Privacy Policy

This Privacy Policy explains what information New Game Plus Ultra, Inc. ("we", "us") collects through Grail Mix, how we use and share it, and the choices you have. It applies to grailmix.io and the Grail Mix service. Grail Mix is a United States service for United States residents aged 18 and over.

1. What we collect

Account information: your email address, your name as provided by your sign-in method (such as Google), and, if you register a passkey, its public key — never a password from another service. Transaction and ownership records: your credit balance and its history, packs you open, cards you own, sell-backs, redemptions, and shipments, all recorded on an append-only ledger. Addresses: the billing address you provide for tax calculation and the shipping addresses you provide for redemptions. Verification status: where identity verification applies, our verification provider tells us the outcome (verified or not); your identity documents go to the provider, not to us. Support communications you send us. Technical data: IP address, browser and device information, timestamps, and security logs generated by using the service, plus error diagnostics collected by our monitoring tooling.

What we do not collect: your full payment-card number never touches our systems — payments are handled by our payment providers on their own systems. We use no advertising trackers and no third-party analytics cookies; the only cookies we set are the session and security cookies required to sign you in and keep your account safe.

2. How we use information

We use the information above to operate Grail Mix: maintaining your account and ledger, processing credit purchases and pack openings, coordinating custody, sell-backs, and shipments, calculating tax, and providing support. We use it to protect the service and comply with law: detecting fraud and abuse, screening against sanctions lists, meeting anti-money-laundering obligations, and keeping the records tax and financial rules require. We send transactional email about your account and activity; we send marketing email only if you opt in, and every marketing message includes an unsubscribe link. We do not sell your personal information, we do not rent it, and we do not share it for cross-context behavioral advertising.

3. Who we share it with

We share personal information only as needed to run the service: with the payment providers that process your credit purchases (currently CoinFlow and its financial partners) and our tax and payments infrastructure (Stripe); with our identity-verification provider when verification applies; with the holding shop and our shipping provider (EasyPost) — they receive your name and shipping address when they fulfil a redemption you request; with our infrastructure providers (hosting on Vercel, database on Neon, transactional email via Resend, error monitoring via Sentry); and with your sign-in provider (such as Google) to authenticate you. Each provider processes your data to provide its service to us. We also disclose information where the law requires it — including tax reporting, and responses to valid legal process — to protect the rights, safety, or property of users, the public, or the platform, and as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred data.

4. How long we keep it

We keep account information while your account is open. The ownership ledger is append-only by design, and financial, tax, and anti-money-laundering records are kept for as long as the law requires — typically seven years — even after your account closes. Technical logs and error diagnostics are kept for shorter operational periods. When retention ends, records are deleted or de-identified.

5. Your choices and rights

Wherever you live, you can: request a copy of the personal information we hold about you; ask us to correct it; ask us to delete it; and ask us to close your account. Send requests to support@grailmix.io from your account email; we will verify the request, respond within 45 days, and never discriminate against you for exercising these rights. An authorized agent may submit a request on your behalf with proof of authorization. Deletion has limits we cannot waive: records the law requires us to keep — the ledger, tax records, sanctions and anti-money-laundering records — are retained for their required periods and deleted when those periods end. Because we do not sell or share personal information for advertising, there is nothing to opt out of under state "do not sell or share" rights, and browser signals such as Global Privacy Control have nothing to switch off — but we honor the spirit of those signals, and this paragraph is our standing commitment not to sell.

6. Security

We protect personal information with industry-standard measures: encryption in transit, hashed session tokens, passkey support, access controls, and append-only financial records. No system is perfectly secure, and we cannot guarantee absolute security; if a breach affects you, we will notify you as applicable law requires.

7. Children

Grail Mix is for adults 18 and over. We do not knowingly collect information from anyone under 18, and if we learn we hold information about a child under 13 we will delete it promptly.

8. Where data is processed

Grail Mix operates from the United States and our providers process data primarily in the United States. Some providers may process limited data in other countries under their own safeguards; we choose providers that commit to appropriate protections.

9. Changes to this policy

We may update this policy as the service evolves. Each version carries the version number and effective date shown at the top of this page, and we will notify you of material changes in the app or by email before they take effect. Earlier versions are available on request.

10. Contact

Privacy questions and requests: support@grailmix.io. Legal notices: legal@grailmix.io. New Game Plus Ultra, Inc., a Delaware corporation.