Privacy Policy

1.1The data controller is Vantalis Group LLC, a Wyoming limited liability company with its registered address at 30 N Gould St, Ste R, Sheridan, Wyoming 82801, USA. “We” and “us” in this policy mean that company.

1.2For any privacy question, request or complaint, write to support@packsnatch.com.

2.1This policy covers personal data we process about visitors to packsnatch.com and holders of PackSnatch accounts.

2.2It does not cover the separate processing carried out by a third-party payment or on-ramp provider when you pay them directly. Where such a provider is the merchant of record for your payment, it is a controller of that payment data in its own right and its own privacy notice applies to it.

3.1Account and profile data:

• email address, display name, avatar selection, password hash;
• where you sign in with Google or Discord, the account identifier and basic profile fields that provider returns to us.

3.2Identity verification data, where verification is required:

• full legal name, date of birth, nationality, residential address;
• government-issued identity document images and their extracted data;
• a facial image or liveness capture used to match you to that document;
• proof of address and, where we ask for it, source-of-funds evidence.

3.3Transaction and activity data:

• deposits, Pack purchases, opening outcomes, Items held, sell-backs, withdrawals;
• cryptocurrency wallet addresses you give us for withdrawal;
• shipping address where you request physical delivery;
• server seed commitments, client seeds and nonces associated with your account.

3.4Technical data:

• IP address and the country derived from it;
• device, browser and operating system information;
• pages viewed, actions taken and timestamps;
• error and diagnostic reports.

3.5Communications you send us, including support emails and their contents.

4.1Most data comes from you directly, when you register, verify your identity, transact, or contact support.

4.2Some is generated automatically as you use the Service, such as technical data and transaction records.

4.3Some comes from third parties: identity verification providers, sanctions and politically-exposed-person screening providers, fraud-prevention providers, and the sign-in provider you choose.

5.1To provide the Service — creating and running your account, processing deposits, delivering Items, handling sell-backs, withdrawals and shipments. Basis: performance of our contract with you.

5.2To verify who you are and to run anti-money-laundering and sanctions checks. Basis: compliance with legal obligations, and our legitimate interest in preventing financial crime.

5.3To enforce territory restrictions — deriving your country from your IP address and comparing your declared residency against the restricted list in Terms clause 4.2. Basis: compliance with legal obligations, and our legitimate interest in operating lawfully.

5.4To keep the Service secure and fair — detecting fraud, multi-accounting, automation and abuse; investigating incidents. Basis: our legitimate interest in protecting the Service and its users.

5.5To support you and to respond to your enquiries and complaints. Basis: performance of our contract, and our legitimate interest in running a support function.

5.6To improve the Service — diagnosing errors and understanding aggregate usage. Basis: our legitimate interest in maintaining and improving what we offer.

5.7To send marketing, where you have opted in. Basis: your consent, which you can withdraw at any time.

6.1Identity documents and facial images are sensitive. We collect them only where verification is required — before a withdrawal or a physical shipment, and where risk signals warrant it — and we use them only to confirm you are who you say you are, that you are over 18, and that you are not resident in a restricted jurisdiction.

6.2Verification is carried out by a specialist provider acting for us. Where that provider performs a biometric comparison between your selfie and your document photograph, that processing is carried out on our instruction for the sole purpose of verification and the result — not the biometric template — is what we act on.

6.3We do not use identity documents or facial images for advertising, profiling unrelated to verification and fraud prevention, or training generalised models.

7.1We share personal data with the following categories of recipient, each only to the extent needed:

• identity verification, sanctions screening and fraud prevention providers;
• payment, on-ramp, off-ramp and cryptocurrency infrastructure providers involved in moving value to or from your account;
• hosting, content delivery, database and email providers that run the Service;
• error monitoring and analytics providers;
• fulfilment and shipping partners, where you request physical delivery;
• professional advisers, including lawyers, auditors and accountants;
• law enforcement, regulators and other authorities, where we are legally required or permitted to disclose.

