Privacy Policy

Prior Phil LLC, doing business as “Drift” (“Drift,” “Company,” “we,” “us,” or “our”), respects your privacy and is committed to protecting your information.

This Privacy Policy describes how we collect, use, disclose, and safeguard information when you access or use the Drift website, companion mobile app, and related services (the “Platform”).

The website and companion mobile app use a shared Drift account. The mobile app provides access to your account, collection, and available athlete account information. Card purchases, payout setup, and payout requests are offered on the website. The mobile app does not offer card checkout.

This Policy applies to all users of the Platform, including:

• Collegiate Athletes
• Representatives (agents, collectives, managers, etc.)
• Card Purchasers (including Athletes and Representatives who choose to purchase cards)

By accessing or using the Platform, you agree to the practices described in this Privacy Policy.

1. Information We Collect

A. Information You Provide to Us

Depending on your user type, we may collect the following information:

• Full name
• Email address
• Account credentials
• Contact information
• Communications with Drift
• Account preferences

• Name, image, and likeness (“NIL”) materials
• Photographs and digital content submitted for licensing
• School affiliation
• Social media handles
• Payment and payout information
• Tax-related information as required for lawful disbursement of funds

• Name and contact information
• Business or entity details
• Payment and payout information
• Information related to managed Athlete accounts

• Purchase history
• Account transaction records
• Billing details
• Wallet or digital asset account information
• Shipping information (if applicable)

B. Information Collected Automatically

When you access or use the Platform, we may automatically collect:

• IP address
• Device type and operating system
• Browser type
• Usage data and activity logs
• Checkout, collection-open, and collectible-view timestamps
• Pages viewed and referring URLs
• Cookies and similar tracking technologies

For fraud prevention and payment-dispute support, Drift uses a first-party, HTTP-only drift_device_id cookie containing a random identifier. It is not a hardware or browser fingerprint. Drift stores only a keyed hash of this identifier with relevant checkout and collection-access records. Associated IP addresses and user-agent strings are encrypted at rest and available only to authorized super administrators.

2. Payments and Payout Destinations

Drift uses Stripe, Inc. (“Stripe”) for website card checkout and connected Stripe payouts.

• Website card checkout payments are processed by Stripe.
• Drift does not store, process, or maintain full credit card numbers or complete payment card information in its own database.
• Website card checkout payment information is transmitted directly to and handled by Stripe in accordance with Stripe’s privacy policy and security standards.

Stripe may collect:

• Payment card information
• Billing address
• Transaction details
• Identity verification information
• Bank account information for payouts

Stripe’s use of personal information is governed by its own Privacy Policy and security practices. Drift is not responsible for the independent privacy or security practices of Stripe.

On the website, athletes may choose connected Stripe payouts or provide a manual payout destination: a Cash App $Cashtag, a Venmo username, or a PayPal email address. Drift stores that destination and payout-request snapshots for payout administration; manual wallet payouts are sent by an operator. Manual destinations may also appear in payout notifications delivered to operators.

3. How We Use Information

We use collected information to:

• Operate, maintain, and improve the Platform
• Create and distribute Digital Assets
• Facilitate NIL licensing transactions
• Process card payments through Stripe and administer athlete payouts
• Verify identity and prevent fraud
• Document digital collectible entitlement and authenticated collection access
• Investigate and respond to payment disputes
• Provide customer support
• Communicate service updates
• Comply with legal, regulatory, tax, and NCAA requirements
• Enforce our Terms of Service

We do not sell personal information to third parties.

4. NIL and Licensed Content

Athletes and Representatives represent and warrant that no other party, including any college or university, holds exclusive rights that would invalidate the license granted to Drift.

Drift relies on these representations when:

• Creating Digital Cards
• Displaying Licensed Content
• Marketing Digital Cards
• Transferring Digital Cards to Drift Users

Drift does not independently verify NIL ownership beyond contractual representations.

5. How We Share Information

We may share information with:

• Stripe (card checkout and connected Stripe payouts)
• Cash App, Venmo, or PayPal (for an operator-sent manual wallet payout to the destination you provide)
• Transactional email providers delivering payout notifications to operators
• Cloud hosting providers
• Technology service providers supporting Platform operations
• Representatives managing Athlete accounts
• Professional advisors (legal, accounting, compliance)
• Government authorities or regulators if required by law

Website and mobile app sign-in is provided by Auth0. Account and purchase records are stored in our hosted database (Railway); our website and API hosting provider (Vercel) processes requests to the service. ImageKit stores and delivers submitted images. Resend delivers service and support emails, and Clickterm processes agreement acceptance where that service is used.

Phone sale alerts are not offered in the current mobile release. This release does not register your device for sale alerts or collect installation identifiers or push-notification delivery tokens for that feature.

Previously stored sale-alert installation identifiers, tokens, device platform, registration and delivery records, and notification read status may remain linked to your account. These records are not used to send sale alerts while the feature is unavailable. Account deletion removes our mobile notification records.

We require service providers to implement reasonable security safeguards.

We do not sell personal information.

6. Data Retention

We retain information:

• For as long as an account remains active
• As necessary to complete transactions
• As required for tax, accounting, regulatory, and NIL compliance
• To resolve disputes and enforce agreements

Encrypted IP addresses, user-agent evidence, and correlatable device hashes linked to checkout or collectible access are normally retained for 24 months. If a linked payment dispute remains open, deletion is delayed; that evidence is removed 24 months after the dispute closes. Financial transaction records, immutable listing snapshots, and dispute outcomes may be retained as required for legal, accounting, fraud-prevention, and enforcement purposes.

Account deletion may retain a manual payout destination when a pending or approved request, a nonzero recorded balance, or a successful historical sale exists. Historical payout-request destination snapshots also remain; a settled payment does not currently trigger automatic disposal of all destination copies. We are reviewing the disposal of these records after settlement and the handling of historical email, export, log, and backup copies. Deleting active account records does not guarantee that every retained copy has been removed.

7. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information.

However, no online platform can guarantee absolute security. Users access and use the Platform at their own risk.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Request access to your personal information
• Correct inaccurate information
• Request deletion (subject to legal retention requirements)
• Opt out of non-essential communications

You can delete your shared DRiFT account from Profile on the website or in the app. Deletion removes your login and public profile and permanently ends access to your collection across both platforms. If you are an athlete, new sales of your cards stop; people who already purchased your cards keep them in their collections. We retain records needed to settle payments and comply with signed NIL or guardian agreements and the retention purposes described above, including the manual payout destination limitations described in Data Retention.

We complete account deletion within 30 days of your confirmed request, usually sooner. Use the saved receipt from your request to check completion on the original account-deletion screen. For website requests, keep the original browser tab available until completion. If it is still pending or you need help, contact info@driftnil.com.

Purchased card editions and their licensed athlete artwork remain available to existing buyers after athlete account deletion. They are not offered for new sales. This is separate from the minimized financial and agreement records we retain.

Requests may be submitted to: info@driftnil.com

9. Children’s Privacy

DRiFT accounts and the companion mobile app are intended for people aged 13 and older. Minors must have their parent or legal guardian's permission. Athletes aged 13–17 require guardian consent and DRiFT approval before their profiles or cards become publicly available.

We do not knowingly collect personal information from children under 13.

10. Third-Party Services

The Platform may contain links to third-party websites or services. Drift is not responsible for the privacy practices of third-party services.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised Effective Date.

Continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Contact Information

If you have questions regarding this Privacy Policy, please contact: