Privacy Policy

This Privacy Policy explains how ICOINBOX ("ICOINBOX," "we," "us," or "our"), as the operator of ICOINBOX.com, collects, uses, discloses, retains, and protects personal information in connection with the ICOINBOX website, BETA platform, personalized Curated Surprise Box ordering experience, cryptocurrency payment functions, website contact form, supporter features, NFTs, customer support, and related services (collectively, the "Services").

This Privacy Policy also describes the privacy rights and choices that may be available to you.

This Privacy Policy applies only to personal information processed by ICOINBOX. It does not apply to third-party websites, cryptocurrency wallets, blockchain networks, NFT marketplaces, social-media platforms, shipping carriers, payment providers, or other independent services that maintain their own privacy practices.

Please review this Privacy Policy before using the Services or providing personal information.

ICOINBOX may collect the categories of personal information described in Section 2 for the purposes described in Section 4.

Depending on how you interact with the Services, this information may include:

• Contact and identity information;
• Shipping and order information;
• Curated Surprise Box preference and personalization information;
• Account information;
• Cryptocurrency wallet and blockchain transaction information;
• Commercial and transaction information;
• Device, browser, network, and website activity information;
• Approximate location information;
• Contact-form and customer-support communications;
• Marketing and preference information; and
• Information received from third-party services.

We retain personal information according to the criteria described in Section 10.

We do not sell personal information in exchange for money. We may use analytics, advertising, and social-media technologies that disclose certain online identifiers and activity information to third parties. Such disclosures may be considered a "sale," "sharing," or use for targeted advertising under certain U.S. state privacy laws.

You may exercise applicable privacy rights as described in Sections 12 through 15.

The personal information we collect depends on how you access and use the Services.

We may collect:

• Name;
• Email address;
• Telephone number;
• Shipping address;
• Billing address, where applicable;
• Account username or identifier; and
• Other contact information you provide.

If account functionality is available and you create an account, we may collect:

• Account credentials;
• Account preferences;
• Account history;
• Authentication and security information; and
• Information associated with account access.

You are responsible for protecting your account credentials.

ICOINBOX will never ask you to provide your cryptocurrency wallet private key or seed phrase.

When you place or attempt to place an order, we may collect:

• Products viewed or purchased;
• Curated Surprise Box selections;
• Preferences, interests, tastes, and other information you submit to help personalize product selection;
• Order numbers;
• Order dates and amounts;
• Shipping and fulfillment status;
• Transaction history;
• Refund requests, claims, disputes, and customer-service records;
• Promotional or discount information; and
• Other information reasonably necessary to process, personalize, fulfill, or support an order.

Please do not submit sensitive personal information through a Curated Surprise Box preference field or general message field unless it is reasonably necessary for your request and you choose to provide it.

When you use cryptocurrency, purchase or transfer an ICOINBOX NFT, connect a wallet, or submit voluntary cryptocurrency support where such a feature is offered, we may collect or observe:

• Public wallet addresses;
• Blockchain network;
• Cryptocurrency type;
• Transaction hash;
• Transaction amount;
• Transaction status;
• Token contract address;
• Token identifier;
• NFT ownership or transfer information;
• Transaction timestamp; and
• Other information publicly recorded on the applicable blockchain.

Blockchain information may be publicly accessible and may remain permanently available even if ICOINBOX deletes information from its own systems.

We do not control public blockchains and generally cannot alter, delete, or erase information recorded on them.

When you access the Services, we and our service providers may automatically collect:

• Internet Protocol address;
• Browser type and version;
• Device type;
• Operating system;
• Device identifiers;
• Language and time-zone settings;
• Referring and exit pages;
• Pages viewed;
• Links clicked;
• Dates and times of access;
• Session duration;
• Website interactions;
• Cookie and similar technology identifiers;
• Error, performance, and diagnostic information; and
• Security and fraud-prevention signals.

We may derive an approximate geographic location, such as country, state, region, or city, from an Internet Protocol address or similar technical information.

We do not intentionally collect precise geographic location information unless you expressly provide permission through a feature that requires it.

