PRIVACY NOTICE

Riplz Collectives

Last Updated: May 1st, 2026

This Privacy Notice for DailyKarma, doing business as Riplz Collectives (“Riplz,” “we,” “us,” or “our”), describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”).

Riplz Collectives provides a platform that enables eCommerce brands to collaborate through shared customer experiences and post-purchase engagement. This Privacy Notice describes how we collect, use, and share information when merchants install our app and when customers interact with Collective experiences.

This Privacy Notice applies when you:

• Visit our website at http://www.riplz.co or any website of ours that links to this Privacy Notice

• Use our Services, including installing our app as a merchant or interacting with a Collective experience as a customer

• Engage with us in other related ways, including marketing communications or events

This Privacy Notice describes how we handle personal information of: (a) individuals who install, use, or administer the Riplz app on behalf of a merchant business; (b) customers who interact with Collective experiences; and (c) visitors to our website. If you are a merchant, your contractual relationship with Riplz—including licensing, billing, data processing obligations, and service terms—is governed by our separate Merchant Terms of Service, which is incorporated by reference into this Privacy Notice.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, please contact us at privacy@riplz.co.

Summary of Key Points

This summary provides key points from our Privacy Notice. You can find more detail about any of these topics below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use. This includes merchant store data, customer emails, interaction data, and technical information.

Do we process sensitive personal information? No. We do not process sensitive personal information.

Do we sell personal information? No. We do not sell personal information. When a customer opts in to a Collective, their information is disclosed to participating brands only with the customer’s informed consent and is not sold for monetary or other valuable consideration.

How do we process your information? We process information to provide, improve, and administer our Services, to enable Collective experiences between brands and customers, for security and fraud prevention, and to comply with law.

With whom do we share information? We share information with participating brands when a customer affirmatively opts in to a Collective, with trusted service providers who help us operate our Services, and as required by law.

What are your rights? Depending on your state of residence, you may have rights to access, correct, delete, or opt out of certain processing of your personal information.

How do you exercise your rights? Contact us at privacy@riplz.co. We will respond in accordance with applicable law.

Table of Contents

1. What Information Do We Collect?

2. How Do We Process Your Information?

3. How Do We Obtain Customer Consent for Collective Participation?

4. When and With Whom Do We Share Your Personal Information?

5. Do We Use Cookies and Other Tracking Technologies?

6. Do We Offer Artificial Intelligence-Based Products?

7. How Long Do We Keep Your Information?

8. How Do We Keep Your Information Safe?

9. Do We Collect Information From Minors?

10. What Are Your Privacy Rights?

11. Controls for Do-Not-Track Features

12. Do United States Residents Have Specific Privacy Rights?

13. International Data Transfers

14. Third-Party Brands and Links

15. Do We Make Updates to This Notice?

16. How Can You Contact Us About This Notice?

17. How Can You Review, Update, or Delete the Data We Collect From You?

1. What Information Do We Collect?

1.1 Personal Information You Disclose to Us

We collect personal information that you voluntarily provide to us when you register for our Services, express an interest in our products and Services, participate in activities on the Services, or otherwise contact us. The personal information we collect depends on whether you are a merchant using our platform or a customer interacting with a Collective experience.

Information We Collect From Merchants (Store Owners)

When a merchant installs and uses Riplz, we may collect:

•      Store information (e.g., store name, domain, contact details)

•      Order data (e.g., order value, products purchased, timestamps)

•      Discount data (e.g., discount codes, usage)

•      Product data (e.g., product names, images, metadata)

•      Account information (e.g., login credentials, contact name, email)

Information We Collect From Customers:

When customers interact with a Riplz-powered Collective experience (such as a post-purchase widget), we may collect:

•      Email address (when provided or confirmed by the customer)

•      Interaction data (e.g., clicks, participation in Collectives)

•      Associated order context (e.g., that the interaction occurred after a purchase)

We only collect customer information where the customer has taken an affirmative action (such as joining a Collective) or where otherwise permitted under applicable law.

Sensitive Information

We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

1.2 Information Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, which we collect primarily to maintain the security and operation of our Services and for internal analytics and reporting.

The information we automatically collect includes:

•      Log and Usage Data. Service-related, diagnostic, usage, and performance information, including IP address, device information, browser type and settings, pages and features accessed, and error reports.

•      Device Data. Information about the device you use to access our Services, including IP address, device identification numbers, browser type, hardware model, operating system, and system configuration.

•      Location Data. Approximate location information derived from your IP address. We do not collect precise GPS location data.

