Privacy Policy

1.What we collect

We collect the information described below. We do not collect more than we need to run the Platform.

• Account information — email address, password (stored as a salted hash, never in plain text), or a Google account identifier if you sign in with Google; username; date of birth (used only for the age gate — see Section 2); your acceptance of these policies and the version accepted.
• Identity verification outcome — see Section 3. We do not receive or store your government ID.
• Shipping information — name, street address, city, state, and ZIP code for any card you ask us to ship, plus carrier and tracking data once it ships.
• Payout destination — the PayPal or Venmo email or handle you give us to receive cash-out proceeds.
• Transaction and activity data — your wallet balances, the ledger of pack opens, sell-backs, top-ups, shipments, and withdrawals, and gameplay activity such as missions, streaks, and promo-code use.
• Location data — an approximate location derived from your IP address. See Section 7.
• Device and log data — your IP address, and standard request metadata (timestamps, the action taken, a request identifier) recorded in our audit log for security, fraud prevention, and dispute resolution.
• Support communications — anything you send us at support@slabbed.us or through the support page.

2.How we use it

We use the information above to:

• Create and secure your account, and verify you meet our age and location requirements.
• Operate pack openings, maintain your vault, and process shipping, sell-back, and cash-out requests.
• Process payments and payouts through our processors (Section 5), and verify your identity before a first payout.
• Detect and prevent fraud, abuse, and chargebacks, and investigate suspected violations of our Terms.
• Send transactional email — order and shipping confirmations, security notices, and responses to support requests.
• Comply with law, including tax reporting, sanctions screening, and responding to lawful requests from authorities.
• Maintain the durable transaction and audit record described in Section 8, for disputes and compliance.

We do not use your information to build an advertising profile, and we do not sell your personal information.

3.Identity verification

Cash withdrawals require identity verification through Stripe Identity. When you complete verification, Stripe processes your government ID and related biometric data on our behalf, under Stripe's own privacy policy. We receive only the verification outcome (verified or not), a reference to that verification session, and a one-way cryptographic fingerprint we use to detect one person operating multiple accounts.

4.Payments and payouts

• Card top-ups are processed by Stripe. We do not store your full card number; Stripe tokenizes it and shares only what we need to process the charge and handle refunds or disputes.
• Cash withdrawals are sent via PayPal or Venmo. We store your chosen payout destination (email or handle) and share the payout amount and that destination with the provider to complete the transfer.
• Where the law requires it, we may collect tax information (such as an IRS Form W-9 or W-8) before releasing a payout, and report amounts paid to you.

5.Who we share it with

We do not sell or rent your personal information. We share it only as follows:

• Stripe — payment processing and identity verification.
• PayPal and Venmo — cash-out payouts.
• Google — if you choose to sign in with Google, we receive your verified email address and account identifier to create or link your account.
• USPS — address verification for shipments, to reduce misdelivery.
• Resend — our email provider, used to deliver transactional email (order confirmations, security notices). Not used for marketing.
• Sentry — error monitoring, so we can find and fix bugs. Error reports are configured to avoid capturing sensitive fields; see our internal logging policy.
• Vercel and Railway — our hosting infrastructure for the website and backend, and the Postgres database that stores the information described in Section 1.
• Shipping carriers — the address needed to deliver a card you ask us to ship.
• Grading and market-data providers (e.g. PSA, card pricing services) — these receive card certification and pricing lookups, not your personal information.
• Legal and safety — we may disclose information where required by law, to respond to a valid legal process, to enforce our Terms, or to protect the rights, safety, or property of Slabbed, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a successor policy you are notified of.

Each of these providers processes information under its own privacy policy and only for the purpose described above.

6.Cookies and similar technologies

We use a small number of cookies and similar technologies to run the Platform:

• Authentication cookie — keeps you signed in. It is essential to the Platform and is not readable by scripts on the page.
• Location claim (vr_geo) — a cookie holding your approximate country and state, cryptographically signed so our backend can trust it, valid for up to 12 hours. It exists solely to enforce the geographic and state restrictions described in Section 7 and Terms Section 17. Unlike the authentication cookie, this one is readable by the page itself, because our app needs to send it along with your requests — it carries only your approximate location, not your identity.

We do not use third-party advertising or cross-site tracking cookies.

7.Location data and state restrictions

We derive an approximate country and state from your IP address when you visit the Platform. We use this solely to determine whether the Platform is available to you under our list of restricted states — never for advertising, profiling, or any purpose unrelated to that eligibility check. We also check the state on any shipping address you submit against the same list, since a shipment to a restricted state is blocked regardless of where you accessed the Platform from.

Location data derived this way is approximate, not precise geolocation, and we do not request or use device GPS data.

8.Retention

• We keep account information for as long as your account is active, and for a limited period after closure to handle disputes, comply with law, and satisfy unclaimed-property requirements described in our Terms.
• Transaction and audit records — your wallet ledger and audit log entries — are retained longer than ordinary account data, because they are the durable record we and, where relevant, a payment processor or regulator may need for a dispute, chargeback, or compliance inquiry.
• Identity verification outcome is retained for as long as required to meet our KYC obligations; we never hold the underlying ID document, which Stripe retains under its own policy.
• You may ask us to delete your account under Section 11; we will do so except where we are required or permitted to retain certain records as described above.

9.Security

We use industry-standard measures to protect your information, including encryption in transit, hashed password storage, and access controls limiting who can view sensitive data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@slabbed.us.

10.Children

The Platform is not directed to, and we do not knowingly collect personal information from, anyone under 18. Our Terms require you to be at least 18 (or older where your state requires it) to use the Platform. If we learn that we have collected information from someone under 18, we will delete it. If you believe a minor has provided us information, contact us at support@slabbed.us.

11.Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information, subject to the retention needs in Section 8.
• Receive a copy of your information in a portable format.
• Appeal a decision we make on one of these requests.

To exercise any of these rights, email support@slabbed.us. We will verify your identity before acting on a request. We will not discriminate against you — with a different price, service level, or denial of service — for exercising a privacy right.

12.State-specific rights

These rights apply regardless of whether you are eligible to use the Platform. Several of the states on our restricted list have their own privacy laws that reach residents whose data we collected — for example before an account was blocked, or in connection with a support request.

California (CCPA/CPRA).

• The categories of information we collect and the business purposes for collecting them are described in Sections 1 and 2.
• We do not sell or share personal information, and we do not engage in cross-context behavioral advertising.
• We treat your date of birth and the outcome of identity verification as sensitive personal information, and we use it only to operate the age gate and KYC requirements described in Sections 2 and 3 — never for any other purpose.
• You have the rights described in Section 11, plus the right to limit use of sensitive personal information (which we already limit as stated above) and to designate an authorized agent to make a request on your behalf.

Other states with comprehensive privacy laws (including Connecticut, Montana, and Tennessee) provide similar rights of access, correction, deletion, portability, and appeal. Contact support@slabbed.us to exercise any of them; we will respond within the time your state's law requires.

13.Third-party links and services

The Platform may link to third-party sites or services (for example a grading company's certification lookup, or a payment provider's own site). Those sites have their own privacy practices, and this Policy does not cover them. We encourage you to review their policies before providing information to them.

14.Changes to this Policy

We may update this Policy from time to time. When we make a material change, we will update the version identifier and effective date at the top of this page, and where required we will notify you by email or an in-product notice. Because this Policy is incorporated into our Terms of Service, a material change to either is generally made and dated together.

15.Contact us

Questions about this Policy, or to exercise a privacy right described above: support@slabbed.us, or through our support page.

Slabbed LLC
908 College Place CT NW, Kennesaw, GA 30144