When you use the website contact form, email us, or otherwise contact ICOINBOX, we may collect:

• Your email address;
• Your order number, if provided;
• The contents of your message;
• Your contact details;
• Order or wallet information associated with your request;
• Photographs, video, shipping labels, packaging images, or documentation submitted in connection with an order claim;
• Records of our response; and
• Other information you voluntarily provide.

We may collect:

• Email subscription preferences;
• Cookie and privacy choices;
• Product interests;
• Marketing interaction information; and
• Information about whether you opened or interacted with a communication, where permitted by law.

If you interact with ICOINBOX through X, OpenSea, or another third-party platform, we may receive or view information made available by that platform, including:

• Public username;
• Public profile information;
• Public posts, comments, replies, or messages;
• Public wallet or NFT information;
• Referral information; and
• Information you authorize the platform to provide.

The third-party platform independently determines how it collects and processes your information.

We may collect information used to assess legal, sanctions, security, or fraud risk, including:

• Wallet risk indicators;
• Transaction-screening results;
• Internet Protocol risk information;
• Device and account security signals;
• Order and refund patterns;
• Information concerning suspected prohibited conduct; and
• Information supplied by compliance, fraud-prevention, or sanctions-screening providers.

Where reasonably necessary or legally required, we may request additional identifying, transaction, or source-of-funds information.

Depending on applicable law, certain information may be considered sensitive personal information, including account credentials or information collected for fraud, security, or legal compliance.

ICOINBOX does not use sensitive personal information to infer characteristics about you.

We do not intentionally collect biometric information, health information, genetic information, Social Security numbers, government-issued identification numbers, or precise geolocation unless collection becomes reasonably necessary and is permitted by applicable law.

If we materially change these practices, we will provide any notice and choices required by law.

We may collect personal information from:

• You directly;
• Your interactions with the website;
• Your browser, device, or network;
• Cookies and similar technologies;
• Cryptocurrency blockchains;
• Cryptocurrency wallets and payment providers;
• OpenSea and other NFT marketplaces;
• Shipping carriers and fulfillment providers;
• Suppliers and order-processing providers;
• Fraud-prevention, security, sanctions-screening, and compliance providers;
• Analytics, advertising, and social-media providers;
• Customer-support providers;
• Publicly available sources; and
• Business partners or service providers acting on our behalf.

We may use personal information to:

• Operate, maintain, and provide the Services;
• Process, review, accept, fulfill, cancel, or refund orders;
• Review submitted preferences and curate a personalized Curated Surprise Box product selection;
• Verify cryptocurrency payments;
• Associate blockchain transactions with orders or support requests;
• Provide shipping, delivery, and order tracking;
• Process product-problem, damage, loss, non-delivery, missing-content, or refund claims;
• Operate and respond to the website contact form;
• Provide customer service;
• Communicate about orders, transactions, policy changes, security, or the Services;
• Operate account and wallet-related features;
• Maintain website functionality;
• Personalize website content and user experience;
• Measure website traffic and performance;
• Understand how users interact with the Services;
• Conduct advertising and measure marketing effectiveness;
• Prevent fraud, abuse, unauthorized transactions, security incidents, and prohibited conduct;
• Screen transactions for sanctions, legal, and compliance risk;
• Protect ICOINBOX, its users, service providers, and third parties;
• Debug, repair, test, improve, and develop the BETA platform;
• Enforce the ICOINBOX Terms of Use and Conditions of Sale and other applicable policies;
• Establish, exercise, or defend legal claims;
• Comply with tax, accounting, reporting, recordkeeping, court, regulatory, and legal obligations;
• Respond to lawful requests from governmental or regulatory authorities;
• Complete a merger, acquisition, financing, restructuring, asset transfer, or similar business transaction;
• Obtain your consent where required; and
• Carry out another purpose disclosed to you at or before collection.

Where applicable law requires a legal basis, ICOINBOX may process personal information based on:

• Performance of a contract, including processing and fulfilling an order;
• Compliance with a legal obligation;
• ICOINBOX's legitimate interests in operating, securing, developing, and improving the Services;
• Prevention of fraud, abuse, sanctions violations, and security incidents;
• Establishment or defense of legal claims;
• Your consent; or
• Another lawful basis recognized by applicable law.