1.3 Information Collected From Other Sources

We may obtain limited information about merchants from the Shopify platform and other integration partners to facilitate installation of our app and verify merchant account information. We do not purchase personal information from data brokers.

2. How Do We Process Your Information?

We process personal information for the following purposes:

For Merchants

•      Enabling participation in Collectives

•      Matching brands into compatible Collectives

•      Displaying brand assets and offers

•      Measuring performance (e.g., conversions, revenue attribution)

•      Supporting billing and usage-based fees

•      Providing customer support and technical assistance

•      Sending service-related and administrative communications

For Customers

•      Enabling participation in Collective experiences

•      Facilitating the delivery of offers and benefits across participating brands

•      Improving the relevance of Collective experiences

•      Responding to customer inquiries

General Purposes

•      To protect our Services, including fraud monitoring and prevention

•      To evaluate and improve our Services, products, and user experience

•      To identify usage trends and measure the effectiveness of our Services

•      To comply with our legal obligations and respond to legal requests

We do not use merchant or customer data for purposes unrelated to those described in this Privacy Notice.

3. How Do We Obtain Customer Consent for Collective Participation?

Customers may be presented with a Collective experience (such as after completing a purchase on a merchant’s store). Within this experience, customers are provided with clear disclosure that, by joining, they agree to receive marketing communications from the brands participating in the Collective.

Customer participation occurs through an affirmative action (such as clicking a “Join” or similar button), which signifies the customer’s agreement to these terms and to the sharing of their information with participating brands.

Following this action, customers are provided with the ability to manage and customize their email preferences, including opting out of communications from specific brands within the Collective at any time.

We rely on the following lawful bases for processing customer information:

•      Customer consent, indicated through a clear, informed, affirmative action accompanied by prominent disclosure; and/or

•      Other lawful bases permitted under applicable law.

4. When and With Whom Do We Share Your Personal Information?

4.1 No Sale of Personal Information

We do not sell personal information as that term is defined under the California Consumer Privacy Act (CCPA) or other applicable state privacy laws. We do not exchange personal information for monetary or other valuable consideration, and we do not engage in cross-context behavioral advertising.

Riplz charges participating brands subscription fees for access to the Collective platform, including features such as analytics, collaboration tools, campaign management, brand matching, and participation in Collective experiences. Our subscription pricing is structured around platform features and participation levels, not around the sale or licensing of personal information. Customer information disclosed to participating brands occurs exclusively pursuant to the customer’s affirmative opt-in direction described in Section 3, and such consented disclosure does not constitute a “sale” or “share” of personal information under the CCPA or other applicable state privacy laws.

4.2 Sharing With Participating Brands (Core Functionality)

When a customer chooses to join a Collective, their information—such as their email address—may be disclosed to the brands participating in that Collective. This disclosure enables:

•      Customer participation in the Collective experience

•      Access to brand-specific offers and benefits

•      Direct marketing communications from participating brands

Independent Controllers / Separate Businesses

Each participating brand acts as a separate and independent business (and, where applicable, an independent data controller) with respect to the customer information it receives through a Collective. This means:

•      Each brand is independently responsible for its own use of customer data after receipt.

•      Each brand’s privacy policy, not Riplz’s Privacy Notice, governs how that brand uses the data after it is disclosed.

•      Riplz and participating brands do not jointly determine how data is used post-disclosure.

•      Riplz contractually requires participating brands to comply with applicable privacy laws and not to sell customer data obtained through Collectives.

Consented Disclosure Only

Customer data is disclosed to participating brands only after the customer provides clear, informed, affirmative consent through an opt-in action within a Collective experience, as described in Section 3 above. These disclosures are made pursuant to customer consent for the customer’s requested purpose and do not constitute a “sale” or “sharing” of personal information as defined by the CCPA or other applicable state privacy laws.

4.3 Service Providers

We may share information with trusted third-party service providers who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our service providers that are designed to safeguard personal information. The categories of service providers we may share information with include:

•      Data analytics providers

•      Cloud hosting and data storage providers

•      Email and communications infrastructure providers

•      Performance monitoring and security providers

•      Payment and billing processors

4.4 Aggregated or Anonymized Data

We may share aggregated or anonymized data—such as performance metrics or trends—with merchants, brand partners, or other third parties to improve the Services. This data does not identify any individual.

4.5 Business Transfers

We may share or transfer information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4.6 Legal Requirements

We may disclose information if required to do so by law, valid legal process, or to protect the rights, property, or safety of Riplz, our users, or others.

