Privacy Policy

Last Updated: 20 June 2026

1. Introduction

The Concept Labs Company Limited ("Oripa.cards," "we," "us," or "our"), a company incorporated and registered under the laws of the Kingdom of Thailand, is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, retain, transfer, and safeguard your information when you access or use our website at https://oripa.cards, our mobile and desktop applications, and any related services we provide (collectively, the "Service").

This Privacy Policy applies to all Users of the Service, regardless of location. We process personal data in accordance with applicable data protection laws, including the Thai Personal Data Protection Act B.E. 2562 (PDPA), the European Union General Data Protection Regulation (GDPR) and UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Singapore Personal Data Protection Act 2012, and other applicable privacy regulations.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this Privacy Policy, please do not use the Service.

For the purposes of the PDPA, GDPR, and other applicable laws, the data controller is The Concept Labs Company Limited. For any questions about this Privacy Policy or our data practices, please contact us at [email protected].

Relationship to other documents. This Privacy Policy should be read together with our Terms of Service and Terms & Conditions. In the event of any conflict between this Privacy Policy and those documents regarding the handling of personal data, this Privacy Policy governs.

2. Information We Collect

We collect information in several ways when you interact with the Service. The categories of information we collect include information you provide directly, information collected automatically, and information obtained from third-party sources.

2.1 Information You Provide Directly

We collect information that you voluntarily provide when creating an account, making a purchase, using platform features, or contacting us. This may include:

Account information. Email address, phone number, social account identifiers (where you log in via Google, Apple, or similar), username, and password (if applicable);
Profile information. Display name, country of residence, language preference, category interests (e.g., Pokémon, One Piece, Yu-Gi-Oh!, baseball, basketball, football), and any linked social media handles;
Shipping and redemption information. Full name, street address, city, state or province, postal code, country, email address, and phone number — required for physical card redemption shipments. This data is passed directly to our third-party shipping and logistics provider for fulfillment. We encourage you to review that provider's privacy policy before submitting a redemption request. See Section 4.1 for details;
Identity verification (KYC) data. When identity verification is required for compliance, fraud prevention, or eligibility purposes, our identity verification provider collects government-issued identification documents, selfie photographs, and associated biometric or identity data on our behalf. This data is held and processed by our designated customer data and identity management provider. We encourage you to review that provider's privacy policy. See Section 4.1 for details;
Communications. Messages sent through any in-app messaging feature, customer support enquiries, and any other communications you send to us;
Transaction information. Records of purchases, sales, offers, Pack openings, Platform Credit conversions, Platform Credit balances and activity, Digital Title Asset deliveries, Marketplace activity, redemptions, Sell-to-Oripa transactions, and other activity on the Service.

2.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

Device information. Device type, operating system, browser type and version, screen resolution, language settings, and unique device identifiers;
Usage information. Pages viewed, features used, click patterns, time spent on pages, search queries, Pack opening results, Marketplace activity, and navigation paths;
Log data. IP address, access times, referring URLs, and error logs;
On-chain data. Public wallet address(es) on the Monad network and any other supported blockchain used in connection with the Service. On-chain data includes transaction hashes, Digital Title Asset mints and transfers, Pack outcome commitment and reveal hashes, and grader certification numbers and serial numbers recorded on-chain. Important: on-chain data is inherently public and permanently and immutably recorded on the Monad network. No personally identifying information (including your name, email, phone number, or government ID) is written to the blockchain. Your wallet address functions as a pseudonym on-chain; the mapping between your wallet address and your identity is held exclusively in our off-chain systems and by our designated data provider as described in Section 4.1;
Cookies and similar technologies. Information collected via cookies, web beacons, pixels, and local storage. See our Cookie Policy for details.

