Privacy Policy

Ripstorm.io · Mystery Box & Case Opening Platform

June 2026

1. Introduction

This Privacy Policy explains how we collect, use, share and protect your personal data when you use the website Ripstorm.io (the “Website”), and the rights available to you. We take your privacy seriously and are committed to handling your data in accordance with applicable data protection law, including the EU General Data Protection Regulation (EU Regulation 2016/679, the “GDPR”) and Cyprus data protection law. This policy applies to your use of the Website and to our communications with you, except where a separate notice applies.

2. Who We Are

The Website is owned and operated by Arvion Tech Solutions LTD (“Ripstorm”, “we”, “us” or “our”), a company registered in the Republic of Cyprus under company number HE 459333, with its registered office at Peiraios 30, 1st floor, Flat/Office 1, Strovolos 2023, Nicosia, Cyprus. We determine the purposes and means of the processing of your personal data and therefore act as the “data controller”. For any privacy matter, or to exercise your rights, contact us at [email protected].

3. Legal Bases for Processing

We process your personal data on one or more of the following grounds: performance of a contract (to provide the Website and its features to you); legal obligation (for example, age verification, anti-money-laundering and record-keeping duties); legitimate interests (to operate, secure, analyse and improve the Website and to prevent fraud, balanced against your rights); and consent (for example, for certain marketing and non-essential cookies, which you may withdraw at any time).

4. Data We Collect and Why

We process the following categories of personal data for the purposes and on the legal bases described. Some data may be processed for more than one purpose.

Account data (email address, date of birth, username, password stored securely, and account preferences): to create and manage your Account, authenticate you, and provide the Website’s features. Legal basis: performance of a contract.
Identity and verification data (KYC) (full name, date of birth, government-issued ID, proof of address and similar documents): to verify your age and identity, comply with anti-money-laundering obligations, and prevent fraud before opening boxes, receiving items or making withdrawals. Legal basis: legal obligation and legitimate interest (fraud prevention).
Payment data (payment method details and transaction records; full card details are processed by our payment providers, not stored by us): to process deposits and any withdrawals, maintain financial records, and detect fraudulent transactions. Legal basis: performance of a contract and legal obligation.
Gameplay and transaction data (boxes opened, items won, Credits balance, game history and provably-fair seeds): to operate the games, maintain accurate records, enable fairness verification, and support responsible-play tools. Legal basis: performance of a contract and legitimate interest.
Shipping data (delivery name, postal address and contact details): to deliver physical items you have won and to manage shipment and any substitution. Legal basis: performance of a contract.
Communications data (messages to our support team and the content of your enquiries): to respond to you, provide support and keep records of our communications. Legal basis: performance of a contract and legitimate interest.
Marketing data (email address and your marketing preferences): to send you offers, promotions and news about the Website where you have not opted out. You may unsubscribe at any time. Legal basis: consent and legitimate interest.
Technical and usage data (IP address, approximate (GeoIP) location, device and browser information, pages visited, interactions and session data): to operate and secure the Website, analyse and improve performance, enforce jurisdictional restrictions, and detect and prevent malicious activity. Legal basis: legitimate interest and consent (non-essential cookies).

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you without a lawful basis and appropriate safeguards. Where automated checks (for example, fraud or AML screening) affect you, you may request human review.

5. Cookies

We use cookies and similar technologies to enable core functionality, remember your preferences, secure the Website and understand how it is used. You can manage non-essential cookies through your browser settings or any cookie controls on the Website. Blocking some cookies may affect how the Website works. For more detail, please see our Cookie Policy, where available.

6. How We Share Your Data

We share personal data only as necessary and under appropriate safeguards, with the following categories of recipient:

Payment providers: to process deposits and withdrawals securely.
Identity and AML providers: to verify your age and identity and meet our legal obligations.
Couriers and fulfilment partners: to deliver physical items you have won.
IT, hosting and analytics providers (and their sub-processors), which process data on our behalf under contract (for example, cloud hosting and analytics services).
Group companies: our parent, subsidiaries and affiliates, where reasonably necessary for the purposes in this policy.
Professional advisers: lawyers, auditors and consultants, where access is required.
Authorities: courts, regulators or law-enforcement bodies, where required or permitted by law, or to protect our rights.

We do not share your personal data with third parties for their own marketing purposes unless you consent. We may share aggregated or anonymised information that does not identify you for analysis and business purposes. In the event of a merger, acquisition or sale of assets, your data may be transferred as part of the transaction, subject to this policy.

7. International Data Transfers

Some of our providers may be located outside the European Economic Area (EEA). Where we transfer your data outside the EEA, we put appropriate safeguards in place, such as an adequacy decision by the relevant authority, Standard Contractual Clauses, or another lawful transfer mechanism that ensures an equivalent level of protection.

8. Data Retention

We keep your personal data only for as long as necessary for the purposes for which it was collected, including for the duration of your Account and a reasonable period thereafter. We may retain certain data for longer where required to comply with legal, regulatory, tax or anti-money-laundering obligations, or for the establishment, exercise or defence of legal claims. Where we have applied self-exclusion at your request, we retain the records necessary to honour it.

9. Security

We use a range of technical and organisational measures to protect your data against unauthorised access, loss, misuse or alteration. The Website uses secure HTTPS / SSL encryption, access to personal data is restricted to those who need it, and we encourage you to use a strong, unique password and to enable any additional security features we offer. No transmission over the internet can be guaranteed to be completely secure, so we cannot warrant absolute security, but we work to protect your data using industry-standard practices.

10. Your Rights

Subject to applicable law, you have the right to: be informed about and access your data; have inaccurate or incomplete data corrected; have your data erased in certain circumstances; restrict or object to certain processing, including direct marketing; data portability; and withdraw consent where processing is based on consent. To exercise any right, contact us at [email protected]. We may ask you to verify your identity first, and we will respond within the timeframes required by law. Please note these rights are not absolute and some may be limited by our legal obligations. You also have the right to lodge a complaint with your local data protection authority, though we ask that you contact us first so we can try to help.

11. Responsible Play and Self-Exclusion

If you ask us to apply responsible-play measures such as deposit limits, a cooling-off period or self-exclusion, we will process the personal data needed to give effect to your request and to prevent you from re-registering during any exclusion period. This processing is carried out to protect you and to meet our responsibilities as an operator.

12. Children

The Website is strictly for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it and close any associated Account. If you believe a minor has provided us with personal data, please contact us.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes take effect when posted on the Website, and where appropriate we will notify you by email. We recommend checking this page periodically. If you do not agree with a change, you should stop using the Website.

14. Contact Us

Arvion Tech Solutions LTD, the operator of Ripstorm.io
Company No. HE 459333
Peiraios 30, 1st floor, Flat/Office 1, Strovolos 2023, Nicosia, Cyprus
Email: [email protected]
Web: www.ripstorm.io