Privacy Policy

Effective August 14, 2026

Mystery Pak ™ sells a single limited-edition collectible directly to customers. This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. Questions? Email info@mysterypak.com.

Information we collect

• Order information — your name, email address, shipping address, order contents, order number and shipment tracking. Provided by you at checkout.
• Payment information — card details are entered directly with our payment processor and never touch our servers. We receive only the payment status, amount, currency and a transaction reference.
• VIP pre-order information — name, email, mailing address, requested quantity and, optionally, a brand name and logo, for customers who applied for early access.
• Newsletter information — your email address and the date you opted in, if you choose to subscribe.
• Support correspondence — emails you send us and our replies.
• Technical information — server logs and rate-limiting records containing a truncated network address, used to keep the store secure and prevent abuse.

Why we use it (lawful bases)

• To take, process, fulfil and ship your order, and to handle refunds and disputes — this is necessary to perform our contract with you.
• To send transactional email such as order confirmations and shipment notifications — also contract performance.
• To send marketing email — only with your consent, which you can withdraw at any time.
• To prevent fraud, enforce purchase limits and secure the store — our legitimate interest.
• To keep tax and sales records — a legal obligation.

Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share only what is needed with service providers acting on our instructions:

• Our payment processor, to take payment and handle refunds and chargebacks.
• Our email delivery provider, to send transactional and newsletter email.
• Our hosting and database provider, which stores order and subscriber records.
• Shipping carriers, to deliver your order and provide tracking.
• Authorities or advisors, where we are legally required to disclose.

Cookies and local storage

This site does not run third-party advertising or analytics tags. We use browser storage that is strictly necessary to operate the store: your shopping cart, your checkout session with the payment processor, your consent choice, and — for staff only — an administrator sign-in session. If we ever add optional analytics, nothing will load until you have given consent through the banner, and you can withdraw that consent below at any time.

How long we keep it

Order and payment records are kept for seven years to meet tax and accounting obligations. Newsletter subscriptions are kept until you unsubscribe, after which we keep your address on a suppression list so we do not email you again. VIP applications that never converted are kept for two years. Security and rate-limiting logs are kept for 90 days.

Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, opt out of marketing, opt out of the sale or sharing of personal information (we do neither), and to be free from discrimination for exercising these rights. Residents of the EU/UK have these rights under the GDPR and UK GDPR; residents of California, Colorado, Connecticut, Virginia and other US states with privacy laws have equivalent rights. Use the form below or email us and we will respond within 30 days (45 days in California, where permitted). If you are in the EU or UK and are unhappy with our response, you may complain to your local supervisory authority.

Children

This store is intended for adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, email us and we will delete it.

International transfers

We are based in the United States, and our providers process data in the United States and the European Union. Where personal information is transferred out of the EU/UK, our providers rely on the European Commission's Standard Contractual Clauses.

Changes to this policy

If we make a material change we will update the effective date at the top of this page and, where required, notify you by email.

Request my data or delete my data

Submit a request and we will verify your identity by replying to the email address on your order before we act on it.