2.3 Information from Third-Party Sources

We may receive information about you from third-party sources, including:

Authentication and wallet providers. Our wallet infrastructure provider may share authentication tokens, wallet addresses, and login method identifiers when you sign in or are provisioned an embedded wallet;
Payment processors. Our payment processors share transaction confirmation data, payment status, and fraud-prevention signals. They do not share full payment card numbers with us;
Identity verification providers. Our KYC partner may share verification status, risk signals, and (where you have consented) the identity documents you have submitted;
Vault partners. Our vault custody partners may share information regarding card authentication, inventory status, and fulfillment tracking;
Analytics and advertising providers. Analytics services may provide aggregated or pseudonymized data about User behavior, conversion events, and campaign performance;
Monad network. Publicly available data from the Monad network and any other supported networks, including transaction history and wallet activity associated with wallets connected to your account;
Referral sources. If you are referred by another User, we receive the referring User's referral code or identifier.

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing and maintaining the Service. Creating and managing your account, processing transactions, converting USDC to Platform Credit, facilitating Pack purchases and openings, delivering Digital Title Assets, fulfilling redemptions, managing vault custody, facilitating Marketplace operations, and delivering all core platform functionality;
Payment processing. Processing purchases, managing Platform Credit balances, facilitating Sell-to-Oripa payouts, processing Marketplace settlement, and processing fees;
Identity verification and compliance. Verifying your identity when required for compliance, fraud prevention, or security purposes, and meeting our obligations under anti-money laundering, counter-terrorist financing, and sanctions laws;
Communication. Sending you transactional notifications (purchase confirmations, Pack opening results, shipping updates, Sell-to-Oripa offers), responding to support enquiries, and providing service-related announcements;
Improvement and personalization. Analyzing usage patterns, optimizing platform performance, developing new features, personalizing content and recommendations, and conducting product testing;
Security and fraud prevention. Detecting and preventing fraud, unauthorized transactions, abuse, and other harmful activities, and protecting the integrity of the provable fairness system and the Marketplace;
Marketing and advertising. Measuring the effectiveness of our advertising campaigns, managing conversion tracking, and (with your consent where required) sending promotional communications;
Legal compliance. Complying with applicable laws, regulations, legal processes, and government or regulatory requests, including during the pre-licensing beta phase as the platform completes its regulatory engagements in Thailand;
Enforcement. Enforcing our Terms of Service, Terms & Conditions, and other agreements, and protecting the rights, property, and safety of Oripa.cards, our Users, and others.

3.1 Legal Bases for Processing

Where the GDPR, UK GDPR, or PDPA applies, our legal bases for processing your personal data include:

Performance of a contract — to provide the Service, process transactions, fulfill redemptions, and deliver other services you have requested;
Legitimate interests — for fraud prevention, security, platform improvement, analytics, and direct marketing to existing customers (subject to your right to object);
Consent — for marketing communications to non-customers, certain cookies and tracking technologies, and processing of sensitive personal data (where required);
Legal obligation — to comply with applicable laws and regulations, including KYC/AML, tax, and consumer protection requirements;
Vital interests — to protect a person's life or physical safety, where applicable.

Where we rely on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We do not sell your personal information. We may share your information with the following categories of recipients for the purposes described in this Privacy Policy.

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, subject to contractual obligations to protect your information. The categories of service providers we engage include:

Customer data and identity management provider. Account information, KYC documents, identity verification data, wallet-address-to-user-account mapping, and other personal data are held and managed by our designated customer data protection service provider — Easyship Inc. We encourage you to review their privacy policy and terms of service. This provider is contractually bound to process your data only on our instructions and in accordance with applicable data protection law;
Shipping and logistics providers. Shipping and redemption details (name, address, phone number) are passed to our designated shipping provider — Coinflow Inc. and its associates — and such other carriers (including FedEx, DHL, and equivalent) as are engaged for fulfillment. We encourage you to review their privacy policy before submitting a redemption request;
Wallet and authentication infrastructure. To enable account creation, login, and the provisioning of embedded wallets on the Monad network;
Payment processors. To process credit and debit card transactions, fiat-to-crypto on-ramps and off-ramps, and stablecoin payments;
Vault custody partners. To custody and manage physical graded trading cards held on behalf of Users, including tracking card authentication, inventory, and fulfillment;
Card grading and authentication services. Including PSA, BGS, CGC, SGC, and other recognized graders;
Customer support platforms. To manage support enquiries and conversations;
Email and notification providers. To deliver transactional emails and platform notifications;
Cloud hosting and content delivery providers. To host the Service and deliver content reliably;
Monad network RPC and indexing providers. To read from and broadcast to the Monad network and other supported networks;
Bot protection and security providers. To protect the Service from abuse, scraping, and automated attack;
Blockchain analytics providers. To monitor on-chain activity for compliance, fraud prevention, and sanctions screening. This may include analysis of the transaction history of wallets connected to your account, including activity predating your use of the Service.

