Privacy Policy

1. Introduction

SpinBox s.r.o. ("Slaybox", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform.

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Data We Collect

3.1 Information You Provide

• Account Information: Email address, username, password, date of birth
• Profile Information: Display name, profile picture, bio (optional)
• Identity Verification: Government-issued ID, selfie verification (for creators and age verification)
• Payment Information: Billing address, payment method details (processed by third-party payment processors)
• Communications: Messages, support requests, feedback

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, spin history, content interactions
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies: Session cookies, preference cookies, analytics cookies (see Section 9)
• Log Data: Access times, error logs, referring URLs

3.3 Information from Third Parties

• Payment Processors: Transaction confirmations, fraud prevention data
• Identity Verification Services: Verification results
• Social Login: Basic profile information if you sign in via social accounts

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To provide our services, process transactions, and manage your account
• Legal Obligation: To comply with laws (e.g., age verification, tax reporting, 2257 record-keeping)
• Legitimate Interests: To improve our services, prevent fraud, ensure security, and send service communications
• Consent: For marketing communications and optional cookies (you can withdraw consent at any time)

5. How We Use Your Data

• Service Provision: Create and manage accounts, process spins and purchases, deliver content
• Verification: Verify age and identity for legal compliance
• Payments: Process transactions, prevent fraud, handle refunds
• Communication: Send service updates, respond to inquiries, provide support
• Security: Detect and prevent fraud, abuse, and unauthorized access
• Improvement: Analyze usage patterns, improve features, develop new services
• Legal Compliance: Meet regulatory requirements, respond to legal requests

6. Data Sharing

We may share your data with:

• Payment Processors: To process transactions (e.g., Stripe, card networks)
• Identity Verification Providers: To verify age and identity
• Cloud Service Providers: For hosting and infrastructure
• Analytics Providers: To understand platform usage (anonymized where possible)
• Legal Authorities: When required by law or to protect rights and safety
• Business Transfers: In case of merger, acquisition, or sale of assets

We do not sell your personal data to third parties.

7. Data Retention

We retain your data for the following periods:

• Account Data: Duration of account plus 3 years after deletion
• Transaction Records: 7 years (tax and legal requirements)
• Identity Verification: 7 years (2257 and KYC compliance)
• Support Communications: 3 years after resolution
• Usage Logs: 12 months
• Marketing Consent Records: Duration of consent plus 3 years

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing)
• Right to Lodge a Complaint: File a complaint with a supervisory authority

To exercise your rights, contact us at compliance@spinbox.app. We will respond within 30 days.

Supervisory Authority: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic

9. Cookies

We use the following types of cookies:

• Essential Cookies: Required for platform functionality (authentication, security)
• Preference Cookies: Remember your settings (theme, language)
• Analytics Cookies: Help us understand how you use the platform (with consent)

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for countries with equivalent data protection
• Binding Corporate Rules where applicable

11. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures

12. Children's Privacy

Slaybox is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from a minor, we will delete it immediately. If you believe a minor has provided us with personal data, please contact compliance@spinbox.app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. The "Last Updated" date at the top indicates when the policy was last revised. Continued use of the platform after changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related inquiries or to exercise your rights:

• Email: compliance@spinbox.app
• Address: SpinBox s.r.o., Dandova 2619/13, Horní Počernice, 193 00 Praha, Czech Republic

For general support: support@spinbox.app