Privacy Policy

1. Introduction

WishUnbox LLC, a Wyoming LLC DBA WishUnbox (together with its subsidiaries and affiliates, "WishUnbox", "we," "our" or "us") believes that the privacy of its users is paramount. This Privacy Policy (the "Privacy Policy") serves to inform you of our policies and procedures regarding the collection, use and disclosure of the information we receive when you access and use the website (the "Site"), services, software, content, and all other products and services (all of the foregoing collectively, the "Services") owned, controlled or offered, directly or indirectly, by WishUnbox LLC, a Wyoming LLC dba WishUnbox.

2. Agreement to Policy

The Privacy Policy is incorporated by reference into our Terms of Service. Any terms used herein and not defined will have the meanings given to them in the Terms of Service. By using the Services, you hereby warrant and represent that you have read, understand and agree to this Privacy Policy and the Terms of Service and that you are over 18 years of age.

PLEASE DO NOT USE OR ACCESS THE SERVICES IF YOU DO NOT AGREE TO THIS PRIVACY POLICY.

3. Information We Collect

3.1. Information You Provide To Us

When you use the Services or otherwise communicate with us, we collect information that you provide to us directly. For example, we collect information when you: (i) visit the Site; (ii) register for an account as a creator or a gifter (an "Account"); (iii) create or update a wishlist; (iv) make a cash gift or purchase through the Services; (v) connect your Account to third-party social media platforms; (vi) sign up for newsletters or updates; (vii) request technical support; or (viii) communicate with us via the Site, email, or social media.

The information you provide may include, without limitation, the following which may constitute Personal Information:

• Gifter Information: Information provided when sending a gift, including your name, email address, the recipient's identifier, and any personal messages or notes you choose to include with the gift.
• Creator Profile & Registration: Information provided when registering as a creator, including your legal name, stage name or username, email address, profile picture, social media handles.
• Wishlist Data: Details about the items or "cash goals" you add to your wishlist, including descriptions, price points, and categories.
• Communication & Support: Information provided via our support channels, contact forms, or email, including your inquiry details and any files or screenshots you provide to resolve technical issues.
• Newsletter & Marketing: Information provided to subscribe to updates, including your email address and preferences regarding the types of notifications you wish to receive.
• Business & Financial Relations: If you are a business partner or supplier, we may process limited Personal Information such as your company name, title, and business contact details to facilitate our professional relationship.
• Transaction and Payout Data: Limited (non-PCI) data related to your transactions. While we use third-party processors for payments, we may retain records of transaction IDs, dates, and amounts to facilitate support and payouts.
• Correspondence Records: If you contact us, we may keep a record of that correspondence for quality assurance and training.

3.2. Automatically Collected Information

Most of the data we collect is technical in nature and is processed automatically through APIs, software development kits (SDKs), cookies, and similar technologies. This data may include:

• Usage Data: Including search terms entered, wishlists viewed, and interaction with various features of the Services.
• Network and Device Information: Including Internet Protocol (IP) addresses, browser type, operating system, device identifiers, and location information derived from your IP address.
• Google Analytics: We use Google Analytics to understand Site traffic and user behavior. Google Analytics uses cookies to collect data such as time of visit and pages viewed. You may opt out via the Google Analytics Opt-out Browser Add-on.

3.3. Information You Post on the Services

The Services allow creators to build customized profiles, including "avatars," cover photos, and public wishlists. Information you provide in your public profile or on your wishlist will be available to the public generally. We have no obligation to keep private any information that you disclose to other users or the public.

Privacy Shield: Notwithstanding the above, a creator's legal name (if different from their username), payout details, and verified mailing address provided to us for administrative purposes will not be available to the public or to the gifter.

3.4. Information Shared via Third-Party Services

The Services may allow you to link your account to social media services (e.g., Twitter/X, Instagram, TikTok). This may result in the sharing of information between our Services and those third-party platforms. We encourage you to review the privacy settings of those services to understand how your data is shared.

3.5. How We Use Cookies and Other Technologies

We use "cookies" small text files stored on your device to measure page access, track feature usage, and improve the user experience.

