Privacy Policy

1Introduction

Ritual Labs LLC, a Delaware limited liability company (“Ritual Labs,” “we,” “us,” or “our”), operates the Ritual Rips mobile application and the website located at ritualrips.com (collectively, the “Service”). This Privacy Policy describes the personal information we collect, how we use and disclose it, how long we retain it, and the rights and choices available to you.

This Privacy Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

Ritual Labs is the business responsible for the personal information described in this Privacy Policy. We are the merchant and seller of record for every transaction conducted through the Service.

1.1Scope

This Privacy Policy applies to personal information we process in connection with the Service. It does not apply to the independent practices of third parties whose own privacy policies govern information you provide directly to them — most importantly the identity documents and payment credentials you submit to our payment provider, which we never receive.

1.2Geographic Scope

The Service is offered only to residents of the United States, and only in those states in which it is available. We do not offer the Service in the European Economic Area, the United Kingdom, or elsewhere outside the United States, and we do not direct the Service to residents of those regions. Personal information collected through the Service is processed and stored in the United States.

1.3A Summary, in Plain Terms

The detail that follows is the operative text. In summary:

• We do not sell your personal information and we do not share it for advertising. We run no advertising, use no advertising identifiers, and operate no cross-site or cross-application tracking.
• We never see your identity documents, your payment card number, or your face. Identity verification, including any liveness check, is performed by our payment provider and its own verification vendor. We receive a pass or fail outcome and a reference to it.
• We hold funds and we ship physical goods, so some records we are required by law to keep for five years or more. Deleting your account does not delete those.
• You can ask us what we hold, correct it, delete it, or export it, from inside the app, by email, or through a web form.

2Personal Information We Collect

2.1Information You Provide to Us

Account data. Your email address, and your name if you choose to provide one, when you register.

Eligibility data. Your attestation that you are eighteen (18) years of age or older, the state of residence on which your eligibility is determined, and your acceptance of our Terms of Service and this Privacy Policy — each recorded with a date and time and with the specific document versions presented to you.

Identity data. Your full legal name, date of birth, residential address, Social Security number or taxpayer identification number, and a government-issued photographic identification document, together with a selfie or other liveness check where required. This information is collected and verified by our payment provider and its identity-verification vendor, not by us. See Sections 2.5 and 4.1.

Tax data. Where your withdrawals of sale proceeds reach the threshold at which we are required to report them, the information required to complete an IRS Form W-9 — your legal name, address, and taxpayer identification number — collected through our payment provider. See Section 3 and Section 5, and Section 32 of the Terms of Service.

Banking data. Where you connect a bank account in order to withdraw funds, the account credentials and account details you provide in that flow. These are collected by Plaid, Inc. on behalf of our payment provider. We do not receive your banking credentials. See Section 4.1.

Source of funds data. Information and documentation concerning the origin of funds you deposit, where our anti-money-laundering obligations require us to request it.

Fulfillment data. The recipient name and shipping address you provide when you request physical delivery of a Card, together with any address correction returned by address validation.

Communications data. The contents of messages you send to our support, compliance, privacy, or security functions, and any attachments, including photographs you submit in support of a delivery or damage claim.

Purchasing-control data. Any deposit limit, spending limit, cooling-off period, or account self-suspension you set, and its duration. See Section 29.10 of the Terms of Service.

2.2Information Generated by Your Use of the Service

Transaction data. Packs purchased, Cards allocated, buyback offers accepted or lapsed, shipment requests, deposits, withdrawals, and refunds.

Financial data. Your Balance and the complete ledger of entries comprising it.

Verification status data. Whether your identity verification has been completed, its outcome, and a reference to the check performed by our payment provider.

Fairness and draw records. For each purchase, the commitment published to you before the draw, the client seed associated with your purchase, the seed revealed after settlement, the resulting allocation, and the provider session identifier by which the draw can be re-derived. These records are retained so that you can verify any purchase. See Section 29.6 of the Terms of Service.