7.2We do not sell personal data, and we do not share it with third parties for their own independent marketing.

7.3If our business is reorganised, merged or sold, personal data may transfer to the acquiring party, which would remain bound by this policy or a policy no less protective.

7.4A current list of the specific providers we use is available on request from support@packsnatch.com.

8.1We are established in the United States, and our providers operate in the United States, the European Economic Area, the United Kingdom and elsewhere. Using the Service therefore involves transferring your personal data across borders, including to the United States.

8.2Where data is transferred out of a jurisdiction that restricts such transfers, we rely on an appropriate safeguard — most often the European Commission’s Standard Contractual Clauses or the equivalent UK addendum — together with contractual confidentiality and security obligations on the recipient.

8.3You can request details of the safeguard applying to a particular transfer by writing to support@packsnatch.com.

9.1Account and transaction data is kept for as long as your account is open.

9.2Identity verification records, transaction records and related anti-money-laundering documentation are kept for five years after your relationship with us ends. This is a records-retention obligation, and it means closing your account does not immediately erase everything we hold. Terms clause 20.3 says the same.

9.3Technical logs are kept for a shorter period, typically up to 12 months, unless retained longer for an active security or fraud investigation.

9.4Support correspondence is kept for up to 3 years from the last message.

9.5Where you have self-excluded, we retain the minimum record needed to keep the exclusion effective, for as long as it is meant to last.

10.1Data is encrypted in transit. Access to production systems is restricted to personnel who need it and is logged.

10.2Passwords are stored hashed, never in a recoverable form. We never ask for your password by email or chat.

10.3Error and diagnostic reports are scrubbed of credentials and sensitive parameters before they leave the Service.

10.4No system is perfectly secure. If a breach affects your personal data and creates a real risk to you, we will notify you and the relevant authority as required by law.

11.1Subject to the law that applies to you, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete data we no longer have a lawful reason to keep;
• restrict how we use it, while a dispute about it is resolved;
• provide it in a portable, machine-readable form, or send it to another controller;
• stop processing based on legitimate interests, where your circumstances give you grounds to object;
• withdraw consent you previously gave, such as for marketing.

11.2Some rights are limited. We cannot delete records we are required to retain under clause 9.2, and we cannot provide information that would reveal a suspicious-activity report or prejudice an investigation.

11.3Write to support@packsnatch.com from your account email. We respond within 30 days and will tell you if we need longer. We do not charge for this, and we will not make using the Service worse because you exercised a right.

12.1We use automated checks to screen for sanctions matches, fraud and territory restrictions. An automated check can block a transaction or restrict an account.

12.2Where an automated decision materially affects you, you can ask for it to be reviewed by a person, explain your circumstances, and contest the outcome. Write to support@packsnatch.com.

13.1We use cookies and local storage that are necessary for the Service: keeping you signed in, preserving your session, remembering your sound preference, and carrying a referral reference where you arrived through one.

13.2We use limited analytics and error-monitoring technologies to understand aggregate usage and to diagnose faults.

13.3You can block or delete cookies in your browser. Blocking necessary cookies will stop you being able to sign in.

14.1The Service is for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18.

14.2If you believe someone under 18 has given us personal data, write to support@packsnatch.com and we will close the account and delete the data, keeping only what we must under clause 9.2.

15.1We may update this policy. Where a change materially affects you, we will give notice on the Service or by email before it takes effect, and the effective date at the top of this page will change.

16.1Contact us first at support@packsnatch.com. We would rather fix a problem than have you escalate it.

16.2If you are not satisfied with our response, you may be able to complain to a data protection authority. Which one depends on where you live. Users in Australia may contact the Office of the Australian Information Commissioner. Users in the European Economic Area or the United Kingdom may contact their national supervisory authority. We will tell you which authority we consider applicable to your case if you ask.