We and our service providers may also use "pixel tags" or "web beacons" to track the actions of users, measure the success of marketing campaigns, and compile statistics about Site usage.

4. Use of Collected Information

We use the information you provide to us for the following purposes:

• (i) to further our legitimate interests in providing the Services, including without limitation to facilitate the collection of cash gifts from gifters and the remittance of payouts to creators;
• (ii) to administer your use of the Services and any Accounts you may have with us;
• (iii) to personalize your experience, such as customizing your wishlist display or creator profile;
• (iv) to provide you with Service announcements, transaction receipts, payout notifications, or inform you of new releases and features;
• (v) to provide you with further information and offers from us or third parties that we believe you may find useful or interesting, such as newsletters, marketing or promotional materials;
• (vi) to perform tasks on behalf of and according to instructions of a third party, such as payment processors used to handle financial transactions, identity verification services, or our advertising partners;
• (vii) to enforce our Terms of Service;
• (viii) to resolve any disputes between users of the Site (e.g., between a gifter and a creator regarding a transaction) or between such users and us;
• (ix) to comply with a legal requirement or process, including, but not limited to, civil and criminal subpoenas, court orders, or other compulsory disclosures, and to meet tax reporting obligations as a US entity;
• (x) to further our legitimate interest in protecting our rights, property, or safety and the rights, property and safety of the Services, our users or the public, including the detection and prevention of fraudulent gifting or money laundering; and
• (xi) to contact you to obtain feedback from you regarding the Site and the Services.

In addition to the purposes described above, we use the information collected automatically to:

• (i) further our legitimate interests in monitoring and analyzing the use of the Services and for the technical administration of the Site;
• (ii) improve the Site and the Services;
• (iii) generate and derive useful data and information concerning the interests, characteristics, and website use behavior of our users to improve the marketplace experience; and
• (iv) verify that users of the Services meet the criteria required to process their requests, such as ensuring a creator has provided sufficient information to receive a payout.

5. Sharing Information with Third Parties

We do not sell your Personal Information. However, we may disclose certain categories of information to third parties to facilitate the operation of our Services, comply with legal obligations, or protect our business interests. We share information with the following categories of third parties:

5.1. Payment Service Providers (PSPs) and Financial Partners

To facilitate the marketplace and cash-gifting functionality, we share information with third-party payment settlement entities and financial institutions.

• Sub-Merchant Processing: We share information with our PSPs to enable the creation of creator sub-merchant accounts and sub-wallets. This data is used for transaction processing, remittance of funds, and the automatic splitting of platform commissions.
• Identity and Compliance: We share data with partners who provide "Know Your Customer" (KYC), Anti-Money Laundering (AML), and fraud-prevention services. In many cases, sensitive documentation (such as government IDs) is provided directly to these partners through our interface, and we do not store such sensitive data on our own servers.

5.2. Technical Service Providers and Infrastructure

We share information with companies that provide the technical backbone of our Site:

• Hosting and Cloud Services: Information is stored on secure servers managed by our third-party cloud infrastructure providers.
• Security and Monitoring: We share technical data (such as IP addresses) with security vendors who help us detect malicious activity, prevent "bot" attacks, and monitor system performance.

5.3. Analytics and Operational Tools

We share limited, often de-identified or technical data with providers that help us optimize the platform:

• Platform Analytics: To understand user behavior and improve the user interface.
• Customer Support and Communication: We share contact information and inquiry details with third-party tools used to manage our support tickets, emails, and social media interactions.

5.4. Other Users (Creators and Gifters)

As a marketplace, the core of our service requires sharing limited information between users to complete a transaction:

• Gifter to Creator: We disclose the information you provide when sending a gift (e.g., your name/alias and message) to the recipient creator.
• Creator to Gifter: We disclose the creator's public profile information and the status of the gift to the gifter.
• Note: Private identifiers, legal names (unless used as a username), and financial sub-wallet details are never shared between users.

