In short
- We collect what we need to run a safe marketplace: your account, your orders and chats, payment status from our payment partners, and fraud-prevention signals such as IP address and a device identifier.
- Sellers also give us identity documents and, where the law requires, tax information. These are stored privately and seen only by authorised staff.
- We do not sell your data and we do not use advertising or tracking cookies.
- You can access, correct, export or delete your data, and EU/UK users have full GDPR rights, including complaining to a data protection authority.
1. Who is responsible for your data
The controller of your personal data is:
[COMPANY NAME], [LEGAL ENTITY TYPE AND REGISTRATION NUMBER][REGISTERED ADDRESS], [COUNTRY OF REGISTRATION]
General contact: [CONTACT EMAIL]
Data protection contact: [DATA PROTECTION CONTACT EMAIL]
EU representative (Art. 27 GDPR): [EU REPRESENTATIVE NAME AND ADDRESS, OR REMOVE]
This policy explains what personal data we process when you use MythicDeals, why, and the choices and rights you have. It applies to buyers, sellers, affiliates and visitors.
2. Data we collect
Account data
Username, email address, password (stored only as a secure hash), display language, profile details you add, notification preferences, phone number if you add one (verified by a one-time code), the Roblox username or ID you choose to link, and when you were last active.
Orders, chats and support
Orders you place or receive, amounts, coupons, order history and status changes; the game user ID, server or username you enter for delivery; delivery details such as account credentials (stored encrypted); order and pre-sale chat messages and attachments; dispute reasons, offers and evidence; reviews; support tickets and their attachments. In chats we automatically hide phone numbers, email addresses and messaging-app links.
Seller verification (identity documents)
If you apply to sell, we collect your first and last name, date of birth, nationality, country, address, phone number, the type, number and issuing country of your identity document (accepted: Passport, National ID card, Driver’s licence, Residence permit), images of the front and back of the document, a selfie holding the document, the games and categories you sell, optional profile links, and your payout details. Identity files are stored on private storage, never at a public URL, and can be opened only by authorised staff through the admin panel.
Tax information (sellers)
Where tax reporting rules apply to you — the EU DAC7 directive for sellers resident in the EU, or US reporting (Form 1099-K) for US sellers — we collect your legal or business name, date of birth, address, tax identification number (stored encrypted), VAT number, business registration number and, for US sellers, your tax classification and state. See section 6 for when this is reported.
Security and fraud-prevention data
- IP address and IP-derived information: the IP address you use, the country it belongs to and whether it appears to be a VPN, proxy or data-centre address. To determine this we may send the IP address to our IP-intelligence provider, ipapi.is. Results are cached for a short period.
- Device identifier: a random identifier stored in a cookie (
go_did) that lets us recognise the same browser across accounts — a common card-testing pattern. - Order risk assessments: for each order we compute a risk score from signals such as account age, number of attempts per hour per account and per IP, device reuse, IP/payment country mismatch and order size, and record the decision and any manual review.
- Two-factor authentication: your authenticator secret (encrypted), passkey / security-key public keys, recovery codes, and trusted devices (a browser label and IP address).
Payment data
Payments are processed by Xendit (local methods such as QRIS, e-wallets, virtual accounts and retail outlets) and by our cryptocurrency payment processor. We receive the payment reference, method, amount, currency, status and, where provided, the country of the payment instrument. We do not receive or store full card numbers or bank or wallet passwords. For seller payouts we store the payout details you enter (for example a USDT wallet address, Wise or Payoneer email, or IBAN/SWIFT details).
Roblox account linking and Roblox Analytics
If you link a Roblox account (Roblox Market), you sign in on Roblox's own page and choose what to share. We are not affiliated with Roblox Corporation.
- Profile (OAuth scopes
openid,profile): your Roblox user ID, username, display name, avatar picture and account creation date. We use this to show who is selling, to check that the person selling a game or group really controls it, and to confirm a transfer to the buyer. - Public Roblox data: the experiences and groups you own or manage, their public stats (visits, players online, favorites, likes, members) and current owner, read from Roblox's public APIs. We record these daily while a listing is live so buyers see real history.
- Roblox Analytics (only if you choose "Connect analytics" or add a read-only key): read-only analytics for the experiences you select on Roblox's consent screen — Robux revenue, active users, retention, session length, acquisition and audience breakdowns (country, platform, age group, gender — aggregated, never about individual players). We show these on your listing as verified numbers. We never change anything on Roblox.
- Tokens and keys: Roblox access and refresh tokens, and any read-only API key you give us, are stored encrypted and used only for the purposes above. You can disconnect at any time on the Roblox Market connect page or in Roblox's app permissions; we then stop reading data and revoke the tokens.
- We never ask for, receive or store your Roblox password, cookies or security codes.
Affiliate data
If you join the affiliate program: your referral code, clicks on your link, the users attributed to you and the commissions earned. If you arrive through a referral link, the go_ref cookie records the referral code for 30 days.
3. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, processing orders, escrow, delivery, chat, reviews, payouts and support | Performance of our contract with you (Art. 6(1)(b)) |
| Deciding disputes, warranty claims and refunds | Contract (Art. 6(1)(b)) and our legitimate interest in a fair marketplace (Art. 6(1)(f)) |
| Seller identity verification | Legal obligations on payment and anti-money-laundering controls where they apply (Art. 6(1)(c)) and our legitimate interest in keeping fraudsters out (Art. 6(1)(f)) |
| Tax information collection and reporting (DAC7, 1099-K) | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention, risk scoring, account security and 2FA | Legitimate interest in protecting users and the Platform from fraud and chargebacks (Art. 6(1)(f)); for some checks, legal obligation |
| Accounting and record keeping | Legal obligation (Art. 6(1)(c)) |
| Service emails, SMS codes and notifications about your orders | Contract (Art. 6(1)(b)); you can change non-essential notifications in your settings |
| Affiliate program and referral attribution | Contract with affiliates (Art. 6(1)(b)); legitimate interest for the referral cookie (Art. 6(1)(f)) |
| Remembering your language | Legitimate interest / strictly necessary for the service you asked for |
Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (see section 10).
