Privacy Policy

To operate the Services and deliver the $ertified$tackers experience, we collect the following categories of information:

• Account: email, name, chosen password (stored as a bcrypt hash — we never see your plaintext password), referral code, referral chain, membership tier, community activity.
• Shipping: physical address(es) you provide for order fulfillment.
• Payment: processed by Stripe. We store only a token and the last four digits of your card. We do not store or see your full card number, expiry, or CVC.
• Device & Session: IP address, browser type, device fingerprint, cookies necessary for authentication, and timestamps of your visits.
• Community Content: photos, videos, comments, likes, follows, shares, and metadata you generate on the lifestyle feed.
• Communications: messages you send us via email or support channels.

We use your information to:

• Fulfill and ship orders, deliver event tickets, and register limited-edition serials.
• Credit and manage your $TACK wallet, including daily-accrual, purchase, referral, community, and event-attendance rewards.
• Authenticate you across sessions and secure your account (bcrypt-hashed passwords, HTTPS in transit).
• Send transactional email (order confirmations, shipping updates, ticket delivery, password resets).
• Send marketing email if you have opted in — you may opt out at any time via the unsubscribe link.
• Prevent fraud, chargeback abuse, and violations of our Terms of Service.
• Improve the Services through aggregate analytics that do not identify individual users.

We share only the minimum data necessary with trusted processors:

• Stripe (payments): for processing card transactions. Governed by Stripe’s privacy policy.
• Email delivery: transactional email is delivered by an established provider (e.g., Resend / SendGrid) — placeholder pending vendor lock-in.
• Shipping carriers: we share your shipping address with the fulfillment carrier for your order (e.g., UPS, FedEx, USPS).
• Analytics: aggregate, non-identifying analytics provider — placeholder pending vendor lock-in.

We do not sell your personal information. We do not share your data with advertisers or data brokers.

We use cookies for two purposes:

• Session: a single httpOnly cookie (sertified_session) that keeps you signed in. Required for authentication — cannot be disabled.
• Analytics (future, opt-in): aggregate site analytics. You will be prompted to consent before any analytics cookie is set.

Depending on your jurisdiction (California residents under CCPA/CPRA, European residents under GDPR, and residents of other regions with similar laws), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data (subject to legal retention requirements around orders, taxes, and fraud prevention).
• Request a portable export of your data.
• Opt out of marketing email at any time.

To exercise any of these rights, email privacy@sertifiedstackers.com from the address on your account.

We retain your account data for as long as your account is active. On deletion, most personal data is purged within thirty (30) days, except for information we must retain for legal reasons — including order records for tax and warranty purposes (retention up to seven years), fraud logs, and any content required to be preserved by law.

We apply industry-standard practices to protect your data:

• Passwords hashed with bcrypt (never stored in plaintext).
• All traffic served over HTTPS/TLS.
• Card data handled exclusively by Stripe — never touches our servers.
• Principle of least privilege for internal access to production systems.

No system is perfectly secure. In the unfortunate event of a data breach affecting your personal information, we will notify affected users promptly and comply with all applicable notification laws.

The Services are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from anyone under 18. If we discover that we have inadvertently collected data from a person under 18, we will delete it promptly.

$ertified$tackers is operated from the United States. If you access the Services from outside the United States, your data may be transferred to, and processed in, the United States. Where required by law, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

We may update this Privacy Policy from time to time. Material changes will be announced by email to your account address and via a notice on the Services. The “Last Updated” date at the top reflects the current version.

Privacy questions or requests may be directed to privacy@sertifiedstackers.com.