5. Do We Use Cookies and Other Tracking Technologies?

We use cookies and similar tracking technologies (such as web beacons and pixels) to gather information when you interact with our Services. These technologies help us maintain the security of our Services, save your preferences, support basic site functionality, and analyze how the Services are used.

We may permit service providers to use tracking technologies on our Services for analytics purposes (for example, Google Analytics). Where permitted by law, you can opt out of certain tracking by adjusting your browser settings, using browser plug-ins (such as the Google Analytics opt-out), or by contacting us.

We honor Global Privacy Control (GPC) signals where required by applicable law and where the signal is sent by a browser or device identifying a user from a state that recognizes GPC as a valid opt-out mechanism.

Google Analytics

We may share information with Google Analytics to analyze the use of our Services. To opt out of Google Analytics tracking, visit https://tools.google.com/dlpage/gaoptout. For more on Google’s privacy practices, see the Google Privacy & Terms page.

6. Do We Offer Artificial Intelligence-Based Products?

Our Services may include features powered by artificial intelligence, machine learning, or similar technologies (collectively, “AI Features”). These AI Features are designed to:

•      Match compatible brands into Collectives based on product, audience, and category signals

•      Personalize Collective offers and recommendations for customers

•      Analyze performance trends and engagement metrics to improve the Services

All personal information processed using our AI Features is handled in line with this Privacy Notice and our agreements with third-party service providers. We do not use customer personal information to train third-party foundation models without appropriate safeguards and, where required, consent.

7. How Long Do We Keep Your Information?

We retain personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or legal requirements).

Our specific retention practices are as follows:

•      Merchant account data is retained for as long as the merchant has an active installation of the Riplz app, plus up to 24 months thereafter for legal, tax, and dispute-resolution purposes.

•      Customer Collective data is retained for as long as necessary to deliver the Collective experience and for up to 24 months thereafter, unless the customer requests earlier deletion or a participating brand’s independent retention applies.

•      Log and technical data is retained for up to 12 months for security, troubleshooting, and analytics purposes.

•      Aggregated or anonymized data may be retained indefinitely, as it no longer identifies any individual.

Merchants may request deletion of their data at any time by uninstalling the app or contacting us at privacy@riplz.co. When we have no ongoing legitimate business need to process personal information, we will delete or anonymize it, or, if this is not possible, securely store it and isolate it from further processing until deletion is possible.

8. How Do We Keep Your Information Safe?

We implement appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. Our security measures include:

•      Encryption of data in transit and at rest where appropriate

•      Access controls and authentication safeguards

•      Secure infrastructure and continuous monitoring

•      Regular review and testing of our security practices

However, no electronic transmission or storage technology can be guaranteed to be 100% secure. Although we work to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

9. Do We Collect Information From Minors?

Our Services are intended for merchants operating eCommerce businesses and adult customers. We do not knowingly collect, solicit personal information from, or market to children under 13 years of age, in compliance with the Children’s Online Privacy Protection Act (COPPA), and we do not knowingly sell such personal information.

Our Services are not directed to individuals under 18. By using the Services, you represent that you are at least 18 years old or that you are the parent or guardian of a minor and consent to such minor’s use of the Services. If we learn that personal information from a child under 13 has been collected, we will deactivate the account and take reasonable steps to promptly delete such data from our records. If you become aware of any data we may have collected from a child under 13, please contact us at privacy@riplz.co

10. What Are Your Privacy Rights?

Withdrawing Your Consent

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the details provided in Section 16 below. Withdrawing consent will not affect the lawfulness of processing before the withdrawal, nor will it affect processing conducted on other lawful bases.

Opting Out of Marketing Communications

You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in the emails we send, or by contacting us directly. You will then be removed from our marketing lists. We may still send you service-related messages necessary for the administration of your account.

Merchant Rights

Merchants using the Riplz platform may:

•      Access and update their account information through the app dashboard

•      Request deletion of their personal data by contacting privacy@riplz.co

•      Terminate their use of the Services and revoke Riplz’s access to store data by uninstalling the Riplz app, in accordance with the Merchant Terms of Service

Upon uninstallation, we will cease collecting new data and will delete or anonymize merchant data in accordance with the retention periods described in Section 7, subject to any legal retention obligations.

Customer Rights

Customers who participated in a Collective experience may request to access, correct, or delete the personal information we hold by contacting privacy@riplz.co. For requests concerning data that has been disclosed to a participating brand, customers may also contact that brand directly, as the brand is an independent controller of that data.

11. Controls for Do-Not-Track Features

Most web browsers include a Do-Not-Track (“DNT”) feature. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. If a standard for online tracking is adopted that we must follow in the future, we will update this Privacy Notice accordingly.

