Privacy Policy
Last updated: 1 June 2026 · Pull. is operated by PullRate Ltd, United Kingdom
We keep this simple. Pull. collects only what it needs to run the service, never sells your data, and gives you full control to delete your account and all associated data at any time.
1. Who we are
Pull. ("PullRate Ltd", "we", "us") operates the sports card portfolio tracker available at pull-co.com. We are the data controller for the personal data described in this policy.
If you have any questions or wish to exercise your rights, contact us at: support@pullrate.co.uk
2. What data we collect
Account data
- Email address — used to identify your account and send transactional emails (subscription receipts, expiry notices)
- Username — chosen by you, displayed within the app
- Password — stored as a salted hash by Supabase Auth; we never see your plaintext password
Collection data
- Sports cards you add: player name, set, year, grade, cost, sport, notes, and any photos you upload
- Boxes and packs: name, cost, vendor, sport, and cards pulled from them
- Sales records: sale price, date, platform, and buyer notes
- Watched cards and bundle configurations
Subscription and billing data
- Subscription tier and status — stored in our database
- Payment processing is handled entirely by Stripe. We do not store card numbers, bank details, or any payment instrument data. Stripe's privacy policy applies to payment data: stripe.com/gb/privacy
Technical data
- Server request logs (URL path, HTTP method, status code, timestamp) — retained for up to 30 days for debugging
- No tracking pixels, third-party analytics scripts, or advertising cookies are used
3. How we use your data
- To provide and operate the Pull. service
- To send transactional emails: subscription confirmation, cancellation confirmation, and expiry reminders (you cannot opt out of these while subscribed, as they are essential to the service)
- To enforce subscription limits and tier-based access
- To improve the service based on aggregated, anonymised usage patterns
4. Legal basis for processing (UK GDPR)
- Contract performance — processing necessary to deliver the service you signed up for
- Legitimate interests — server logs for security and debugging, fraud prevention
- Legal obligation — retaining billing records as required by UK tax law
5. Data sharing
We do not sell, rent, or trade your personal data. We share data only with the following sub-processors, each bound by data processing agreements:
- Supabase — database and authentication (EU/US data centres)
- Stripe — payment processing (UK/EU/US)
- Anthropic — AI card scanning; card images are sent to Anthropic's API for processing and are not retained by Anthropic beyond the API call
- Google (Gmail) — transactional email delivery
6. Data retention
- Your account and collection data are retained for as long as your account is active
- When you delete your account, all personal data and collection data are permanently deleted within 30 days
- Billing records (subscription history) may be retained for up to 7 years to comply with UK tax and accounting obligations
- Server logs are deleted after 30 days
7. Your rights under UK GDPR
You have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your account and associated data
- Portability — receive your collection data in a machine-readable format
- Restriction — ask us to stop processing your data in certain circumstances
- Object — object to processing based on legitimate interests
To exercise any of these rights, email support@pullrate.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8. Cookies
Pull. uses a single session cookie set by Supabase Auth to keep you logged in. No advertising, tracking, or analytics cookies are used. You can clear this cookie at any time by logging out or clearing your browser storage.
9. Security
All data is transmitted over HTTPS. Passwords are hashed using bcrypt. Database access is restricted to application-level service accounts with row-level security policies enforced by Supabase. We conduct regular reviews of access controls and dependencies.
10. Children
Pull. is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, please contact us and we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. We will notify subscribed users by email of any material changes. The "last updated" date at the top of this page will always reflect the most recent version.
12. Contact
PullRate Ltd, United Kingdom
Email: support@pullrate.co.uk