Privacy Policy

1. Who we are

The controller of personal information under this Policy is Grail Ranger LLC, a Colorado limited liability company. The product is branded Grail Ranger. We operate a bounty-style marketplace for scarce sports cards and similar collectibles. Buyers post Hunts, Rangers help find current sellers, and Sellers may verify possession and deal sales through the platform. Payments for Finder's Fees and sales are processed through our payment partners so funds can be held and released according to our settlement flow.

2. Information we collect

We collect information you provide, information generated by your use of the Services, and information from service providers that help us run the marketplace.

Account and profile

Email address, authentication identifiers, display labels used on the Services, and account settings. We may also store reliability or standing indicators tied to your account based on marketplace activity.

Marketplace activity

Hunt details, bounty and fee amounts, finder claims, seller invites, deal offers and messages, deal terms, shipping and tracking details you submit, dispute information, and related timestamps.

Verification and evidence

Ownership verification materials you upload or record, such as photos, possession-challenge videos, challenge codes, and Admin review outcomes. These materials are used to confirm possession and reduce fraud.

Device and usage data

IP address, browser or device type, approximate location derived from IP, pages viewed, referral URLs, and diagnostic logs needed to operate, secure, and improve the Services.

Payment and payout data

Transaction amounts, payment method type (for example card, ACH bank debit, or domestic wire), payment status, payout destination status for sellers, and identifiers returned by our payment processors. See the Payments section below for bank-linking details.

3. Payments and Financial Connections

We use Stripe, Inc. and related Stripe services ("Stripe") to process payments, hold sale funds according to our settlement flow, and pay Sellers and Rangers when payouts are due. Depending on the transaction, this may include:

• Card payments
• ACH Direct Debit from a US bank account (including bank account linking through Stripe Financial Connections)
• Domestic wire instructions into a Stripe Treasury financial account when that rail is enabled for a sale
• Stripe Connect Express onboarding and payouts for eligible Sellers and Rangers

When you link a bank account for ACH, Stripe may collect tokenized account and routing information and, where permitted, balance information to help reduce failed payments. Stripe processes that data under Stripe's own terms and privacy notices. We do not use Financial Connections data to sell advertising, to build unrelated financial products, or to underwrite consumer loans.

We generally do not store full bank account numbers ourselves when Stripe tokenizes them for ACH. We may store payment intent identifiers, sale records, wire memo references, and status needed to match funds and support disputes.

4. How we use information

• Provide, operate, and improve the Services
• Create and manage accounts, Hunts, claims, deals, and sales
• Process payments, escrowed holds, inspections, and payouts
• Review ownership evidence and enforce marketplace rules
• Calculate and display reliability or standing signals
• Detect, investigate, and prevent fraud and abuse
• Provide customer support and send service-related notices
• Comply with law, tax, and regulatory obligations
• Protect the rights, safety, and property of Grail Ranger and users

5. How we share information

We share information in these situations:

• Service providers. Vendors that host or operate parts of the Services on our behalf, including Amazon Web Services (hosting and storage), Amazon Cognito (authentication), and Stripe (payments, Financial Connections, and Connect payouts).
• Other users, as needed for a deal. Limited information may be shared so a transaction can proceed. For example, after agreement we may surface shipping or fulfillment details you provide. Public Hunt boards show card details and anonymous buyer labels, not your email, by default.
• Legal and safety. We may disclose information if we believe it is reasonably necessary to comply with law, legal process, or governmental request, or to protect users, the Services, or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction subject to appropriate confidentiality and notice practices.

We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising in the sense used by California privacy law.

6. Anonymity and marketplace visibility

Parts of Grail Ranger are designed to keep Buyers anonymous on the public Bounty Board. Private lead emails and certain verification materials are not shown to Buyers. Admin reviewers and automated systems may access evidence needed to approve ownership and run the marketplace. Do not upload information you are not authorized to share.

7. Retention

We retain information for as long as your account is active and as needed to provide the Services, resolve disputes, enforce agreements, maintain security and reliability records, and meet legal, tax, and accounting requirements. Retention periods vary by record type. For example, payment and sale records may be kept longer than routine diagnostic logs.

8. Security

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure. You are responsible for protecting account credentials and for using a strong, unique password where applicable.

9. Your choices and rights

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information, or to appeal a denied request. To make a privacy request, email privacy@grailranger.com. We may need to verify your identity before completing a request.

California residents: we do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are commonly used under the CCPA/CPRA. You may still contact us to exercise access, deletion, and related rights.

You can also update certain account information in product settings, and you can stop using the Services at any time. Some notices are transactional (for example, payment or security emails) and are not marketing opt-outs.

10. Children

The Services are directed to adults. They are not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

11. International users and storage

We currently operate the Services with a US focus. Personal information is stored and processed in the United States. If you access the Services from outside the United States, you understand that your information may be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date above. If changes are material, we may provide additional notice through the Services or by email when appropriate. Continued use after an update means you accept the revised Policy.

13. Contact

For privacy questions or requests, email privacy@grailranger.com.