5.5. Legal, Regulatory, and Law Enforcement Authorities

As a US-registered entity, we may disclose Personal Information to government authorities or third parties if required to do so by law or in the good faith belief that such action is necessary to:

• Comply with a legal obligation, such as a subpoena, court order, or government audit.
• Protect and defend the rights, property, or safety of the company, our users, or the public.
• Assist our PSPs in fulfilling their own regulatory reporting requirements.

5.6. Business Transfers

In the event that we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, or sale of company assets, your information may be disclosed or transferred as part of that transaction.

6. Security of your Personal Information

WishUnbox secures your personal information from unauthorized access, use, or disclosure. We utilize industry-standard methods and technologies for this purpose, including:

6.1. Encryption and SSL Protocol

We use the Secure Sockets Layer (SSL) protocol and Transport Layer Security (TLS) to encrypt data in transit. When sensitive information (such as personal identifiers or financial data) is transmitted through our Services or to our third-party Payment Service Providers (PSPs), it is protected through the use of high-level encryption.

6.2. Financial Data and Tokenization

Because we utilize a marketplace API for sub-merchant accounts:

• Storage: We do not store full credit card numbers, bank account details, or government-issued identification on our servers.
• Processing: All sensitive financial data and "Know Your Customer" (KYC) documentation are processed directly by our PCI-DSS compliant PSPs.
• Tokenization: We use secure tokens to interact with our PSPs, ensuring that your primary financial credentials are never exposed within our local database environment.

6.3. Administrative and Technical Safeguards

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. This includes internal reviews of our data collection, storage, and processing practices, as well as physical and digital security measures to guard against unauthorized access to the systems where we store personal data.

6.4. Disclaimer and Limitations

Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, you acknowledge that:

• (a) there are security and privacy limitations inherent to the Internet which are beyond our control;
• (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through this Site cannot be guaranteed; and
• (c) you are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your Account.

7. Use of Cookies and Tracking Technologies

WishUnbox may use "cookies" to help personalize your online experience. A cookie is a small text file that is placed on your device by a web page server. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie to you.

7.1. Why We Use Cookies

One of the primary purposes of cookies is to provide convenience features to save you time. The purpose of a cookie is to tell the web server that you have returned to a specific page. For WishUnbox, cookies help us:

• Maintain Your Session: Keep you logged into your Account as you move between your wishlist and your creator dashboard.
• Recall Preferences: Remember your customized settings, such as your display language or profile layout.
• Security & Fraud Prevention: Help our Payment Service Providers (PSPs) identify your device to prevent unauthorized logins or fraudulent transactions.
• Analytics: Understand how visitors interact with the Site so we can improve the user interface and performance.

7.2. Third-Party Cookies

In addition to our own cookies, we may allow third parties (such as Google Analytics or our PSPs) to place cookies on your device. These third-party cookies are used to perform services on our behalf, such as analyzing web traffic or providing secure payment interfaces. We do not have control over the information collected by these third parties in their own cookies.

7.3. Managing Your Cookies

You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer.

Please Note: If you choose to decline cookies, you may not be able to fully experience the interactive features of the WishUnbox services. For example, you may be unable to stay logged into your Account or complete the gifting process successfully.

7.4. "Do Not Track" and Global Privacy Control (GPC)

Some web browsers incorporate a "Do Not Track" (DNT) feature. While there is no universal standard for DNT, WishUnbox recognizes and processes Global Privacy Control (GPC) signals where required by applicable law. If our system detects a GPC signal from your browser, we will treat it as a valid request to opt-out of the "sharing" of your personal information for targeted advertising purposes for that specific browser.

8. Right to Deletion

Subject to certain exceptions set out below, upon receipt of a verifiable request from you, we will:

• Delete your personal information from our records; and
• Direct our service providers (such as our PSPs and infrastructure partners) to delete your personal information from their records.