We do, however, honor Global Privacy Control (GPC) signals where required by applicable law, as described in Section 5.

12. Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain, correct inaccuracies, obtain a copy of, or delete your personal information, subject to certain exceptions. You may also have the right to withdraw your consent to our processing. These rights may be limited by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the preceding twelve (12) months, as defined under the CCPA.

Category

Examples

Collected

A. Identifiers

Real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name

YES

B. Cal. Customer Records

Name, contact information, employment information, financial information

YES

C. Protected Classifications

Gender, age, race, ethnicity, national origin, marital status

NO

D. Commercial Information

Transaction information, purchase history, products purchased via Collective interactions

YES

E. Biometric Information

Fingerprints, voiceprints

NO

F. Internet / Network Activity

Browsing history, interaction data with our Services, log data

YES

G. Geolocation Data

Approximate location derived from IP address

YES

H. Audio / Visual Information

Images, audio, or video recordings

NO

I. Professional / Employment

Business contact details, job title

YES

J. Education Information

Student records and directory information

NO

K. Inferences

Inferences drawn from collected information to create a profile about preferences and characteristics

NO

L. Sensitive Personal Information

As defined under applicable state privacy laws

NO

Sale or Sharing of Personal Information

We have not sold or shared (as those terms are defined under the CCPA) any personal information in the preceding twelve (12) months. Customer data is only disclosed to participating brands pursuant to customer opt-in consent, as described in Sections 3 and 4, and such disclosure does not constitute a sale or share.

Disclosure for Business Purposes

In the preceding twelve (12) months, we have disclosed the following categories of personal information to service providers for business or commercial purposes: Category A (Identifiers), Category B (California Customer Records), Category D (Commercial Information), Category F (Internet/Network Activity), Category G (Geolocation Data), and Category I (Professional/Employment Information). The categories of third parties to whom we disclosed such information are described in Section 4 above.

Your Rights

Depending on your state of residence, you may have the following rights:

•      Right to know whether we are processing your personal data

•      Right to access your personal data and receive a copy

•      Right to correct inaccuracies in your personal data

•      Right to request deletion of your personal data

•      Right to data portability

•      Right to non-discrimination for exercising your rights

•      Right to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of significant decisions

•      Right to limit the use and disclosure of sensitive personal information (as applicable)

•      Right to appeal our decision regarding a rights request (Colorado, Connecticut, Virginia, and other states with appeal provisions)

How to Exercise Your Rights

To exercise your rights, you may contact us by email at privacy@riplz.co. We will respond to verified requests within 45 days, with one additional 45-day extension if reasonably necessary and communicated to you in writing. You may also designate an authorized agent to make a request on your behalf; we may require proof of authorization.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have information. We may request additional information to verify your identity for security and fraud-prevention purposes. We will only use information provided in a verification request to verify your identity and respond to your request.

Appeals

If we decline to take action regarding your rights request, you may appeal our decision by emailing privacy@riplz.co. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for our decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine the Light” Law

California Civil Code Section 1798.83 permits California residents to request once a year, free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of those third parties. We do not disclose personal information to third parties for their own direct marketing purposes; however, California residents may submit such requests in writing to privacy@riplz.co

13. International Data Transfers

Riplz is based in the United States, and our servers and service providers are primarily located in the United States. If you are located outside the United States, your personal information may be transferred to, stored, and processed in the United States or other jurisdictions that may have different data protection laws than your country.

Where required by applicable law, we use appropriate safeguards for cross-border transfers of personal information, which may include standard contractual clauses, adequacy determinations, or other lawful transfer mechanisms. By using our Services, you acknowledge and consent to such transfers.

14. Third-Party Brands and Links

Collectives include multiple independent brands. When customers interact with, purchase from, or receive communications from those brands after joining a Collective, their data is subject to the privacy policies of those brands. We encourage customers to review the privacy policies of each participating brand before engaging with them.

We are not responsible for the privacy practices, content, or services of third-party brands or websites, including those of our merchant customers, their participating Collective partners, or any third-party sites linked from our Services.

15. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Last Updated” date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to stay informed about how we protect your information.

16. How Can You Contact Us About This Notice?

If you have questions or comments about this Privacy Notice, you may contact us at:

DailyKarma d/b/a Riplz Collectives

8605 Santa Monica Blvd., PMB 95166

West Hollywood, CA 90069

United States

Email: privacy@riplz.co

17. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or request deletion of your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited by applicable law.

To submit a request to review, update, or delete your personal information, please email privacy@riplz.co. We will respond to verified requests in accordance with applicable law.