Where processing is based on consent, you may withdraw consent, subject to applicable legal and operational limitations.

We may disclose personal information to the following categories of recipients.

We may disclose information to providers that support:

• Website hosting;
• Contact-form operation and delivery;
• Cloud storage;
• Content delivery;
• Database management;
• Email delivery;
• Customer support;
• Website security;
• Error monitoring;
• Account authentication; and
• Technical development.

We may disclose contact, preference, order, and shipping information to:

• Suppliers;
• Warehouses;
• Fulfillment providers;
• Shipping carriers;
• Logistics providers; and
• Other parties reasonably necessary to select, prepare, fulfill, deliver, or support an order.

These recipients receive only the information reasonably necessary to perform the applicable service.

We may disclose or transmit transaction information to:

• Cryptocurrency payment providers;
• Wallet-connection providers;
• Blockchain infrastructure providers;
• Smart-contract services;
• NFT marketplaces; and
• Transaction-monitoring services.

Blockchain transactions may also become publicly available through the applicable blockchain.

We may disclose online identifiers, device information, approximate location, commercial interactions, and website activity to analytics, advertising, and social-media providers for purposes such as:

• Measuring website usage;
• Understanding advertising performance;
• Preventing repeated or irrelevant advertisements;
• Creating or measuring audiences;
• Displaying targeted advertising; and
• Improving marketing campaigns.

Under certain state laws, these activities may be considered a "sale," "sharing," or processing for targeted advertising.

We may disclose information to providers that help us:

• Detect fraud;
• Prevent abuse;
• Screen wallet addresses;
• Identify sanctions risk;
• Investigate unauthorized activity;
• Protect website security; and
• Comply with legal requirements.

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary.

We may disclose personal information when we reasonably believe disclosure is necessary to:

• Comply with applicable law;
• Respond to a subpoena, court order, warrant, or lawful governmental request;
• Enforce our agreements and policies;
• Investigate unlawful or prohibited activity;
• Protect legal rights, safety, property, users, or the public;
• Detect or prevent fraud or security incidents; or
• Establish, exercise, or defend legal claims.

Personal information may be disclosed or transferred in connection with an actual or proposed:

• Merger;
• Acquisition;
• Financing;
• Reorganization;
• Bankruptcy;
• Sale of assets;
• Transfer of business operations; or
• Similar transaction.

The recipient may continue to process the information in accordance with this Privacy Policy or provide notice of a replacement policy as required by law.

We may disclose information when you direct us to do so or provide valid consent.

ICOINBOX does not sell personal information in exchange for monetary payment.

ICOINBOX may use third-party analytics, advertising, or social-media technologies that receive:

• Online identifiers;
• Internet or website activity;
• Device information;
• Approximate location information;
• Product or page interactions; and
• Commercial interaction information.

Certain U.S. state privacy laws may define these disclosures as a "sale," "sharing," or processing for targeted advertising, even when no money is exchanged.

Where applicable, you may opt out by:

• Using the cookie or privacy preference controls available on ICOINBOX.com;
• Activating a legally recognized universal opt-out preference signal, such as Global Privacy Control; or
• Contacting us as described in Section 13.

We do not knowingly sell or share the personal information of individuals under eighteen years of age.

ICOINBOX and its service providers may use cookies, pixels, tags, local storage, software development kits, web beacons, and similar technologies.

These technologies support essential functions such as:

• Website operation;
• Security;
• Fraud prevention;
• Order processing;
• Network management;
• Cookie preference storage; and
• Account functionality.

Disabling these technologies may prevent parts of the Services from functioning.

These technologies remember settings, preferences, language, and other choices intended to improve website functionality.

These technologies help us understand:

• Website traffic;
• Page performance;
• User navigation;
• Technical errors; and
• General patterns of use.

These technologies may help:

• Measure advertising;
• Attribute website visits to advertising campaigns;
• Build or measure advertising audiences;
• Display advertisements;
• Limit repetitive advertisements; and
• Understand interactions with social-media content.

You may manage nonessential cookies through the cookie or privacy controls available on the website and through browser settings.