Device and technical data. Device type, operating system, application version, and diagnostic and error data.

Network data. The Internet Protocol (IP) address from which each request originates, from which we infer general location for eligibility and fraud purposes.

Authentication data. Session records and related security metadata maintained by our authentication provider.

2.3Cookies and Similar Technologies

The mobile application stores data on your device in order to function: your authentication session, held in the operating system’s secure credential storage (Keychain on iOS, Keystore on Android), and a local cache of your collection and display preferences. This data remains on your device. You may clear it by signing out or by deleting the application.

The website uses only cookies and similar storage that are strictly necessary to operate it — maintaining your signed-in session, securing that session, and remembering preferences you have set. We do not use advertising cookies, analytics cookies, or third-party tracking technologies, and we do not engage in cross-site or cross-application tracking.

Because we do not track you across sites or applications and do not sell or share personal information, a Global Privacy Control or “Do Not Track” signal does not alter our handling of your information; there is no sale, sharing, or targeted advertising for such a signal to restrict.

2.4Information We Do Not Collect

Complete payment card numbers. Payment card details are transmitted directly to our payment provider. We neither receive nor store them.

Identity documents and complete government identification numbers. Our payment provider and its verification vendor collect and verify these. We receive a pass or fail outcome and a reference to the verification performed.

Banking credentials. Credentials you enter to connect a bank account are collected by Plaid, Inc. and are not transmitted to us.

Advertising identifiers and cross-context behavioral data. We do not collect them and do not use advertising software development kits.

Precise geolocation. We do not collect GPS or other precise location data, and the Service does not request location permission. We infer your general location only from your IP address and from the addresses you provide.

2.5Biometric Information

Identity verification may include a liveness check — a selfie or short video compared against your government-issued identification document. Depending on how it is performed, that check may involve the processing of a biometric identifier within the meaning of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and comparable state law.

That check is performed by our payment provider and its identity-verification vendor, not by Ritual Labs. We do not capture the image, we do not receive the image, and we do not receive or store any biometric template, scan, or measurement derived from it. What we receive is the outcome of the check and a reference to it.

The provider performing the check is responsible for obtaining any consent its own processing requires and for its own retention and destruction schedule, which are governed by that provider’s privacy notice, presented to you at the point of verification. We do not use any biometric information for any purpose other than verifying that you are who you say you are, we do not use it to identify you across services, and we do not sell, lease, trade, or otherwise profit from biometric information.

If you would prefer not to undergo a liveness check, you may use the Service without completing identity verification; you will not, however, be able to withdraw funds, and you may not be able to request physical delivery. See Section 5.1 below and Section 32.3 of the Terms of Service.

3How We Use Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your personal information for advertising purposes of any kind, and we do not use it to build a profile of you for any purpose other than those stated above.

4How We Disclose Personal Information

4.1Service Providers

We engage a limited number of service providers to operate the Service. Each receives only the personal information necessary for its function, under a written contract restricting its use of that information to the purposes we specify and prohibiting its sale.

Sub-processors. Certain of the providers above engage their own sub-processors to perform part of their function — Plaid for bank connection and an identity-verification vendor for document and liveness checks are the two that handle your information most directly, and both are engaged by our payment provider. Each such sub-processor is bound by its principal’s contract with us and by its own agreement with that principal. We require each provider to impose equivalent restrictions on its sub-processors.

4.2Legal and Compliance Disclosures

We may disclose personal information:

1. where required by applicable law, regulation, legal process, or governmental request;
2. to governmental authorities where our anti-money-laundering or sanctions obligations require it, as described in Section 5;
3. to the Internal Revenue Service and to state taxing authorities, in the information returns we are required to file in respect of amounts paid to you;
4. to state unclaimed-property authorities, where an inactive Balance must be reported and remitted under applicable unclaimed property law;
5. to investigate, prevent, or respond to suspected fraud, security incidents, violations of our Terms of Service, or threats to the safety of any person;
6. to our professional advisors, including legal counsel, auditors, and accountants, under a duty of confidentiality; and
7. to establish, exercise, or defend legal claims.

