Global Truth Machines Corporation (the "Company") values your privacy. This Privacy Policy explains how the Company collects, processes, uses and protects personal data through the "unravel" card draw platform, including its website and mobile applications (the "Service"). This Policy is established with reference to the Republic of China's Personal Data Protection Act (the "PDPA") and related laws.
1. Scope
This Policy applies to personal data involved in your use of the Service. It does not apply to linked third-party websites or services; their handling of personal data is governed by their own privacy policies.
2. Categories of Personal Data Collected
Depending on the features you use, the Company may collect the following categories:
3. Purposes of Collection and Use
Providing, operating and maintaining the Service, including Account management, identity verification and age confirmation;
Collecting payments, billing, issuing transaction documents and accounting for Point purchases;
Executing and recording Draws, Recycling, Collection and related features;
Storing, shipping and delivering Physical Cards;
Providing support, handling disputes and responding to feedback;
Preventing fraud, multiple Accounts, money laundering, arbitrage abuse and other unlawful conduct or violations, and maintaining transaction security;
Sending campaigns, offers and newsletters, which you may refuse at any time as described in Section 9;
Analyzing service quality, conducting statistical research and developing features (use in de-identified or aggregate form is not subject to PDPA restrictions);
Complying with legal obligations, including tax, accounting, anti-money laundering and competent authority requirements;
Other purposes to which you consent.
(Examples of corresponding PDPA specific-purpose categories: 090 consumer and customer management and services; 069 contractual, quasi-contractual or other legal relationships; 040 marketing; 181 other business consistent with registered business activities or organizational articles; 136 information, communications and database management; 157 surveys, statistics and research analysis.)
4. Period, Areas, Recipients and Methods of Use
Period: from collection until the stated purposes cease and legally required retention periods after Account deletion expire. Transaction and accounting records are retained for at least 5 years under applicable tax, accounting and anti-money laundering laws. Basic Account records are retained for 1 year to handle disputes after deletion.
Areas: the Republic of China (Taiwan), the United States (where the Company is located) and the locations of data centers used by the Company's cloud services. For international transfers, the Company will ensure processors maintain appropriate data protection standards.
Recipients: the Company and processors and partners necessary to fulfill the stated purposes, as described in Section 6.
Methods: automated or non-automated collection, processing, use and international transfer within the stated purposes.
5. Cookies and Tracking Technologies
The Service uses Cookies and similar technologies, including local storage and SDK identifiers, to maintain login status, record preferences and analyze traffic and effectiveness.
You may refuse or delete Cookies through browser settings, but some features, such as maintaining login status, may not work properly.
The Service's analytics and tracking tools are listed in Section 6.
6. Third-Party Services and Outsourcing
As necessary, the Company provides personal data to or entrusts its processing to the following third parties and supervises them appropriately:
(The Company will update this Policy when providers in the table are added or removed.)
The Company will not provide your personal data to third parties except:
With your consent;
Where expressly required by law or lawfully requested by judicial or administrative authorities;
To avoid imminent danger to your life, body, freedom or property;
When the Company's business is transferred through merger, division or business transfer, with the successor remaining bound by this Policy;
For outsourced processing listed above that is necessary to perform the Service.
7. Security of Personal Data
The Company adopts industry-standard safeguards, including transport encryption (TLS), password hashing, access controls, system logs and audits, firewalls and intrusion detection.
Access to personal data is restricted to personnel who need it for their duties and to the minimum necessary scope.
If personal data is stolen, disclosed, altered or otherwise compromised, the Company will investigate under applicable law, notify affected individuals appropriately and report to competent authorities as legally required.
8. Your Rights
Under Article 3 of the PDPA, you may exercise the following rights over personal data held by the Company:
Inquiry or access;
Requesting copies;
Requesting supplementation or correction;
Requesting cessation of collection, processing or use;
Requesting deletion.
To exercise these rights, contact support@unravel.cards. After verifying your identity, the Company will respond within the periods prescribed by the PDPA: 15 days for inquiry or access and 30 days for correction or deletion, extendable where necessary. Data subject to mandatory retention, such as transaction records, cannot be deleted during the retention period, but the Company will cease uses beyond statutory retention purposes. Necessary costs may be charged for inquiries or copies.
9. Opting Out of Marketing
You may refuse marketing messages at any time through unsubscribe links, app notification settings or support. The Company may still send necessary notices concerning transactions, Account security or material Service changes after you opt out.
10. Protection of Minors
The Service is only for persons aged 18 or older. The Company does not knowingly collect personal data from persons under 18. If an underage registration or use is discovered, the Company will delete the Account and related personal data, except data legally required to be retained.
11. Data Retention and Account Deletion
After you request Account deletion, the Company will delete or de-identify personal data within a reasonable period. Transaction, accounting and fraud-prevention records required by law will remain retained for the statutory period and used only for those purposes.
12. Amendments
The Company may amend this Policy for legal or operational needs. Amendments will be announced on the Service website. Material changes, such as expansion of data categories or purposes, will also be notified through in-service notices or email. Continued use after amendment constitutes agreement to the amended Policy.
13. Contact Us
If you have questions about this Policy or the handling of personal data, or wish to exercise the rights in Section 8, please contact:
Company name: Global Truth Machines Corporation
Address: 3203 Hanover St Ste 100, Palo Alto, CA 94304, United States
Support email: support@unravel.cards
Personal data protection contact: the support email above