Blocking cookies may affect website functionality.

Your choices may apply only to the browser and device from which they were submitted. You may need to repeat your choices on other browsers or devices.

Where required by applicable law, ICOINBOX recognizes valid universal opt-out preference signals, including Global Privacy Control, as a request to opt out of the sale or sharing of personal information and targeted advertising for the browser or device sending the signal.

If we can reasonably associate the signal with an ICOINBOX account, we may apply the preference to that account as required by law.

Some browsers provide a separate "Do Not Track" signal. Because there is no uniform industry standard governing Do Not Track signals, ICOINBOX does not currently respond to those signals unless applicable law requires otherwise.

Global Privacy Control and Do Not Track are separate mechanisms.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or as required or permitted by law.

Retention is determined according to factors including:

• The nature and sensitivity of the information;
• The length of the customer or account relationship;
• The time needed to fulfill and support an order;
• Applicable return, refund, dispute, and limitation periods;
• Tax, accounting, sanctions, compliance, and recordkeeping requirements;
• Fraud and security needs;
• Contractual obligations;
• The status of an investigation or legal claim; and
• Technical limitations.

In general:

• Order and transaction records are retained as necessary to fulfill orders, handle disputes, maintain accounting records, comply with law, and prevent fraud;
• Account information is retained while the account remains active and for a reasonable period afterward;
• Customer-support records are retained until the matter is resolved and for a reasonable period needed for legal, quality, fraud-prevention, and operational purposes;
• Marketing information is retained until you unsubscribe or we no longer need it, while a limited suppression record may be retained to honor your opt-out;
• Cookie and online activity information is retained according to the applicable technology, provider settings, and legal requirements;
• Security and compliance records are retained as necessary to protect the Services and satisfy legal obligations; and
• Public blockchain information may remain available indefinitely and is not controlled by ICOINBOX.

When information is no longer reasonably required, we may delete, aggregate, anonymize, or otherwise dispose of it in accordance with applicable law.

ICOINBOX uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, destruction, loss, alteration, or disclosure.

These safeguards may include, where appropriate:

• Access controls;
• Authentication controls;
• Encryption in transit or at rest;
• Security monitoring;
• Data minimization;
• Vendor oversight;
• Fraud and transaction screening;
• System updates;
• Backup procedures; and
• Incident-response measures.

No website, network, database, blockchain, wallet, or method of electronic transmission is completely secure.

ICOINBOX cannot guarantee absolute security.

You are responsible for protecting your devices, accounts, passwords, wallet credentials, private keys, and seed phrases.

If a data-security incident occurs, ICOINBOX will investigate and provide notifications as required by applicable law.

Depending on your place of residence and applicable law, you may have the right to:

• Confirm whether we process your personal information;
• Access personal information we maintain about you;
• Obtain information about the categories of personal information collected;
• Obtain information about the purposes for which information is used;
• Obtain information about categories of recipients;
• Correct inaccurate personal information;
• Request deletion of personal information;
• Receive a portable copy of certain personal information;
• Opt out of the sale or sharing of personal information;
• Opt out of processing for targeted advertising;
• Opt out of certain profiling or automated decision-making activities;
• Limit certain uses or disclosures of sensitive personal information;
• Withdraw consent where processing is based on consent;
• Appeal a decision concerning a privacy request; and
• Receive equal service and pricing without unlawful discrimination for exercising a privacy right.

These rights are subject to exceptions and limitations under applicable law.

For example, we may retain or decline to delete information when reasonably necessary to:

• Complete a transaction;
• Fulfill an order;
• Detect or prevent fraud;
• Maintain security;
• Exercise legal rights;
• Comply with tax, accounting, sanctions, or recordkeeping obligations;
• Resolve a dispute;
• Maintain an opt-out record; or
• Satisfy another lawful exception.

A deletion request cannot remove data from a public blockchain that ICOINBOX does not control.

You may submit a privacy request by:

• Emailing support@icoinbox.com with the subject line "Privacy Request"; or
• Using the contact form available on ICOINBOX.com and clearly identifying the submission as a privacy request.

