Back

Privacy Policy

Last updated: October 9, 2026

This Privacy Policy explains what personal information GachaBox collects, why, who we share it with, how long we keep it, and the rights you have where you live. It applies to all consumers who use the Service.

1. Personal information we collect

We collect only what is needed to operate the Service. Specifically:

  • Account & authentication. Email address and display name via our authentication provider Clerk. Date of birth, used solely to verify the 18+ eligibility requirement and never sold or shared.
  • Payment information. Payment-card details are entered directly into Stripe and tokenized; GachaBox never sees or stores your card number, expiry, or CVV. We retain Stripe customer and charge identifiers, the last four digits of the card, the card brand, billing country, and the amount and currency of each transaction.
  • Behavioral information. Pulls, claims, and reveal events associated with your account, together with the timestamps and outcomes generated by the server-side draw engine.
  • Technical information. IP address, user-agent, approximate country/region (from the IP), and request timestamps. We capture these on consent submission, on reveal/claim (in RevealAuditLog), and on payment dispute, so that we can defend chargebacks and detect fraud.
  • User-provided information. Discord handle — when entering a tournament, where it is shown publicly on the tournament bracket so opponents can reach you, and, for Chase outcomes awarded under our earlier Discord-delivery process, to deliver that prize; messages you send to our support, disputes, abuse, privacy, or DMCA mailboxes. When you enter a tournament, our staff may also check the Hive ID and username of the account you enter against our records to verify eligibility; these are never published.

2. How we use this information

  • Service delivery. Authenticate your account; process pulls, claims, and reveals; deliver Chase outcomes awarded under our earlier Discord-delivery process via Discord; send transaction receipts.
  • Fraud prevention & security. Detect stolen-card use, abusive automation, multi-accounting, and chargeback fraud; rate-limit abusive traffic; investigate reports sent to abuse@gachabox.com.
  • Dispute defense. When you initiate a payment dispute we assemble evidence required by Visa Compelling Evidence 3.0 and Mastercard dispute rules, including your acceptance of our Terms (content hash, IP, user-agent, timestamp) and rows from RevealAuditLog showing that the purchased credentials were revealed to you.
  • Legal compliance. Tax recordkeeping, sanctions screening, response to lawful requests from authorities, and exercising or defending legal claims.
  • Service improvement & communication. Operational notices about changes to the Service, the legal-document bundle (re-prompt at next checkout when hashes change), and security advisories.

3. Third-party processors we share with

We use the following sub-processors. Each has its own privacy notice, linked below. We do not sell or share personal information for cross-context behavioral advertising.

We may also share information where required by law, valid legal process, or to protect our rights or those of our users (e.g., responding to a subpoena or to a law-enforcement request that complies with applicable law).

4. How long we keep it

  • Active account data: for as long as your account is active.
  • Tax and financial records: seven (7) years from the date of the transaction, to satisfy tax-record retention requirements in the United States, Canada, the United Kingdom, Australia, and New Zealand.
  • Chargeback and dispute evidence: five (5) years from the dispute, to satisfy card-network retention rules and to defend later-filed claims.
  • Deletion requests: see §10. After a verified deletion we retain only the minimum information needed to comply with the tax and dispute retention rules above; everything else is removed within thirty (30) days of the request.

5. California — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the following rights:

  • Right to know what personal information we have collected, the categories of sources, the business purposes, and the categories of third parties we share it with.
  • Right to delete personal information we have collected from you.
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined under the CPRA, including not sharing for cross-context behavioral advertising.
  • Right to limit the use of sensitive personal information; we do not use sensitive personal information beyond what is necessary to provide the Service.
  • Right to non-discrimination for exercising any of the above.

California residents may exercise these rights from /dashboard/privacy or by emailing privacy@gachabox.com. An authorized agent may submit a request on your behalf with proof of authorization. We verify identity by matching the request to information already associated with your account before fulfilling it.

6. United Kingdom — UK GDPR & Data (Use and Access) Act 2025

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you rights of subject access, rectification, erasure, restriction of processing, portability, and objection. The Data (Use and Access) Act 2025 introduces a seventh lawful basis — "recognised legitimate interest" — for narrowly-listed public-interest processing; we do not currently rely on that basis.

You may exercise these rights at /dashboard/privacy or by emailing privacy@gachabox.com. If you are not satisfied with our response you may complain to the UK Information Commissioner's Office at ico.org.uk.

7. Australia — Privacy Act 1988 & the 13 APPs

If you are in Australia, the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) apply. You have the right to access (APP 12) and correct (APP 13) the personal information we hold about you. We give a collection notice under APP 5 at the point of collection (account signup, checkout, tournament entry, Chase claim under our earlier Discord-delivery process). Under APP 8, we remain accountable for personal information disclosed to overseas processors (Stripe, Clerk, Supabase, Vercel, Discord — all in the United States).

Privacy concerns must first be raised with us; we will respond within thirty (30) days. If unresolved you may escalate to the Office of the Australian Information Commissioner at oaic.gov.au.

