Your data, plainly
Privacy policy.
Who we are
MISTY is a trading name of VGT Ventures Ltd, the data controller for information collected on themistybox.com. Contact: support@themistybox.com.
What we collect
Account and entry data (name, email address, date of birth, country), entry records, skill-question answers, box opens and credits, and billing details processed by our payment provider, Stripe. We do not store card numbers. We collect approximate location (country level) from your IP address to enforce regional restrictions.
How we use it
To run competitions (allocating numbered entries, drawing and contacting winners, delivering prizes), to meet legal obligations (age verification, fraud prevention, regional restrictions), and to send service and marketing emails you can opt out of at any time.
Who processes it
Our infrastructure providers process data on our behalf: Supabase (database, EU-hosted in London), Vercel (hosting), Stripe (payments) and Resend (email delivery). Winners' first names and entry numbers may be published on the site and our channels as part of draw results.
Your rights
Under UK GDPR you may request access, correction, deletion or export of your personal data, and object to or restrict processing, by emailing support@themistybox.com. Entry records connected to a completed draw are retained as long as legally required for audit of that competition. You may complain to the ICO (ico.org.uk).
Cookies
We use only essential cookies: session/authentication and the regional-preview cookie. We do not run third-party advertising cookies. If that changes, this policy and a consent banner will be updated first.