Privacy Policy

1. Scope and Data Controller

This Policy applies to Cardinal.rip and the products and services we provide through it (together, “Cardinal” or the “Services”). The data controller responsible for your personal information is Manta Research LLC, which is referred to in this Policy as “we,” “us,” or “our.”

This Policy applies to our handling of information about site visitors, prospective users, users, and persons who apply for employment through the Services. We refer collectively to these categories of individuals as “you” throughout this Policy. Capitalized terms not defined in this Policy have the meanings given in our Terms of Service.

2. What We Collect and Why

Our guiding principle is to collect only what we need. The categories of information we collect are as follows.

(a) Identity and Access

You may sign in to the Services by means of an email one-time code, a passkey, a supported third-party sign-in provider, or a Solana wallet. Sign-in is handled by our wallet provider, which receives the email address or credential you use and creates a Wallet for your account. We receive an account identifier from our wallet provider. We do not receive your email address, password, or the private key of your Wallet through that process. We assign a handle to your account, which you may change once in any period of thirty (30) days, and we display an avatar generated from the initials of your handle.

(b) Wallets and On-Chain Activity

We store the address of your Wallet and any address to which you withdraw. We monitor your Wallet for deposits so that we may credit them, and we keep a record of each deposit, conversion, and withdrawal, including its blockchain transaction. When you add funds, you authorize us to sign the transactions that move those funds for use in the Services, and we use that authorization only for that purpose. Information recorded on the Solana blockchain is public and permanent, and is not controlled by us.

(c) Account Activity

We keep a record of your balance and of each event that changes it, including Packs you open, Cards you sell back, Upgrades you play (including the chance of success and the result), Plinko drops you play (including the board, the result, and the seeds and nonce used), Cards you Stake, Trades, Listings and offers (including any notes or messages you write), purchases, shipments, and leaderboard points. We require these records to operate your account, to display your history, to maintain the accuracy of balances, to verify outcomes, and to resolve disputes. We also keep a record of the versions of the Terms of Service and Privacy Policy that you accept, and when you accepted them.

(d) Shipping Information

If you request that a Card be shipped, we collect the recipient’s name, address, telephone number, and email address, and we share them with our fulfillment partner and its shipping carrier so that the Card may be delivered and tracking information provided. We store the address so that you may use it again.

(e) Payment Information

Where card payments are available, card information is submitted directly to our payment processor, MoonPay, and does not reach our servers. We store a record of each payment transaction for purposes of account history, crediting the payment, payment support, and the detection of fraud.

(f) General Geolocation Data

We use your IP address transiently to limit the rate at which requests may be made to the Services, for the purposes of security and the prevention of abuse. We do not retain IP addresses in our records and do not use them to track you.

(g) Website Interactions

We collect information about your use of the Services for analytics and statistical purposes, such as measuring which pages are used, how long they are viewed, and where visitors leave, so that we may improve the Services. This includes the pages you view and the page that referred you to them, the time a page is visible and how far it is scrolled, the links and buttons you select, page performance measurements, and certain actions within the Services, such as opening a Pack. It also includes the type of device, browser, and operating system you use and the size of your screen. These records are associated with a random identifier stored in your browser and, if you are signed in, with your account. We do not record the contents of anything you type, the query portion of web addresses, or your IP address. We use these records only to operate and improve the Services; we do not sell them, share them with third parties for their own purposes, or use them for advertising. We retain these records for no longer than thirteen (13) months. Because these records are used only in this manner, the Services do not currently alter this collection in response to Do Not Track or Global Privacy Control signals.

(h) Browser Storage and Cookies

We use a single cookie, which maintains your signed-in session. It is an httpOnly cookie that expires after fourteen (14) days. Your browser also stores your session and your preferences, such as sound, motion, and animation settings, so that the Services may retain them, and the random identifiers described in Section 2(g), which are kept in your browser’s local and session storage rather than in cookies. We do not use advertising or third-party tracking cookies, and we do not display advertising. A cookie is a piece of text stored by your browser. You can adjust cookie settings, and accept or block individual cookies, in your browser settings, although the Services will not function properly if you disable the cookie described above.

(i) Voluntary Correspondence

When you contact us with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you contact us in the future.

(j) Employment Applications

If you apply for a position through our careers page (/careers), we collect the information you submit, which comprises your name, email address, links, an optional resume link or uploaded resume, and message. If you upload a resume, we extract its text and store that text, together with any information the file itself reports about the software used to create it, including whether the file declares that it was generated with artificial intelligence; the uploaded file itself is screened and then discarded, and is not retained. This information is reviewed by our team for the purpose of evaluating your application and communicating with you about it.

3. Information Visible to Other Users

Certain information is made visible to other users and to the public by means of your handle. This includes the live feed of Pack results and Upgrades, the leaderboard, Listings and offers (together with their notes), and Cards that you Stake. Users who attempt Upgrades against your Staked Cards, and users against whose Staked Cards you attempt an Upgrade, can see your handle. You should select a handle that you are comfortable displaying publicly.

