Privacy Policy

Effective Date: 1 May 2026

This Privacy Policy describes how Mystery Box Advertising Services ("we", "us", "our", or the "Company"), an emerging economic establishment licensed in the Emirate of Abu Dhabi, United Arab Emirates (Licence No. CN-6490590; Unified Licence No. 501-2026-200068763; Unified Registration No. 101-2026-200101369), collects, uses, and discloses information when you ("you" or "User") access or use the Mystery Box website and related services (the "Service").

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, do not use the Service.

1. Information You Provide

To "break" a block on the Service, you are required to submit:

• A name (which you may choose to be your real name, a pseudonym, a handle, or any other label);
• An email address;
• A city; and
• A country.

Submission of this information is voluntary, but is required to break a block. We do not verify, authenticate, or validate the accuracy of any information you submit. You acknowledge that all information appearing on the Service in connection with broken blocks is User-supplied and may be inaccurate, fictitious, or deliberately falsified.

Your email address is used for receipts, invoicing, purchase reconciliation, fraud prevention, customer support, and collating purchases when the Mystery Box is complete. Your email address is treated as private transaction metadata and is not displayed in the public block view or public leaderboard.

2. Information We Do Not Collect

We do not embed third-party advertising trackers, analytics scripts, behavioural pixels, fingerprinting tools, or other tracking technologies beyond those strictly required for the Service to operate. In particular, we do not collect:

• Information about your browsing activity outside the Service;
• Device fingerprinting data;
• Information from social media or other third-party platforms;
• Any information you have not voluntarily and explicitly entered into the Service.

The only third-party processors involved in our operations are those expressly identified in this Policy (such as our payment processor and infrastructure provider).

3. Payments

Payments for breaking blocks are processed exclusively by Stripe, Inc. ("Stripe"). We accept payments in United States Dollars (USD) via credit card, Apple Pay, Google Pay, and Stripe Link.

When you make a payment, your payment credentials (such as full card details) are transmitted directly to Stripe and are governed by Stripe's privacy policy, available at https://stripe.com/privacy. We do not store, access, or process full payment card numbers on our systems. We may receive limited transaction metadata from Stripe (such as a transaction identifier, payment status, and the last four digits of the card used) for the purpose of fulfilling and reconciling your purchase.

4. Public Display of Information

You acknowledge and agree that, once a block has been broken, the public name, city, country, and block/package information you provided will be permanently associated with that block within our systems. Your email address remains private transaction metadata. Once all blocks in the Mystery Box have been broken, the public contents of all blocks will be displayed on a publicly accessible global leaderboard that may be viewed by anyone, anywhere in the world, with or without an account.

The public name, city, and country you submit to the Service are intended to be public. You should not submit public block information you do not wish to be made publicly available worldwide. You bear sole responsibility for the consequences of any public information you choose to enter.

5. Data Retention

We retain User-submitted block information, private email metadata, and associated transaction records for a minimum period of five (5) years from the date of submission, in line with applicable record-keeping obligations under UAE law. After the expiry of this minimum retention period, we may, at our sole and absolute discretion, continue to retain, archive, display, or delete such information indefinitely. We make no binding commitment as to the duration of public display beyond the minimum retention period.

You further acknowledge that, given the public nature of the leaderboard, public block information may be copied, cached, archived, indexed, or screenshotted by third parties, search engines, web archives, or other Users. We have no ability to control, retrieve, or compel the deletion of any such third-party copies.

6. Disclosure of Information

We do not sell, rent, or trade your information. We may disclose information:

• To Stripe, solely for the purpose of processing your payment;
• To our hosting and infrastructure providers, strictly to operate and maintain the Service;
• To competent authorities, where required by applicable law, regulation, court order, or governmental request;
• To enforce our Terms of Service or to protect our rights, property, or the safety of others;
• In connection with a business transfer, such as a merger, acquisition, or sale of assets, in which case the recipient will be bound by obligations no less protective than those described in this Policy.

7. International Transfers

The Service is operated from the Emirate of Abu Dhabi, United Arab Emirates. If you access the Service from outside the UAE, you consent to the transfer, storage, and processing of your information in the UAE, which may have data protection laws that differ from those in your jurisdiction.

8. Children

The Service is not directed to, and is not intended for use by, individuals under the age of eighteen (18). We do not knowingly collect information from children. If you believe a minor has submitted information to the Service, please contact us and we will take reasonable steps to remove it from public display.

9. Your Rights

Depending on your jurisdiction, you may have rights to request access to, correction of, or deletion of your personal data, or to object to or restrict its processing. To exercise any such right, contact us using the details below. We will respond within the timeframe required by applicable law.

Please note that information that has been published to the public leaderboard may not be retrievable from third parties even after we remove it from the Service, and that we may retain certain information to the extent permitted or required by law.

10. Security

We implement reasonable technical and organisational measures designed to protect information you submit. However, no method of internet transmission or electronic storage is completely secure, and we cannot and do not guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top of the Policy will reflect the most recent revision. Material changes will be communicated through the Service. Your continued use of the Service after any change constitutes your acceptance of the revised Policy.

12. Contact

For questions or requests relating to this Privacy Policy, contact us at: info@mysterybox.art

Mystery Box Advertising Services

Emirate of Abu Dhabi, United Arab Emirates

Licence No. CN-6490590