1. Data we collect
- Account identifiers — email, username, password hash, country
- Identity verification documents (when required for withdrawal)
- Wallet activity — deposits, balances, transaction history
- Gameplay activity — case openings, battles, inventory, withdrawals
- Device and session metadata — IP, user-agent, approximate location
2. How we use it
- To operate the platform and your account
- To verify identity and prevent fraud
- To improve the product (only with your analytics consent)
- To send transactional communications (deposits, withdrawals, security)
- To fulfil legal obligations including age and jurisdiction checks
3. Your rights
You can access, export, and request deletion of your data at any time:
- Access — Settings → Account → Export your data
- Correction — Settings → Profile
- Erasure — Settings → Account → Delete account
- Restriction / objection — contact Support
4. Retention
Notifications are kept for 90 days. KYC documents are kept for 180 days after approval, then purged. Wallet ledger entries are anonymised after account deletion but retained for tax and audit purposes.
5. Security
We use TLS in transit and AES-256 at rest. Sensitive fields (KYC images, session user-agents) are encrypted with a separate key. Two-factor authentication is recommended and available from Settings → Security.
7. Third-party processors
- NOWPayments — cryptocurrency processing
- Resend — transactional email delivery
- Twilio Verify — phone-number verification (if used)
- PostHog — privacy-friendly product analytics (consented)
- Sentry — error monitoring
8. Contact our DPO
Email privacy@lootbox.example with any data-protection inquiry. We respond within 30 days as required by GDPR.