Last updated: October 04, 2026
The data controller for OpenMystery is:
| Purpose | Legal Basis |
|---|---|
| Provide and maintain service | Contract performance |
| Billing and payment processing | Contract performance |
| Customer support | Contract performance / Legitimate interest |
| Service notifications (verification, security, policy updates) | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Product optimization and analytics | Legitimate interest |
| Legal compliance | Legal obligation |
We may aggregate or de-identify data for statistical analysis. Such data cannot be linked to individual users.
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Maintain login, core functionality | No |
| Functional | Language preferences, personalized settings | Yes |
| Analytics | Anonymous usage statistics, product optimization | Yes |
We use authentication tokens stored in your browser's local storage to maintain your login session. Essential session cookies may be used for CSRF protection.
We do not sell your personal information. We share data only in the following circumstances:
If a security incident affecting your rights occurs, we will notify you and relevant regulators within 72 hours of discovery.
| Data Type | Retention Period | Disposal |
|---|---|---|
| Account information | During active use; 90 days after account deletion | Secure deletion or anonymization |
| Transaction records | As required by law (typically 7 years) | Secure deletion or archival |
| Support records | 3 years | Secure deletion |
| Security audit logs | 12 months | Secure deletion |
To exercise your rights, contact us at privacy@openmystery.org. We will respond within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Receive a copy of your personal data |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion of your data under specific conditions |
| Right to restrict processing | Pause data processing under specific conditions |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interest or marketing |
| Right to withdraw consent | Withdraw consent for processing based on consent |
If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.
Our servers and partners may be located in various countries. When data is transferred internationally, we ensure security through Standard Contractual Clauses (SCC), adequacy decisions, or other lawful transfer mechanisms.
This service is intended for users aged 13 and above. We do not knowingly collect information from children under 13. If you believe your child has provided us with personal information, contact us immediately at privacy@openmystery.org and we will promptly delete the data.
This service may contain links to third-party websites or integrate with third-party services. This policy applies only to data we directly collect. We are not responsible for third-party data practices; review their policies before use.
We may update this Privacy Policy from time to time. For significant changes, we will notify you at least 15 days in advance via email or a notice on our website. The "Last updated" date at the top reflects the most recent revision. Continued use after changes constitutes acceptance.