4.3Corporate Transactions

In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, we may disclose personal information to the counterparty and its advisors. We will notify you of any such transfer, and the recipient will remain bound by this Privacy Policy until you are notified otherwise.

5Anti-Money-Laundering, Identity Verification, and Tax Reporting

Because the Service permits you to deposit funds, hold a Balance, and withdraw funds, we are subject to United States anti-money-laundering and tax-information-reporting obligations. These affect our handling of certain personal information and limit certain of your choices.

This Section describes those obligations as they bear on your personal information. The controls they place on your account and your transactions — verification before withdrawal, withdrawal limits and holding periods, transaction monitoring thresholds, prohibited conduct, and our rights of refusal, freezing, and termination — are set out at Section 32 of the Terms of Service, which governs them in full.

5.1Identity Verification

You must complete identity verification before you may withdraw funds from the Service. You may register, deposit, and purchase Packs before completing verification; verification is required at the point at which funds are to leave the platform, and may also be required before we will dispatch a physical shipment.

Verification is performed by our payment provider on our behalf and ordinarily requires:

1. your full legal name;
2. your date of birth;
3. your residential address;
4. your Social Security number or taxpayer identification number; and
5. a government-issued photographic identification document, together with a selfie or other liveness check where required.

We do not receive or store your identification documents, your complete government identification number, or any image or biometric template derived from a liveness check. Our payment provider and its verification vendor collect and verify that information; we receive the outcome of the verification and a reference to it. See Sections 2.5 and 4.1.

We retain the outcome, a reference to the verification, and the name, address, and date of birth on which we relied.

5.2Further and Repeated Verification

We may require verification, or re-verification, at any other time, including where:

1. the amounts involved or the pattern of your activity warrants enhanced due diligence;
2. information we hold concerning you appears inaccurate, incomplete, or outdated;
3. you change your withdrawal instrument, email address, or other material account details;
4. our monitoring identifies activity requiring review; or
5. applicable law otherwise requires it.

5.3Source of Funds

Where our obligations require it, we may request information and documentation concerning the source of the funds you deposit and the purpose of your activity on the Service. We may decline to process any deposit, purchase, buyback, or withdrawal pending your response.

5.4Sanctions Screening

We screen Users against United States government sanctions and restricted-party lists, including those administered by OFAC, upon registration and periodically thereafter. We screen against those lists as they stand from time to time; we do not maintain our own list in this Privacy Policy, because sanctions designations change without notice.

5.5Transaction Monitoring and Review

We monitor activity on the Service for patterns associated with money laundering, fraud, and abuse.

Transactions exceeding internal thresholds, and transactions identified by our monitoring, are placed in a review queue and are examined by a member of our compliance function before completion. Automated systems do not resolve such transactions.

We do not publish our monitoring thresholds or the specific patterns to which our monitoring is calibrated. Publication would inform the conduct the monitoring is designed to detect.

5.6Tax Information and Reporting

Proceeds you receive from selling Cards back to us, and other amounts we pay to you, may constitute reportable income.

Where the total you withdraw in a calendar year reaches six hundred U.S. dollars ($600), we are required to collect your taxpayer information and to report those amounts. We will request the information required to complete an IRS Form W-9 — your legal name, address, and taxpayer identification number — through our payment provider.

Withdrawals are paused once you reach that threshold and remain paused until the required tax information is complete. This is not a penalty and not a review under Section 5.5; it is a reporting prerequisite, and the pause lifts as soon as the forms are in order. Your Balance is unaffected, you may continue to use the Service, and nothing is forfeited.

Where we are required to do so, we will furnish you with the corresponding information return and will file a copy with the Internal Revenue Service and, where applicable, with your state taxing authority.

We do not provide tax advice, and we recommend that you consult a qualified tax professional. You remain responsible for determining and meeting your own tax obligations. See Section 11.3 of the Terms of Service.

