Privacy Policy
Template, not legal advice. Fill the [PLACEHOLDERS] and get attorney review before publishing. Two items must match the real implementation: (a) whether captured screenshots/uploaded images are stored and for how long, and (b) whether any user data/images train AI models.
How Dryden Labs LLC ("Pullt," "we") collects, uses, shares, and protects your information across the Pullt website, app, and browser extension (the "Service").
1. Information We Collect
- You provide: account (name, email, hashed password), collection data (cards, sets, conditions, notes, valuations), uploaded images (card photos), communications. Your card images are sent to an AI vision providerto identify the card (see "AI processing" below).
- Payment: processed by Stripe; we receive limited info (subscription status, last4, brand, country). We don't store full card numbers.
- Extension (screenshot capture): when you actively trigger it, the extension captures only the screen region you select, transmits it securely to our servers and/or our AI vision provider to identify the card + return an estimate. It captures only on your action; it does not continuously record your screen. [CONFIRM: whether captures are stored, for how long, and whether used to improve models — must match code + Chrome disclosures.]
- Automatic (analytics): IP, browser/extension version, device/OS, features used, timestamps, diagnostics. Cookies (see §6).
- From third parties: card/price data (providers) + ID results (AI vision) — about cards, combined with your queries.
2. How We Use It
Operate the Service; store/display your collection + images; process screenshots to ID cards + estimate; billing/renewals for Pro (Stripe); support; analytics to maintain/secure/improve; fraud prevention; service + (opt-out) marketing communications; legal compliance. [CONFIRM model-training disclosure.]
2a. AI Processing of Your Images
To identify your cards and estimate values, Pullt sends your card images — photos you upload and the screen regions you capture with the extension — to a third-party AI vision provider. The AI analyzes the image to recognize the player/character, set, edition, parallel, and apparent condition, and returns an identification plus an estimated value. This processing happens only when you take an action that needs it (uploading a photo, scanning, or capturing a region) — we do not continuously scan or record your screen. AI results are automated estimates and can be wrong; see our Terms for the full AI / not-advice disclaimer. The AI provider processes images on our behalf under contract and is not permitted to use them for its own purposes. [CONFIRM the AI provider, whether images are retained by it or by us and for how long, and whether any images are used to train models — this must match the actual implementation and Chrome Web Store disclosures.]
3. How We Share It
We do not sell your personal information. We share with: processors (Stripe payments; hosting [Vercel + Supabase/Cloudflare R2]; AI vision provider; price-data providers — we send card queries, not your identity, where feasible; analytics/error-monitoring); legal/safety; business transfers; with your consent.
4. Storage & International Transfers
Stored/processed in [the United States]. EU/UK transfers rely on Standard Contractual Clauses.
5. Retention
As long as your account is active or as needed for the Service/legal/disputes. On deletion we delete/anonymize within [30–90] days, except records we must keep (billing/tax). [CONFIRM screenshot/image retention.]
6. Cookies
Used to keep you signed in, remember preferences, secure, and measure usage. Control via browser; EU/UK/CA users get a consent/opt-out mechanism for non-essential cookies.
7. Your Rights
Access, correct, delete, port, restrict, object — via settings or [PRIVACY EMAIL]. No discrimination for exercising rights.
- 7.1 California (CCPA/CPRA):know/access, delete, correct, opt out of sale/share (we don't sell), limit sensitive PI. Categories collected: identifiers, commercial info, internet/usage activity, visual info (card images), inferences.
- 7.2 Europe/UK (GDPR): legal bases = contract, legitimate interests, consent, legal obligation; rights incl. access/rectification/erasure/restriction/portability/object/withdraw consent; right to complain to your DPA.
8. Security
TLS in transit, access controls, hashed passwords. No system is perfectly secure. Breaches notified as legally required.
9. Children
Not directed to children under 13 (16 in some regions); we don't knowingly collect their data.
10. Third-Party Links/Marketplaces
The Service may interact with third-party sites (Whatnot, eBay). This Policy doesn't cover them; review theirs. Pullt is independent and unaffiliated.
11. Changes
Updates posted with a new date; material changes get extra notice.
12. Contact
Dryden Labs LLC · [PRIVACY EMAIL] · 12951 Huebner Rd, Unit 780665, San Antonio, TX 78230