What we collect
- Transaction data. Razorpay Payment ID, amount, timestamp and payment status. This is what lets us look up your purchase when you need support.
- Contact details you give us. A phone number or email, only if you enter one to receive your reward or to contact support.
- Reward record. Which reward your box returned, and the voucher code issued, so we can resend or verify it.
- Analytics. Google Analytics collects standard aggregate usage data, pages viewed, device type, approximate region, referring source.
What we never collect
Card numbers, CVVs, UPI PINs, bank passwords and OTPs never reach us. Payment is handled entirely inside Razorpay's own interface. We receive only the result of the transaction. An ID, an amount, and whether it succeeded.
We also do not ask for your Amazon, Flipkart, Myntra or BookMyShow credentials, and there is no circumstance in which we would need them. Anyone asking for those while using our name is impersonating us.
Why we hold it
Transaction and reward records exist so support can work at all, resending a lost reward, verifying a rejected code, or processing a refund all require matching you to a purchase. Contact details are used only to deliver your reward and to reply to you. Analytics is used in aggregate to understand which pages are useful.
We do not sell your data, do not rent it, and do not share it with advertisers or data brokers.
Who we share it with
- Razorpay: payment processing. Governed by their own privacy policy and RBI regulation.
- Google Analytics: aggregate usage measurement.
- Voucher issuers: Only when a specific code has to be verified or replaced in a dispute, and only the code itself.
- Law enforcement: only where legally compelled.
How long we keep it
Transaction and reward records are kept for three years, which is what tax and financial record-keeping obligations in India require. Contact details you submitted are deleted on request at any time. Analytics data follows Google's standard retention.
Your rights
Under India's Digital Personal Data Protection Act you may ask us what personal data we hold on you, ask for corrections, ask for deletion of anything not covered by the retention obligation above, and withdraw consent for non-essential processing.
Email support@mysterybox123.com with "Data request" in the subject line. We respond within 30 days.
Cookies
We use Google Analytics cookies for aggregate measurement and Razorpay's own session cookies during payment. We do not run third-party advertising or retargeting cookies. You can block cookies in your browser; the box will still work.
Children
This service is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has made a purchase, email us and we will delete the record and refund the transaction.
Changes to this policy
Material changes will be posted here with an updated date. The current version is dated 20 July 2026.
Frequently Asked Questions
Does MysteryBox123 store my card details?
No. Card numbers, CVVs, UPI PINs and OTPs never reach us. Payment happens entirely inside Razorpay's interface. We receive only the Payment ID, amount and status.
Do you sell my data?
No. We do not sell, rent or share your data with advertisers or data brokers.
How long is my data kept?
Transaction and reward records are kept three years to meet Indian financial record-keeping obligations. Contact details you submitted are deleted on request at any time.
How do I request deletion of my data?
Email support@mysterybox123.com with 'Data request' in the subject. We respond within 30 days, as required under India's DPDP Act.