4. Automated checks on orders
Our risk engine scores orders automatically. Depending on the score and the rules in force, an order may proceed normally, be held for review by a member of staff, require extra verification (for example identity verification for purchases above $250.00 in one order or $1,000.00 in a month), or — for clear abuse patterns such as an excessive number of attempts in a short time — be blocked. A held order is always reviewed by a person before a final decision is made. If you believe a decision was wrong, contact support; you have the right to obtain human review, express your point of view and contest the decision.
5. Who we share data with
- The other party to your order. Sellers see the buyer's username and the delivery details the buyer provides; buyers see the seller's store name, profile and reviews. Neither sees the other's email address or payment details.
- Payment partners: Xendit and our cryptocurrency payment processor, to process payments and refunds.
- Service providers acting on our instructions: hosting and storage, email delivery, SMS / messaging providers for verification codes, ipapi.is for IP intelligence, and top-up providers that a seller has connected to deliver automatic top-ups (they receive the game user ID needed for delivery).
- Content delivery: our pages load fonts from Google Fonts, and the 2FA setup page loads a QR-code script from Cloudflare's cdnjs. These providers receive your IP address when your browser fetches those files.
- Tax authorities: for sellers who meet the reporting thresholds, we report the information required by law (for DAC7, to the competent EU tax authority; for US sellers, under 1099-K rules).
- Authorities and courts when required by law, or to protect users against fraud or other illegal activity.
- A buyer of our business, if MythicDeals is merged or sold, under the same protections.
We do not sell personal data and do not share it with advertisers.
6. Seller tax reporting (DAC7 and 1099-K)
EU law (Council Directive (EU) 2021/514, "DAC7") requires digital platforms to collect and report information about sellers resident in the EU, unless the seller made fewer than 30 sales and less than €2,000 in the year. US rules require reporting for US sellers above $20,000 and 200 transactions per year (some states use lower thresholds). Sellers approaching a threshold are asked to complete their tax profile; withdrawals can be paused until it is complete. Sellers can download their yearly statement from their tax settings.
7. International transfers
MythicDeals serves users in many countries, and our service providers may process data outside your country, including outside the European Economic Area. Where data from the EEA or UK is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for more information at [DATA PROTECTION CONTACT EMAIL].
8. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is open; deleted or anonymised after closure, except what we must keep below |
| Orders, payments, ledger and invoices | 10 years after the transaction (accounting and tax law) |
| Seller identity documents | 5 years after the end of the seller relationship, or after a rejected application |
| Seller tax information | 10 years after the reporting year |
| Fraud-prevention signals (IP, device identifier, risk assessments) | 24 months, longer if linked to confirmed fraud or a legal claim |
| Order chats and dispute evidence | 3 years after the order closes |
| Roblox tokens and read-only keys | Until you disconnect or remove them; unused keys are removed automatically after 7 days without a live listing |
| Roblox public stats and Roblox Analytics history of a listed game | While the game is listed and up to 2 years after, so past buyers can still see what they relied on |
| Support tickets | 3 years after the ticket is closed |
| Cookies | See the Cookie Policy |
We may keep data longer when needed to establish, exercise or defend legal claims.
9. How we protect data
Measures include encryption of delivery credentials, tax identification numbers and 2FA secrets in our database, private storage for identity documents and attachments served only through access-controlled pages, password hashing, two-factor authentication for users and staff, and limiting access to staff who need it. No system is perfectly secure; if a personal-data breach is likely to put your rights at risk, we will notify you and the competent authority as the law requires.
10. Your rights
Depending on where you live — and in all cases if you are in the EU, EEA or UK — you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data (most account data can be edited in your settings);
- erase your data ("right to be forgotten"), except data we must keep for legal reasons or for open orders, disputes or claims;
- restrict processing in certain cases;
- data portability — receive data you gave us in a structured, machine-readable format (sellers can also export their sales as CSV);
- object to processing based on legitimate interests;
- not be subject to a decision based solely on automated processing that significantly affects you, and obtain human review (section 4);
- withdraw consent at any time where we rely on consent;
- lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work (in France, the CNIL — www.cnil.fr) or, in the UK, the ICO.
To exercise your rights, email [DATA PROTECTION CONTACT EMAIL] or open a ticket in Help & support. We may need to verify your identity. We answer within one month; this can be extended by two further months for complex requests, in which case we will tell you.
11. Children
We do not knowingly collect personal data from young children without a parent's or guardian's permission. If you are a parent or guardian and believe your child has given us personal data without your permission, contact us and we will delete it or close the account.
12. Cookies
We use only essential cookies and the affiliate referral cookie — no advertising or analytics trackers. Details are in the Cookie Policy.
13. Changes to this policy
We will update this policy when our processing changes. The "Last updated" date at the top shows the current version; for significant changes we will notify you by email or on the Platform.
14. Contact
Questions about privacy: [DATA PROTECTION CONTACT EMAIL]. Other questions: [CONTACT EMAIL].