4. When We Access or Disclose Your Information

To provide the Services you have requested. We use third-party providers to help operate the Services and provide them to you. These comprise our wallet provider; our card custody and fulfillment partners; shipping carriers; blockchain infrastructure providers, which we use to read the Solana network and to submit transactions; a token-swap service, which we use to convert SOL deposits and which receives your wallet address; our payment processor, where card payments are available; and our hosting provider. Each receives only the information it requires to perform its function.

To investigate, prevent, or take action regarding restricted uses. We review account activity when investigating fraud, Chargebacks, cheating, or other violations of our Terms of Service. If we discover that you are using the Services for a restricted purpose, we will take action as necessary, including notifying appropriate authorities where warranted.

Aggregated and de-identified data. We may aggregate and/or de-identify information collected through the Services. We may use de-identified or aggregated data for any purpose, including analytics and the improvement of the Services.

When required under applicable law. Our policy is to not respond to government requests for user data unless we are compelled by valid legal process or in limited circumstances in the event of an emergency request. It is our policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases. If we are audited by a tax authority, we may be required to disclose financial and transaction information, in which case we will disclose only the minimum required.

Finally, if Cardinal is acquired by or merges with another company, we will notify you before any of your personal information is transferred or becomes subject to a different privacy policy.

5. Your Rights with Respect to Your Information

We strive to apply the same data rights to all users, regardless of their location. These rights include:

• Right to Know. You have the right to know what personal information is collected, used, and shared. We outline both the categories and specific items of data we collect, as well as how they are used, in this Policy.
• Right of Access. This includes your right to access the personal information we gather about you, and your right to obtain information about the sharing, storage, security, and processing of that information.
• Right to Correction. You have the right to request correction of your personal information.
• Right to Erasure. This is your right to request, subject to certain limitations under applicable law, that your personal information be erased from our possession and, by extension, from our service providers. Fulfillment of a data deletion request may result in the closing of your account. Records of transactions are subject to Section 8 and cannot be erased.
• Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
• Right to Restrict Processing. This is your right to request restriction of how and why your personal information is used or processed.
• Right to Object. You have the right, in certain situations, to object to how or why your personal information is processed.
• Right to Portability. You have the right to receive the personal information we have about you and the right to transmit it to another party.
• Right to Non-Discrimination. We do not and will not treat you differently because you have exercised your data privacy rights. However, the exercise of certain rights may, by virtue of your exercising those rights, prevent you from using the Services.

You may change your handle by signing in and updating your account. Please note that certain information may be exempt from such requests under applicable law. For any other request, or if you have questions about exercising these rights or need assistance, please contact us at support@cardinal.rip, stating your handle and the address of your Wallet.

In some cases, we also need to take reasonable steps to verify your identity before responding to a request, which may include, depending on the sensitivity of the information you are requesting and the type of request you are making, asking you to confirm a recent transaction. If we are unable to verify you, we may be unable to respond to your request. If an authorized agent is corresponding on your behalf, we will need written consent from the account holder before proceeding.

Depending on applicable law, you may have the right to appeal our decision to deny your request. We will provide information about how to exercise that right in our response denying the request. You also have the right to lodge a complaint with a supervisory authority. If you are in the European Economic Area or the United Kingdom, you can contact your data protection authority to file a complaint or learn more about local privacy laws.

6. How We Secure Your Data

All data is encrypted via TLS when transmitted between your browser and our servers. The private keys of your Wallet are held by our wallet provider in secure infrastructure and are not accessible to us. We use our authorization to sign for your Wallet only to move your deposits for use in the Services. Your sign-in session expires after fourteen (14) days.

7. What Happens When You Close Your Account

You may request that your account be closed by contacting us at support@cardinal.rip. Before your account is closed, you should withdraw your Credits and any Cards in your Vault, as described in our Terms of Service. If you close your account, we will delete your personal information, including your saved shipping addresses, except for information that we are required to retain under applicable law or that is described in Section 8. Information recorded on a blockchain is not controlled by us and cannot be deleted.

8. Data Retention

We keep your information for the time necessary for the purposes for which it is processed. The length of time for which we retain information depends on the purposes for which we collected and use it and your choices, after which time we may delete and/or aggregate it. We may also retain and use this information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. In particular, records of your balance and of the transactions that changed it are retained as financial records for as long as we are required to retain them, including after your account is closed.

9. Location of Site and Data

Our Services are operated from, and your data is stored in, the United States. If you are located elsewhere, please be aware that any information you provide to us will be transferred to and stored in that location. By using our websites or Services and/or providing us with your personal information, you consent to this transfer.

10. Children

The Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from them. If you believe that a person under that age has provided us with personal information, please contact us at support@cardinal.rip and we will delete it.

11. Changes and Questions

We may update this Policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change to this Policy, we will refresh the date at the top of this page and take any other appropriate steps to notify users.

Questions, comments, or concerns about this Policy, your data, or your rights with respect to your information may be directed to support@cardinal.rip.