Privacy Policy

(“we”) operates MysteryBox at . This Privacy Policy explains what personal data we collect, why we use it, how we share it, and your choices.

Privacy or legal requests: . General support: .

Account data: email, username, password (hashed), account preferences, and similar identifiers.

Transaction data: deposits, withdrawals (if offered), box openings, inventory actions, sell-backs, shipping requests, amounts, timestamps, and payment-provider references.

Device and log data: IP address, device/browser information, approximate location derived from IP, security logs, and diagnostic events needed to operate and protect the Platform.

Cookies and similar technologies: as described in our Cookie Policy (essential session, preferences, and optional analytics if enabled).

KYC / identity data (when required): personal details you submit (such as name and date of birth), government ID images, selfies, and related verification metadata. Documents are reviewed by our verification team under our KYC and AML Policy.

Support communications: messages you send via Contact Us or email, including optional order identifiers.

We use Stripe and BTCPay Server to process payments. Those providers receive payment and technical data needed to complete transactions (for example amount, currency, and payment method details handled on their systems). Their processing is governed by their own privacy notices in addition to this Policy.

We do not store full payment-card numbers on our servers.

When identity verification is required, we process KYC data to confirm eligibility for sensitive actions (such as withdrawals or higher-risk shipments), to prevent fraud and money laundering, and to meet legal or payment-partner expectations. Verification may involve manual internal review. KYC approval does not by itself credit a wallet or confirm a payment.

We process personal data to: create and secure accounts; process payments and deliveries; operate MysteryBox features; prevent fraud and abuse; meet KYC/AML and legal obligations; provide customer support; improve the Platform; and send transactional notices.

Depending on your location, we may rely on performance of a contract, legitimate interests (security, fraud prevention, product improvement), consent (where required), and legal obligations.

We may share data with payment processors (including Stripe and BTCPay), shipping carriers, cloud hosting, email delivery, analytics (if enabled), professional advisors, and — when KYC requires it — verification or compliance providers, only as needed to operate the service.

We may disclose information if required by law, court order, or to protect rights, safety, and integrity of the Platform and users.

We do not sell your personal information for third-party marketing.

We retain data for as long as needed for the purposes above, including legal, accounting, dispute-resolution, and fraud-prevention needs. KYC image files are typically retained for approximately 180 days after collection or final decision (unless a longer period is required for disputes or law). Verification outcomes and audit metadata may be retained longer.

Passwords are hashed. Access to sensitive records (including KYC documents) is restricted to authorized staff. We use industry-standard transport encryption (HTTPS) and hosting controls. No method of transmission or storage is 100% secure.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection to certain processing. Contact . We may need to verify your identity before fulfilling requests.

You may also lodge a complaint with a supervisory authority where available.

The Platform is not directed to anyone under 18. We do not knowingly collect data from children under that age.

Data may be processed in the United States and other countries where our providers operate. Where required, we use appropriate safeguards for cross-border transfers.

MysteryBox is operated by , .

Support:

Privacy / legal requests: . Website: . Governing law: State of , United States.

Policy version 2026.07.26.3. Last updated 2026-07-26.