4.2 Analytics and Advertising Partners

We share certain information with analytics and advertising partners to measure and improve the Service. These may include product analytics platforms, web analytics services, advertising attribution platforms, error monitoring services, and performance monitoring services. Where required by applicable law, we obtain your consent before placing non-essential cookies or sharing data with advertising partners.

4.3 Other Disclosures

We may also disclose your information in the following circumstances:

Legal requirements. Where required by applicable law, legal process, governmental request, regulatory directive, or court order;
Protection of rights. To protect the rights, property, or safety of Oripa.cards, our Users, or the public, including to investigate suspected fraud or violations of our Terms of Service;
Business transfers. In connection with a merger, acquisition, reorganization, sale of assets, financing, or insolvency, your information may be transferred to the acquiring or successor entity, subject to confidentiality undertakings;
With your consent. Where you have provided express consent to share information with a specific third party.

On-chain data. Information recorded on the Monad network or any other supported blockchain — including wallet addresses, Digital Title Asset transaction history, and Pack outcome hashes — is inherently public, permanent, and immutable. We cannot delete, modify, or remove data from any blockchain. By using the Service, you acknowledge that on-chain activity associated with your wallet address is visible to anyone and is retained permanently by the network regardless of your account status.

5. Cookies and Tracking Technologies

We use cookies, pixels, web beacons, and similar tracking technologies to collect information about your use of the Service. These technologies help us authenticate Users, secure the Service, analyze traffic, personalize content, measure advertising effectiveness, and improve your experience.

The categories of tracking technologies we use include:

Essential cookies. Necessary for the Service to function, including authentication, session management, security, and payment processing;
Analytics cookies. Used to understand how Users interact with the Service, track errors, and measure performance;
Marketing cookies. Used for conversion tracking, advertising attribution, and measurement of campaign performance.

Where required by applicable law (including the GDPR, UK GDPR, and the EU ePrivacy Directive), we obtain your consent through a cookie banner before placing non-essential cookies. You may manage your cookie preferences at any time through the cookie settings on the Service. For detailed information about the cookies we use, please refer to our Cookie Policy.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the nature of the data and the purpose of processing:

Account information. Retained for the duration of your account and for a reasonable period thereafter to comply with legal and regulatory obligations;
Transaction records. Retained for a minimum of seven (7) years (or such longer period as required by applicable law, including Thai tax and accounting law) to comply with financial record-keeping obligations;
Communication records. Customer support conversations are retained for up to three (3) years after the last interaction;
KYC and identity verification data. Retained in accordance with applicable anti-money laundering, counter-terrorist financing, and know-your-customer regulations — typically a minimum of five (5) years from the end of the customer relationship or the date of the relevant transaction, whichever is later. This data is held by our designated customer data and identity management provider;
Analytics data. Identifiable analytics data is retained for up to twenty-six (26) months. Aggregated and anonymized analytics data may be retained indefinitely;
Marketing and advertising data. Marketing-related cookies and associated data are retained in accordance with the timeframes set out in our Cookie Policy;
Device and log data. IP addresses, device identifiers, and access logs are retained for up to twelve (12) months for security and fraud prevention purposes;
On-chain data. Data recorded on the Monad network and other supported networks is permanent and immutable. We cannot delete, modify, or remove data from any blockchain. This includes wallet addresses, Digital Title Asset records, Pack outcome hashes, and grader certification data recorded on-chain.

When personal data is no longer required for its original purpose and there is no legal obligation to retain it, we will securely delete or anonymize the data within a reasonable timeframe.

7. Your Rights

Depending on your jurisdiction, you may have certain rights with respect to your personal information. We are committed to respecting and facilitating these rights.

Important note on blockchain data and the right to erasure. Your right to erasure applies to your off-chain personal data only. When we process an erasure request, we delete all personally identifying information and the wallet-address-to-user-account mapping from our off-chain systems and instruct our customer data provider to do the same. Once this mapping is deleted, your on-chain wallet address becomes an orphan — it is no longer linkable to you as a natural person and is treated as effectively anonymous per applicable regulatory guidance. We cannot delete, modify, or remove any data recorded on the Monad network or any other public blockchain.

7.1 Rights Under the Thai PDPA

If you are located in Thailand, you have the following rights under the Personal Data Protection Act B.E. 2562:

Right to be informed about the collection and processing of your personal data;
Right of access to the personal data we hold about you, and to obtain a copy;
Right to rectification of inaccurate or incomplete personal data;
Right to erasure of your personal data, subject to legal obligations, legitimate business needs, and the inherent immutability of data recorded on public blockchains (see note above);
Right to restriction of processing in certain circumstances;
Right to data portability — to receive your personal data in a structured, commonly used, and machine-readable format;
Right to object to processing based on legitimate interests or for direct marketing purposes;
Right to withdraw consent where processing is based on consent;
Right to lodge a complaint with the Personal Data Protection Committee of Thailand if you believe that we have processed your personal data in a manner that does not comply with the PDPA.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR and UK GDPR:

Right of access to the personal data we hold about you;
Right to rectification of inaccurate or incomplete personal data;
Right to erasure ("right to be forgotten"), subject to legal obligations, legitimate business needs, and the inherent immutability of data recorded on public blockchains (see note above);
Right to restriction of processing in certain circumstances;
Right to data portability — to receive your personal data in a structured, commonly used, and machine-readable format;
Right to object to processing based on legitimate interests or for direct marketing purposes;
Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
Right to lodge a complaint with a supervisory authority in your jurisdiction.

7.3 Rights Under the CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:

Right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share it;
Right to delete your personal information, subject to legal obligations and the immutability of blockchain data (see note above);
Right to correct inaccurate personal information;
Right to opt out of the "sale" or "sharing" of personal information. Oripa.cards does not sell personal information. To the extent that sharing of data with advertising platforms constitutes "sharing" under the CCPA, you may opt out by adjusting your cookie preferences;
Right to limit use of sensitive personal information to certain permitted purposes;
Right to non-discrimination for exercising your privacy rights.

In the preceding twelve (12) months, we have collected the following categories of personal information: identifiers (name, email, phone, wallet address), internet or electronic network activity, geolocation data (country level), commercial information (transaction history), and, where applicable, biometric or sensitive identification information (collected through identity verification).

7.4 Rights of Other ASEAN and International Residents

If you are located in another jurisdiction with applicable data protection laws — including Singapore (PDPA 2012), Malaysia (PDPA 2010), Indonesia (UU PDP), the Philippines (Data Privacy Act), or Vietnam (PDPD) — you may have rights similar to those described above. We will honor your rights in accordance with the applicable law of your jurisdiction.

7.5 How to Exercise Your Rights

To exercise any of the rights described above, please submit a request by email to [email protected] with the subject line "Data Protection Request." We will verify your identity before processing your request and respond within the timeframes required by applicable law (generally 30 days under the PDPA and GDPR, 45 days under the CCPA, with possible extensions where permitted).

You may also designate an authorized agent to make a request on your behalf. If you use an authorized agent, we may require additional verification to confirm that the agent is authorized to act for you.

8. Automated Decision-Making

We may use automated processing in certain areas of the Service, including:

Fraud detection. Automated systems analyze transaction patterns, account behavior, and other signals to detect and prevent fraud;
KYC verification. Identity verification involves automated document and biometric checks, supplemented by manual review where appropriate;
Risk assessment. Automated systems may assess account risk for purposes such as withdrawal limits and feature eligibility;
Content and conduct moderation. Automated tools may detect prohibited content, suspicious activity, or violations of platform rules.

Under Article 22 of the GDPR (and equivalent provisions of the PDPA), you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. If you wish to contest an automated decision affecting your account, you may request human review by contacting us at [email protected].