Please describe the right you wish to exercise and provide information reasonably sufficient to locate the relevant records.

Depending on the request, we may ask for:

• Your name;
• Email address;
• Order number;
• Shipping information;
• Public wallet address;
• Transaction hash; or
• Other information necessary to verify the request.

Do not send us your wallet private key or seed phrase.

We will use information submitted with a privacy request only to verify and process that request, prevent fraud, maintain legally required records, and communicate with you.

We will respond within the period required by applicable law.

If we cannot fulfill a request, we will explain the basis for the decision where legally required.

Where permitted by law, you may authorize another person to submit a privacy request on your behalf.

We may require:

• Written authorization;
• Proof of the agent's identity;
• Verification of your identity; and
• Direct confirmation that you authorized the request.

We may deny a request from an agent who does not provide sufficient proof of authorization, except where prohibited by law.

If we deny a privacy request and applicable law provides a right to appeal, you may appeal by:

• Emailing support@icoinbox.com with the subject line "Privacy Appeal"; or
• Using the contact form available on ICOINBOX.com and clearly identifying the submission as a privacy appeal.

Your appeal should identify the original request and explain why you believe the decision should be reconsidered.

We will review and respond within the period required by applicable law.

Where required, a denied appeal response will explain how you may contact the applicable state regulatory authority.

ICOINBOX may use automated signals to identify fraud, sanctions risk, security incidents, technical abuse, or suspicious transactions.

ICOINBOX does not currently use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

If this practice changes, we will provide any notice and opt-out rights required by law.

This Section supplements the other provisions of this Privacy Policy for California residents.

During the preceding twelve months, ICOINBOX may have collected the following categories of personal information:

• Identifiers, including name, email address, postal address, telephone number, Internet Protocol address, account identifier, device identifier, and public wallet address;
• Customer-record information, including contact, billing, shipping, and account information;
• Commercial information, including products viewed, orders, purchases, cryptocurrency payments, support contributions, NFT transactions, and refund or dispute history;
• Internet or electronic network activity, including website interactions, browser information, device information, cookie identifiers, and referring pages;
• Geolocation information, limited primarily to approximate location derived from Internet Protocol addresses;
• Audio, visual, or similar information, if you submit photographs, video, or other documentation to customer support;
• Professional or employment information, only if voluntarily provided in a business communication;
• Inferences, such as general product interests or marketing preferences derived from website activity; and
• Sensitive personal information, such as account credentials and information processed for security or legal compliance.

The sources, business purposes, and recipients of these categories are described throughout this Privacy Policy.

During the preceding twelve months, ICOINBOX may have disclosed the categories listed above to:

• Hosting and technology providers;
• Order and fulfillment providers;
• Shipping carriers;
• Cryptocurrency and blockchain providers;
• Customer-support providers;
• Security, fraud-prevention, and compliance providers;
• Analytics providers;
• Advertising and social-media providers;
• Professional advisers;
• Governmental or legal authorities; and
• Parties involved in a business transaction.

ICOINBOX does not sell personal information for monetary consideration.

Our use of analytics, advertising, and social-media technologies may involve the disclosure of identifiers, Internet activity, approximate location, and commercial interaction information in a manner considered a sale or sharing under California law.

California residents may opt out as described in Sections 7, 9, and 13.

ICOINBOX does not knowingly sell or share personal information belonging to consumers under sixteen years of age.

ICOINBOX does not use or disclose sensitive personal information for purposes of inferring characteristics or for purposes that require a right to limit under California law.

Subject to applicable exceptions, California residents may request:

• Access to personal information;
• Categories of personal information collected;
• Categories of sources;
• Business or commercial purposes;
• Categories of third parties receiving information;
• Specific pieces of personal information;
• Correction;
• Deletion;
• Portability;
• Opt-out of sale or sharing; and
• Equal treatment when exercising privacy rights.

ICOINBOX does not currently offer a financial incentive, price difference, or service difference in exchange for the collection, sale, or retention of personal information.

If ICOINBOX introduces such a program, we will provide the notice and obtain the consent required by applicable law.

ICOINBOX does not disclose personal information to third parties for those third parties' own direct-marketing purposes without providing any legally required notice or choice.