8.1. Exceptions to Deletion

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

1. Complete Transactions & Financial Records: Complete the transaction for which the personal information was collected (e.g., ensuring a gift reaches a creator), provide a service requested by you, or otherwise perform a contract between you and us.
2. Security and Fraud: Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity. This is critical for preventing "wash trading" or gift-scams on the platform.
3. Technical Integrity: Debug to identify and repair errors that impair existing intended functionality.
4. Legal and Tax Compliance: Comply with an existing legal or tax obligation. For example, as a US entity, financial records and certain "Know Your Customer" (KYC) data must often be retained for a period of 7 years to comply with IRS and federal banking regulations.
5. Internal Use: Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information (e.g., maintaining an internal "blocklist" of fraudulent users).

9. Your GDPR and California Privacy Rights

We strive to comply with all applicable privacy and data security laws, including the EU's General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA").

We do not sell your Personal Information to third parties for their direct marketing purposes. If our practices change, we will update this policy and provide an opt-out mechanism as required by law. Where GDPR and CCPA apply, you may have the following rights:

9.1. Requests to Know and Access

You have the right to request that we disclose the categories of Personal Information we have collected, the sources of that information, the business purpose for collecting it, and the specific pieces of data we hold about you. We are not required to respond to "Requests to Know" more than twice in a 12-month period.

9.2. Requests to Delete

You have the right to request the deletion of your Personal Information, subject to the legal and financial exceptions (such as tax reporting or fraud prevention) outlined in Section 7 of this policy.

9.3. Methods for Submitting Requests

You may submit a request to access or delete your data via:

• Email: support@wishunbox.com

To protect your privacy, we will verify your identity before fulfilling any request. We will acknowledge your request within 14 days and aim to provide a full response within 45 days.

9.4. Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights. We will not deny you services, charge different prices, or provide a different level of quality based on your exercise of these rights.

9.5. Right to Correction

You have the right to request that we correct any inaccurate or incomplete Personal Information we maintain about you. Upon receipt of a verifiable request, we will use commercially reasonable efforts to correct the information as directed.

9.6. Withdrawal of Consent

Where you have provided consent for the processing of your data (such as for marketing communications), you have the right to withdraw that consent at any time. Withdrawing consent is as easy as providing it, and can be done via your account settings or by contacting us at the email address provided below.

10. International Transfers of Personal Information

For the purposes of the GDPR, WishUnbox LLC is the Data Controller of the Personal Information we collect.

• US-Based Operations: WishUnbox is based in the United States. Personal Data collected through our Services will be transferred to and stored on our servers in the U.S.
• Global Transfers: We may work with third-party service providers (such as our PSPs and cloud hosts) in various countries. Therefore, your information may be transferred to, and accessed from, countries other than your own.
• Legal Safeguards: In all such instances, we transfer and disclose Personal Information solely for the purposes described in this Privacy Policy and in compliance with applicable laws. We utilize industry-standard safeguards, such as the Standard Contractual Clauses (SCCs) approved by the European Commission, for the transfer of data from the European Economic Area to third countries.

11. Children's Privacy

Our Services are not intended for use by children. We do not knowingly collect Personal Information from individuals under the age of 18. If we become aware that an individual under 18 has provided us with Personal Information, we will take immediate steps to delete such information and terminate the associated Account.

12. Links to Other Websites

Our Services may contain links to third-party websites, plug-ins, or applications that are not owned or controlled by WishUnbox. Please be aware that we are not responsible for the privacy practices of such other sites or third parties. We encourage you to be aware when you leave our Site and to read the privacy statements of every website that collects Personal Information. This Privacy Policy applies solely to information collected by WishUnbox through our Services.

13. Changes to the Privacy Policy

Our security and Privacy Policy are periodically reviewed and enhanced as necessary. This Privacy Policy might change as we update and expand the Services. You can tell when this Privacy Policy was last updated by reviewing the "Last Updated" legend at the top of this page.

We will endeavor to notify you of significant changes by email or through a notice on the Site, but we will not be liable for any failure to do so. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting the information we collect. If you do not understand any of the terms or conditions of any of our policies, you may inquire regarding the same via the contact methods listed below.

Your continued use of the Services after any change in this Privacy Policy will constitute your acceptance of such change.

14. Contacting Us

If you have any concerns, questions, or specialized requests regarding this Privacy Policy or your Personal Information, please contact us at:

• Email: support@wishunbox.com