9. International Data Transfers

Oripa.cards is incorporated in Thailand, and the Service is operated and hosted using infrastructure that may be located in Thailand, Singapore, the United States, the European Union, and other countries. Your personal information may be transferred to and processed in countries other than your country of residence, which may have data protection laws that differ from those in your jurisdiction.

Additionally, data recorded on the Monad network is processed by validators and nodes distributed globally. On-chain data is pseudonymous (wallet address only — no PII) as described in Section 2.2, and is inherently public and permanent. This global distribution is an inherent characteristic of public blockchain networks.

Where we transfer personal data from a jurisdiction with data export restrictions (including Thailand under the PDPA, the EEA and UK under the GDPR, and Singapore under the PDPA 2012) to a country that has not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, which may include:

Standard Contractual Clauses (SCCs) approved by the European Commission or by the relevant supervisory authority;
Data Processing Agreements with our service providers that include appropriate data protection obligations;
Adequacy decisions issued by the relevant authority;
Other lawful transfer mechanisms recognized under applicable data protection laws, including binding corporate rules, contractual obligations, or your explicit consent.

Our service providers, including our customer data and identity management provider and our shipping provider, may process your data in multiple jurisdictions. We require that all such providers are contractually bound to protect your personal information in a manner consistent with this Privacy Policy and applicable law.

10. Children's Privacy

The Service is not directed to individuals under the age of 20 (twenty). In line with the minimum age requirement set out in our Terms of Service and Terms & Conditions, we do not knowingly collect personal information from persons under 20. If we become aware that we have inadvertently collected personal information from a person under 20, we will take steps to delete that information and close the associated account as promptly as possible.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at [email protected] so that we can take appropriate action.

11. Security

We implement commercially reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS/SSL;
Encryption of sensitive data at rest where appropriate;
Secure authentication infrastructure with support for multi-factor authentication;
Access controls limiting employee access to personal data on a need-to-know basis;
Regular security monitoring, error tracking, and vulnerability management;
Wallet isolation, ensuring that each User's wallet is separately and independently secured;
Payment card data processed and stored exclusively by PCI-compliant payment processors — Oripa.cards does not store payment card numbers;
Separation of on-chain pseudonymous data from off-chain personally identifying data, with the identity-to-wallet-address mapping held exclusively by our designated customer data and identity management provider under appropriate security controls;
Periodic reconciliation between our internal records, vault partner records, and on-chain registries to detect and remediate any discrepancies.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials, wallet access, and any private keys associated with your wallet, and for promptly notifying us of any suspected unauthorized access.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required under Article 33 of the GDPR and equivalent provisions of the Thai PDPA;
Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with applicable data breach notification laws (including Article 34 of the GDPR, the PDPA, and U.S. state breach notification statutes);
Document the breach in our internal breach register, including the nature of the breach, the categories and approximate number of individuals concerned, the likely consequences, and the measures taken or proposed;
Investigate and remediate by conducting a thorough investigation and implementing appropriate measures to prevent recurrence.

Notifications to affected individuals will include, at a minimum: a description of the nature of the breach; the contact details of our data protection point of contact; a description of the likely consequences of the breach; and a description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this Privacy Policy;
Provide notice through the Service or by email where practicable;
Where required by applicable law, obtain your consent to the material changes.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the posting of any changes constitutes your acceptance of those changes, except where additional consent is required by applicable law.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

The Concept Labs Company Limited · Bangkok, Thailand

General enquiries: [email protected]
Support: [email protected]
Data protection enquiries: [email protected]

For privacy-specific or data protection requests — including requests to exercise your rights under the PDPA, GDPR, CCPA, or other applicable laws — please direct your inquiry to [email protected] with the subject line "Data Protection Request." We will acknowledge receipt and respond within the timeframes required by applicable law.

If you are a Thai resident and are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Committee of Thailand. If you are an EEA or UK resident, you have the right to lodge a complaint with the supervisory authority in your country of residence.

This Privacy Policy was last updated on 17 June 2026. The Concept Labs Company Limited, Bangkok, Thailand.

Privacy Policy

On this page