Residents of states with comprehensive privacy laws may have rights including:

• Access;
• Correction;
• Deletion;
• Portability;
• Opt-out of sale;
• Opt-out of targeted advertising;
• Opt-out of certain profiling;
• Consent rights concerning sensitive data;
• Recognition of universal opt-out signals; and
• Appeal of denied requests.

ICOINBOX will process applicable requests in accordance with the law of the requester's state of residence.

The Services are intended for adults and are not directed to individuals under eighteen years of age.

Individuals under eighteen may not use transactional features, connect a wallet, place an order, purchase an ICOINBOX NFT, or submit cryptocurrency support where such a feature is offered.

ICOINBOX does not knowingly collect personal information from children under thirteen.

If we learn that we collected personal information online from a child under thirteen without legally valid authorization, we will take reasonable steps to delete it.

A parent or legal guardian who believes a child has provided information to ICOINBOX may use the contact form on ICOINBOX.com or email support@icoinbox.com.

We may send transactional communications concerning:

• Orders;
• Payments;
• Shipping;
• Refunds;
• Customer support;
• Security;
• Policy changes; and
• Service administration.

These messages are necessary to provide or support the applicable transaction and may continue even if you opt out of promotional messages.

You may unsubscribe from promotional emails by using the unsubscribe mechanism in the message or contacting us.

We may retain a limited record of your opt-out to ensure that your preference is honored.

Blockchain transactions are generally public and may reveal relationships between wallet addresses, transaction histories, token ownership, and other activity.

Information recorded on a public blockchain:

• Is not stored exclusively by ICOINBOX;
• May be copied and processed by unrelated third parties;
• May remain available indefinitely;
• May be searchable through blockchain explorers;
• May be associated with other information by third parties; and
• Generally cannot be changed or deleted by ICOINBOX.

Privacy rights directed to ICOINBOX apply only to information ICOINBOX controls and cannot require ICOINBOX to alter a decentralized public blockchain.

The Services may link to or integrate with third-party services, including:

• OpenSea;
• X;
• Cryptocurrency wallets;
• Blockchain networks;
• Payment providers;
• Shipping carriers;
• Analytics providers;
• Advertising services; and
• Other external websites.

These third parties independently determine their privacy practices.

ICOINBOX is not responsible for a third party's collection, use, disclosure, security, or retention of information.

You should review the applicable third party's privacy policy before using its service.

ICOINBOX and its service providers may process personal information in the United States and other countries in which they operate.

Those countries may have privacy laws that differ from the laws of your location.

Where required by applicable law, we will use legally recognized safeguards for international transfers.

By completing a transaction or requesting a Service, your information may necessarily be transferred to countries where suppliers, fulfillment providers, carriers, blockchain providers, or other service providers operate.

If ICOINBOX suspends or discontinues the website or Services, we may retain, transfer, delete, anonymize, or archive personal information in accordance with:

• This Privacy Policy;
• Applicable law;
• Tax and accounting requirements;
• Sanctions and compliance obligations;
• Fraud-prevention needs;
• Existing order and refund obligations;
• Legal claims and limitation periods; and
• A legitimate business transfer.

Closing the website does not require deletion of information that ICOINBOX must or may lawfully retain.

Public blockchain information may continue to exist independently of ICOINBOX.

We may update this Privacy Policy to reflect changes in:

• The Services;
• Technology;
• Vendors;
• Data practices;
• Legal requirements; or
• Business operations.

The revised policy will be posted with a revised Effective Date.

If a change materially affects how we use previously collected personal information, we will provide additional notice or obtain consent where required by law.

We encourage you to review this Privacy Policy periodically.

For privacy questions, requests, complaints, or appeals, you may:

• Use the contact form available on ICOINBOX.com; or
• Email support@icoinbox.com.

When using email, please include "Privacy Request," "Privacy Appeal," or "Privacy Question" in the subject line, as applicable.

When using the contact form, clearly identify the purpose of your submission in the message.

Do not send cryptocurrency wallet private keys, seed phrases, passwords, or other authentication secrets to ICOINBOX.