5.7Reporting of Suspicious Activity, and the Limits on What We May Explain

We are required to report certain activity to governmental authorities. Applicable law prohibits us from disclosing that such a report has been made or from disclosing its contents. Accordingly, in certain circumstances we are unable to explain a refusal, a hold, or an account closure, and are unable to comply with a request to delete the underlying records.

We may be unable to explain such action to you. United States law prohibits us from disclosing that a report concerning account activity has been filed or considered, or from disclosing the contents of such a report. This prohibition is a matter of law and is binding upon us. Where we are permitted to explain, we will.

5.8Cooperation With Authorities

We cooperate with law enforcement and with governmental and regulatory authorities, and will provide information concerning a User and that User’s activity where we are required or permitted by law to do so. We also notify our payment processor of activity we identify as illegal, fraudulent, deceptive, or otherwise suspicious, as our agreement with that processor requires.

5.9Inactive Accounts and Unclaimed Balances

Every state has unclaimed property law, under which funds held for a person who cannot be located and who has not engaged with the account for a statutory period must be reported and remitted to that state.

Where your account remains inactive for the period prescribed by the unclaimed property law applicable to you, we may be required to report and remit your Balance to the appropriate state authority. Before we do so, we will attempt to contact you at the email address associated with your account, at the last address we hold for you, and within the Service. See Section 32.7 of the Terms of Service.

5.10Recordkeeping

We retain identity verification records and transaction records for not less than five (5) years following the closure of your account, as required by the Bank Secrecy Act and its implementing regulations, and for longer where tax or other law so requires.

This retention survives a request to delete your account. Upon closure we delete the personal information we are able to delete and retain that which we are required to retain, under restricted access and for the sole purpose requiring its retention. See Section 6.

5.11Reporting Concerns to Us

If you believe that another person is using the Service to launder money, or that your own account has been compromised or is being used by another person, contact us immediately at compliance@ritualrips.com. Reports are treated in confidence.

6Retention

We retain personal information for the periods set out below, after which it is deleted or de-identified. Where more than one period applies to the same record, the longest governs.

Closure of your account does not result in the immediate deletion of all personal information. Records we are legally required to retain are held for the periods stated above, under restricted access, and are used solely for the purpose requiring their retention.

7Your Privacy Rights

Depending upon your state of residence, you may have the right to:

1. Know and access the personal information we have collected about you, the categories of sources from which it was collected, the purposes for which it is used, and the categories of third parties to which it has been disclosed;
2. Correct inaccurate personal information;
3. Delete your personal information, subject to the records we are required to retain under Sections 5 and 6;
4. Obtain a portable copy of your personal information in a structured, commonly used, machine-readable format;
5. Opt out of the sale or sharing of personal information and of targeted advertising — we engage in none of these;
6. Limit the use of sensitive personal information — we use it solely for the purposes described in Section 3, each of which is a permitted purpose; and
7. Appeal a decision declining a request.

7.1How to Exercise Your Rights

We will respond to your request within forty-five (45) days. Where reasonably necessary, we may extend that period by a further forty-five (45) days and will notify you of the extension and the reason for it within the initial period.

No charge applies to a request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act and will explain why.

A note on account deletion. Because we hold funds and property for you, we cannot close an account that still holds either. Before your account can be deleted you must withdraw your Balance and either accept a buyback offer for, or request shipment of, each Card you hold. See Section 3.4 of the Terms of Service.

7.2Verification of Requests

We will take reasonable steps to verify your identity before acting on a request, ordinarily by confirming control of the email address associated with your account. We request the minimum information necessary for that purpose and do not retain information submitted for verification longer than the request requires.

7.3Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We will require written proof of the agent’s authority and may additionally require that you verify your own identity directly with us.

7.4Appeals

If we decline a request, our response will state the reason and will describe how to appeal. To appeal, write to privacy@ritualrips.com with “Privacy Appeal” in the subject line. We will respond to an appeal within forty-five (45) days with our decision and the reasons for it. If you are dissatisfied with the outcome, you may submit a complaint to the Attorney General of your state.