8. New Zealand — Privacy Act 2020 & IPP 3A (effective 1 May 2026)

If you are in New Zealand, the Privacy Act 2020 and its Information Privacy Principles (IPPs) apply. You have rights of access (IPP 6) and correction (IPP 7), ordinarily fulfilled within twenty (20) working days. Cross-border transfers to the United States are governed by IPP 12, with comparable safeguards in place.

IPP 3A — indirect-collection notice (effective 1 May 2026). Where GachaBox collects your personal information from a source other than you — for example, identity-verification data returned by Stripe Identity, fraud-screening signals returned by our payment processor, or sanctions-list match data — we will tell you, at or before the time of use, what was collected, from whom, and why. This is a new statutory requirement under the Privacy Amendment Act 2025; we comply from its 1 May 2026 commencement.

Privacy complaints may be raised first with us, then escalated to the Office of the Privacy Commissioner at privacy.org.nz.

9. Canada — PIPEDA & provincial privacy laws

If you reside in an English-language province or territory of Canada (BC, AB, SK, MB, ON, NB, NS, PE, NL, NT, YT, NU), the Personal Information Protection and Electronic Documents Act (PIPEDA) governs our collection, use, and disclosure of your personal information. Residents of British Columbia and Alberta may also rely on their provincial Personal Information Protection Acts and the offices of their respective Information and Privacy Commissioners.

You have the right to access and correct your personal information, to know to whom we have disclosed it, and to withdraw consent (subject to legal or contractual limits).

The Service is not available in Quebec; Quebec residents are blocked at signup and we do not knowingly process personal information governed by Quebec's Law 25. Privacy complaints may be escalated to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

10. How to exercise your rights

The fastest way to exercise your rights is through the privacy controls on your dashboard:

  • Export your data via the export endpoint exposed at /api/user/export (linked from /dashboard/privacy; the in-dashboard UI is being rolled out and will be available shortly).
  • Delete your account via /api/user/delete. Deletion is processed as a soft-delete with a thirty (30) day grace period during which it can be cancelled via /api/user/cancel-deletion; after the grace period, personal data is removed except where we are required to retain it for tax or dispute recordkeeping (see §4).

You can also contact us directly at privacy@gachabox.com. We respond to verified requests within thirty (30) days, or within the shorter statutory window applicable to your jurisdiction.

11. Children

The Service is offered to adults aged 18 or older. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected personal information from a person under 18, we delete the account and the information promptly. If you believe a minor has created an account, please email privacy@gachabox.com.

12. Security

We protect personal information using industry-standard safeguards: TLS encryption in transit, AES-256-GCM authenticated encryption at rest for stored credential material (see src/lib/crypto.ts for the encryption boundary), Stripe-tokenized payment cards (we never see card numbers), and Clerk-managed authentication with hardened session handling. Access to production data is limited to the operator and is logged. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security but we work to reduce risk continuously.

13. International transfers

The Service is hosted on Vercel and stored on Supabase, both in the United States. Stripe, Clerk, and Discord likewise process information in the United States. If you access the Service from the United Kingdom, Australia, New Zealand, or Canada, your personal information will be transferred to and processed in the United States. For UK transfers we rely on either an applicable adequacy decision or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses where required; for other jurisdictions we rely on the cross-border accountability and comparable-safeguard provisions of local law (APP 8 in Australia, IPP 12 in New Zealand, PIPEDA accountability in Canada).

14. Marketing communications

Marketing emails are sent only with your prior consent. We do not pre-tick consent boxes; opt-in is express. Every marketing message identifies the sender, gives a working unsubscribe link, and is honoured within the statutory windows: ten (10) business days under Canada's Anti-Spam Legislation (CASL), five (5) business days under the Australian Spam Act 2003 and the New Zealand Unsolicited Electronic Messages Act 2007, and ten (10) business days under the US CAN-SPAM Act. UK marketing complies with the Privacy and Electronic Communications Regulations (PECR), including the soft-opt-in for our own similar products and an unsubscribe link in every message. Operational and transactional notices (receipts, security alerts, legal-bundle re-prompt notifications) are not marketing and are not opt-out-able while you have an active account.

15. Cookies & similar technologies

Our use of cookies and similar technologies is described in our Cookie Policy, which lists every cookie set by GachaBox or by an essential third party (Clerk, Stripe), the purpose of each, and how to manage your choices. Non-essential categories (analytics, marketing) currently have no cookies enabled; if that changes we will update the Cookie Policy and re-prompt for consent.

16. Changes to this policy & contact

We may update this Privacy Policy from time to time. The current SHA-256 content hash and effective date are exposed in our legal-document registry; when the bundle hash differs from the hash you most recently accepted you will be re-prompted at your next checkout. Material changes will additionally be notified by email.

For privacy questions or requests, contact us at privacy@gachabox.com. The operator's legal name and notice address are set out in §17 of our Terms of Service.