Pullz Privacy Policy

Last updated: July 15, 2026

This Privacy Policy explains how LUPOHMIGNS KFT, the company that operates Pullz ("Pullz," "we," "us") collects, uses, shares, and protects personal information when you visit pullz.ai, use the Pullz app, join our waitlist, or otherwise interact with our services (the "Service"). It also describes your privacy rights and how to exercise them.

By using the Service you agree to this Policy. If you do not agree, do not use the Service. This Policy is incorporated into our Terms of Service.

The Service is intended only for individuals 18 and older. We do not knowingly collect information from anyone under 18 (see Section 9).

1. Information We Collect

A. Information you provide

• Waitlist / contact: email address and any details you submit.
• Account: name, email, phone number, password, and username.
• Identity & age verification (KYC): date of birth, government-issued ID, and related documentation we or our verification providers use to confirm your identity, age, and residency.
• Payment & transactions: billing details and a record of your purchases, Reveals, Cards, sell-backs, Store Credit, Plays/Tokens, EXP, Reveal Credit, and redemptions. Full payment-card numbers are handled by our payment processor; we do not store complete card numbers.
• Shipping: mailing address and delivery information.
• Communications: messages, support requests, and survey or feedback responses.
• Store Credit and transactions. Your Store Credit balance and a ledger of every credit and debit (purchases, buyback proceeds, promotional credit) are stored on our servers so your balance is always accurate and auditable. Store Credit is not money: it cannot be purchased, withdrawn, or transferred, and it is spendable only inside Pullz. Your balance and ledger are deleted permanently when you delete your account.
• Lucky Cam recordings. If you turn on Lucky Cam, the app records a short front-camera video (with audio) of your reveal. The clip uploads to our servers so you can preview it; it is visible to other users only if you choose "Post to Live." You can discard a clip instead of posting, and all your clips are deleted when you delete your account.

B. Information collected automatically

• Device & technical data: IP address, device identifiers, browser type, operating system, and app version.
• Usage data: pages and screens viewed, features used, Reveals, clicks, and timestamps.
• Location: approximate location derived from IP address, used to confirm eligibility and apply geographic restrictions.
• Cookies & similar technologies: see Section 6.

C. Information from third parties

• Identity-verification and fraud-prevention providers, payment processors, analytics providers, and fulfillment/shipping partners may share information with us to deliver and secure the Service.

Sensitive personal information. Government ID and date of birth are treated as sensitive personal information. We collect and use them only to verify identity and age, to comply with law, and to prevent fraud — not to infer characteristics about you.

2. How We Use Information

We use personal information to:

• create and manage your account and provide the Service;
• verify your age, identity, and eligibility, and meet legal, regulatory, anti-fraud, and anti-money-laundering obligations;
• process purchases, shipments, sell-backs, and Store Credit;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• support responsible-use tools such as spending limits and self-exclusion;
• analyze and improve the Service and develop new features;
• communicate with you about your account, transactions, and service updates;
• send marketing communications where permitted or with your consent, from which you can opt out at any time; and
• comply with law and enforce our Terms.

Legal bases (where GDPR/UK GDPR applies): performance of our contract with you; compliance with legal obligations; our legitimate interests in operating, securing, and improving the Service; and your consent (which you may withdraw).

3. How We Share Information

We do not sell your personal information for money. We share it only as follows:

• Service providers / processors acting on our behalf, including payment processing, identity/age verification, fraud prevention, cloud hosting and database, email and messaging, analytics, and shipping/fulfillment. They may use the information only to provide services to us.
• Legal, safety, and compliance: to comply with law, lawful requests, or regulators; to enforce our Terms; or to protect the rights, safety, and property of Pullz, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent.

"Sharing" for cross-context behavioral advertising (California). If we use advertising cookies that constitute "sharing" under California law, you may opt out as described in Sections 6 and 8.

4. Analytics and Advertising Technologies

We use analytics tools (which may include Mixpanel and PostHog) to understand how the Service is used and to improve it — for example, which screens you view, your taps and interactions, purchases, and app-lifecycle events. These analytics events may be linked to your account identifier and email so we can support you and improve your experience. These tools collect usage and device data, may set cookies or use similar identifiers, and process data under their own privacy terms. Where required, we obtain consent before deploying non-essential analytics or advertising technologies. You can control these through the methods in Sections 6 and 8.

5. Data Retention

We keep personal information for as long as needed to provide the Service and for legitimate business and legal purposes — for example, identity-verification and transaction records are retained as long as required by anti-money-laundering, tax, and consumer-protection laws. When information is no longer needed, we delete or de-identify it. When you delete your account, we delete your personal information, except limited records we are legally required to retain (such as transaction and tax records), which we keep only as long as the law requires and then delete.

6. Cookies and Similar Technologies

We use:

• Strictly necessary cookies to operate the Service, keep you logged in, and secure it;
• Functional cookies to remember your preferences;
• Analytics cookies to measure and improve performance; and
• Advertising cookies (if used) to measure and tailor marketing.

You can manage cookies through your browser settings and, where offered, through our in-product cookie controls or a "Your Privacy Choices" link. Blocking some cookies may affect how the Service works. We honor Global Privacy Control (GPC) browser signals as a valid opt-out of "sale"/"sharing" where applicable.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and tokenization of payment data by our processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your account by using a strong, unique password and keeping your credentials confidential.

8. Your Privacy Rights

All users. You may access, update, or delete account information and unsubscribe from marketing at any time via your account or by emailing privacy@pullz.ai. Some records may be retained where the law requires — see Section 5.

California residents (CCPA/CPRA). You have the right to: know and access the personal information we collect; know what is disclosed or "shared"; correct inaccurate information; delete personal information; opt out of any "sale" or "sharing" of personal information; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising these rights. We do not sell personal information. To exercise rights, contact us at privacy@pullz.ai or use "Your Privacy Choices." You may use an authorized agent. We will verify your request before responding.

EEA/UK residents (GDPR/UK GDPR). You have the right to access, rectify, erase, restrict, or object to processing; to data portability; to withdraw consent at any time; and to lodge a complaint with your supervisory authority. Contact privacy@pullz.ai.

Other states. Residents of states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out; contact us to exercise them.

We respond to verifiable requests within the timeframes required by applicable law.

9. Children's Privacy

The Service is for adults 18 and older. We do not knowingly collect personal information from children. Consistent with the Children's Online Privacy Protection Act (COPPA), if we learn we have collected information from anyone under 13 — or from any minor under 18 — we will delete it. If you believe a minor has provided us information, contact privacy@pullz.ai.

10. International Data Transfers

Pullz is operated by LUPOHMIGNS KFT, which is established in Hungary (European Union). We and our service providers may access and process personal information in the European Union, the United States, Israel, and other countries. These countries may have data-protection laws different from your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses or reliance on adequacy decisions) for cross-border transfers. By using the Service, you understand your information may be processed in these locations.

11. Third-Party Links

The Service may link to third-party sites or services (for example, eBay listings used for valuation reference, or payment pages). We are not responsible for their privacy practices. Review their policies before providing information.

12. Changes to This Policy

We may update this Policy. If we make material changes, we will provide notice (for example, by email or in-app) and update the "Last updated" date. Continued use after the effective date means you accept the updated Policy.

13. Contact Us

LUPOHMIGNS KFT 1204 Budapest, Mártírok útja 290, Hungary EU VAT HU27450037 Data controller: LUPOHMIGNS KFT Privacy requests: privacy@pullz.ai General: hello@pullz.ai