Privacy Policy

PLACEHOLDER — REVIEW WITH A LICENSED ATTORNEY BEFORE GOING LIVE.This is template language and is NOT legal advice. Have a CCPA/CPRA- familiar attorney review and customize before publishing.

1. What we collect

• Information you provide on entry forms (e.g. name, phone number, email, Instagram handle, age group, survey responses)
• Information about the specific Mystery Box campaign you entered (campaign key, shop name, timestamp)
• Technical information (IP address, user-agent)
• SMS opt-in status (only if you provided a phone number)

2. How we use it

• Operate the Mystery Box giveaway and contact winners
• Send recurring promotional and personalized marketing text messages from @itsmysterybox, if you opted in by providing a phone number through the main entry form. Messages may be curated based on the participating shops you visit.
• Prevent fraud and rate-limit abuse
• Improve our service and analyze entries in aggregate

3. Sharing

We do not share or sell your contact information with participating retail locations or third parties for their direct marketing. We use trusted service providers (Twilio for SMS, Resend for email, Airtable for storage, Vercel for hosting) under standard data processing agreements.

4. SMS / TCPA

By providing a phone number on a main-entry form, you consent to receive recurring automated marketing text messages from @itsmysterybox. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for help. Consent is not required to enter; see Official Rules §4(b) for the free alternate method of entry.

5. California Residents (CCPA/CPRA)

California residents have specific rights regarding their personal information, including the right to know, delete, correct, and limit the use of sensitive personal information. To exercise these rights, email [privacy email]. We do not sell personal information.

6. Retention

Entry data is retained for as long as you remain on our marketing list (if applicable) and for a reasonable period thereafter to comply with legal obligations. AMOE entries are retained only for the duration of the relevant promotion plus 90 days.

7. Contact

For any privacy questions, email [privacy email].

Last updated: [date]. Return home.