Privacy Policy - CardFlipz

Effective Date: May 3rd, 2026

Last Updated: May 3rd, 2026

This Privacy Policy explains how Ethereal Springs LLC, doing business as CardFlipz (“CardFlipz,” “we,” “us,” or “our”), collects, uses, shares, and protects information when you access or use CardFlipz.io and related services (the “Services”).

This policy applies to information we collect through the Services, in communications (including email, text, and chat) between you and the Services, and when you otherwise interact with us. It does not apply to information collected by any third party, including through any application or content that may link to or be accessible from the Services.

By using the Services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. This policy may change from time to time (see Changes to This Policy). Your continued use of the Services after we post changes is deemed acceptance of those changes.

1) Who We Are

Legal entity: Ethereal Springs LLC (d/b/a CardFlipz)

Website: cardflipz.io

Contact email: support@cardflipz.io

CardFlipz is a platform that allows users to sell gift cards and receive payment through supported methods. CardFlipz is not a bank, money transmitter, or issuer of gift cards.

2) Notice at Collection

"Personal information" (or "personal data") means information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, phone number, payment information, or any other identifier we may use to contact you.

We collect information to:

• Operate and secure the platform
• Verify identity and prevent fraud
• Process transactions and payments
• Comply with legal and regulatory obligations

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising (targeted ads).

3) Information We Collect

A) Information You Provide

• Account information: name, email, phone number, password, account settings
• Profile or business information (if applicable): business name, role, billing contact details
• Support and communications: messages, emails, chat logs, attachments
• Transaction details: order history, confirmations, disputes, payout records
• Gift card information: brand, denomination, codes or details you submit, and notes you choose to provide

B) Identity Verification (KYC)

To protect the platform and comply with fraud-prevention and financial-crime controls, we may require identity verification.

We use Veriff as our identity verification provider. Depending on the verification flow, this may include:

• Name, date of birth, and address
• Government-issued ID images
• Selfie and liveness verification
• Device, network, and verification metadata

Veriff processes this data under its own privacy notice and retention practices.

C) ACH and Banking Information

If you send or receive payments through ACH, we may collect:

• Bank account and routing numbers
• Account holder name
• Authorization records and audit logs confirming your consent

You may revoke ACH authorization by contacting us, subject to transaction processing timelines and legal requirements.

We and our service providers apply security controls to protect banking information, including secure transmission and protective storage measures.

D) Information Collected Automatically

• Device data: IP address, browser type, operating system, identifiers
• Usage data: pages viewed, actions taken, referral URLs, timestamps
• Approximate location: general location inferred from IP address
• Security data: login activity, risk signals, suspected abuse indicators

4) How We Use Information

We use information to:

• Provide and operate the Services
• Create and manage user accounts
• Verify identity and prevent fraud
• Process transactions and payouts
• Communicate with users and provide support
• Monitor performance, debug issues, and improve reliability
• Enforce our terms and policies
• Comply with legal obligations and lawful requests

5) Cookies and Similar Technologies

We use cookies and similar technologies to:

• Maintain sessions and authentication
• Remember user preferences
• Detect and prevent fraud or abuse
• Measure platform performance

We may also use web beacons (small electronic files also known as pixel tags or clear gifs) in our Services and emails to count users, track activity, and for other related statistics.

You can manage cookies through your browser settings. Disabling cookies may limit certain functionality. Some browsers include a "Do Not Track" (DNT) setting. Because there is no common standard for interpreting DNT signals, our Services do not currently respond to all browser DNT signals.

When you use the Services, third parties such as analytics providers or your device manufacturer may use automatic collection technologies to collect information about you or your device. We do not control these third parties' tracking technologies or how they may be used.

6) How We Share Information

We do not sell personal information.

We do not share personal information for targeted advertising.

We may disclose aggregated or de-identified information that does not identify any individual without restriction. We may share personal information as follows:

A) Service Providers

We share information with vendors that support our operations, including, but not limited to:

• Hosting and infrastructure providers
• Customer support tools
• Security and fraud-prevention services
• Identity verification provider (Veriff)
• Payment and ACH processing partners

The categories of personal information we may disclose to service providers include: account and contact information, payment and banking information, transaction records, identity verification data, device and usage data, and security logs.

B) Legal, Compliance, and Safety

We may disclose information if necessary to:

• Comply with applicable law, regulation, subpoena, or court order
• Investigate fraud, security incidents, or prohibited activity
• Protect the rights, property, or safety of CardFlipz, users, or others

C) Business Transfers

If CardFlipz is involved in a merger, acquisition, financing, reorganization, bankruptcy, or asset sale, information may be transferred as part of that transaction.

7) Data Retention

We retain information only as long as reasonably necessary for the purposes described above, including compliance, fraud prevention, dispute resolution, and enforcement.

Typical retention periods may include:

• Account and transaction records: retained while your account is active and afterward as required for legal, tax, or dispute purposes
• KYC data: retained according to compliance requirements and Veriff’s retention practices
• ACH authorizations: retained for at least two (2) years after authorization termination, or longer if required for audits or disputes
• Security logs: retained for limited periods consistent with security needs

When information is no longer required, we delete or de-identify it unless law requires retention.

8) Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, including access controls, encryption in transit, and security monitoring.

No system is completely secure, and we cannot guarantee absolute security. In particular, email, text, and chat communications sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such channels. Any transmission of personal information is at your own risk. The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal information against unauthorized use, disclosure, and access.

9) Your Privacy Rights

Depending on where you live, including California, Texas, and other U.S. states, you may have rights to:

• Access and receive a portable copy of personal information we collected

• Request deletion of personal information (subject to legal exceptions)

• Correct inaccurate personal information

• Opt out of the sale or sharing of personal information (we do not sell or share for targeted ads)

• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects

• Limit use of sensitive personal information to permitted purposes

• Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights. We will not deny you services, charge you different prices, or provide a different level or quality of service for exercising your rights under applicable law.

How to Submit a Request

Email support@cardflipz.io with the subject line: Privacy Request.

We will verify your identity before responding and will reply within legally required timeframes.

Right to Appeal. If we decline your privacy request, you may appeal our decision by emailing support@cardflipz.io with the subject line: Privacy Appeal. We will respond to your appeal within the timeframe required by applicable law.

Global Privacy Control (GPC). Some browsers and browser extensions support the Global Privacy Control signal. When we detect a GPC signal, we will make reasonable efforts to respect your opt-out preferences as required by applicable law.

Nevada Residents. Nevada law (NRS 603A) provides residents with a limited right to opt out of certain personal data sales. We do not currently sell personal data as defined under Nevada law. If you are a Nevada resident and wish to submit an opt-out request, contact us at support@cardflipz.io.

10) Sensitive Information

Sensitive information may include government ID data, biometric information used for identity verification, and banking details. Where required by applicable law, we collect and process sensitive personal information only with your consent or as otherwise permitted by law.

We use sensitive information only for:

• Identity verification and fraud prevention
• Security and account protection
• Payment processing and ACH instructions
• Compliance and recordkeeping

Veriff’s handling of biometric and identity data is governed by its own privacy notice.

11) Age Restrictions

CardFlipz is intended for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that such information has been collected, we will take steps to delete it.

12) Third-Party Links

The Services may contain links to third-party websites. We are not responsible for their privacy practices.

13) International Users

If you access CardFlipz from outside the United States, you understand that your information may be processed and stored in the United States. We may restrict or refuse service where required by law, sanctions, or compliance obligations.

14) Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last Updated” date. Material changes may be accompanied by additional notice.

15) Contact Us

Ethereal Springs LLC (d/b/a CardFlipz)

Email: support@cardflipz.io