7.5Non-Discrimination

We will not discriminate against you for exercising any privacy right. We will not deny you the Service, charge you a different price, provide you a different level of service, or suggest that we will do any of these things because you exercised a right.

8State-Specific Disclosures

8.1California

This Section supplements the foregoing for residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

Categories collected. In the preceding twelve (12) months we have collected the following categories of personal information: identifiers; personal information described in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)); commercial information; internet or other electronic network activity information; and, as sensitive personal information, a government identifier, account log-in and financial account information handled by our payment provider, and — as described in Section 2.5, and processed by that provider rather than by us — information that may constitute biometric information processed for the purpose of uniquely identifying you.

Sources. Personal information is collected from you directly, from your use of the Service, from our payment provider in the form of verification outcomes and tax information, and from our fulfillment provider in the form of order and delivery records.

Purposes. As described in Section 3.

Disclosures for a business purpose. In the preceding twelve (12) months we have disclosed each of the categories above to the service provider categories identified in Section 4.1.

Sale and sharing. We have not sold or shared personal information, as those terms are defined by the CCPA, in the preceding twelve (12) months, and we do not do so. We have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age.

Sensitive personal information. We use and disclose sensitive personal information only for the purposes enumerated in section 7027(m) of the CCPA regulations. We do not use sensitive personal information for the purpose of inferring characteristics about you, and accordingly the right to limit its use does not apply.

Retention. As described in Section 6.

8.2Illinois, Texas, and Other Biometric Privacy Statutes

As described in Section 2.5, Ritual Labs does not collect, capture, or store biometric identifiers or biometric information. Any liveness check forming part of identity verification is performed by our payment provider and its verification vendor, under that provider’s own notice and consent. We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

8.3Other States

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive consumer privacy legislation have the rights described in Section 7, including the right to appeal a declined request under Section 7.4, and may exercise them by the methods described in Section 7.1.

We do not process personal information for the purposes of targeted advertising, the sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects. Accordingly, no opt-out of those activities is required.

8.4Nevada

Nevada residents may direct us not to sell certain personal information. We do not sell personal information. Requests may nonetheless be submitted to privacy@ritualrips.com.

9Children’s Privacy

The Service is intended solely for adults and is not directed to anyone under eighteen (18) years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under eighteen, we will delete that information and close the account, subject to the records we are required to retain.

If you believe that a child has provided personal information to us, please contact privacy@ritualrips.com.

10Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit, encryption of sensitive data at rest, role-based access controls limiting staff access to what a role requires, secure storage of credentials on your device, and logging of access to systems that move money. Payment card numbers, identity documents, and banking credentials do not enter our systems.

No method of transmission or storage is entirely secure, and we cannot guarantee absolute security.

10.1Breach Notification

In the event of a breach of security affecting your personal information, we will notify you and the applicable regulatory authorities as and when required by applicable state law, without unreasonable delay.

10.2Reporting a Vulnerability

To report a security vulnerability, please contact security@ritualrips.com. We investigate all reports received and will not pursue action against researchers who report in good faith and who do not access, modify, or exfiltrate the data of others.

11Third-Party Services

The Service may contain links to websites or services operated by third parties. We are not responsible for the privacy practices of any third party, and this Privacy Policy does not apply to them. We encourage you to review the privacy policy of any third-party service before providing personal information to it.

12Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where a change is material, we will provide notice within the Service before it takes effect and will request your acknowledgment of the revised version. The Version and Effective Date at the top of this Privacy Policy always reflect the current text. Prior versions are available upon request.

13Contact Us

Privacy inquiries and requests: privacy@ritualrips.com General support: support@ritualrips.com Security reports: security@ritualrips.com

Ritual Labs LLC Attn: Privacy 838 Walker Road, Suite 21-2 Dover, DE 19904 United States

Related policy: Terms of Service