Monster Strategy, Inc., a Delaware corporation (“Monster”, “we,” “us,” or “our”), provides access to the Monster application located at mnstr.xyz (the “Application”) and associated products and services, including the Vault and the Marketplace (as defined in the Terms of Service) (together, the “Products”). Please read this Privacy Policy carefully as it contains important information on who we are and how and why we collect, store, use, and share your personal and other information in connection with the use of the Products. It also explains your rights in relation to your personal information and how to contact us.
By using the Products, you agree to this Privacy Policy. This Privacy Policy is subject to and incorporated by reference to our Terms of Service posted on mnstr.xyz.
1. Information We Collect About You
Personal Information: We may collect and use the following personal information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you when you use our Products:
- Contact and account information, including your email address, display name, and, if you connect them, social handles such as Discord or X usernames;
- Balance account and transaction information, including the identifier of the balance account opened in your name with our balance and payments provider (currently Coinflow), your balance and the deposits, purchases, payouts, and withdrawals made through it as that provider reports them to us, and, if your Account moved from the old wallet login, the public address of that wallet and its public on-chain transactions, which we may also receive from our service providers in order to comply with our legal obligations and prevent fraudulent or other illicit activities;
- Purchase and activity information, including the packs you purchase and open, the Cards you receive, hold, ship, sell, or sell back, Marketplace and auction activity, Account balances and withdrawal history, Points balances and redemptions, promotional feature participation, and referral and Partner Program attribution;
- Shipping information, including the recipient name, shipping address, and contact details you provide when you request shipment of a Card;
- Identity verification information, where required for certain payouts, shipments, or compliance purposes, including government-issued identification documents, date of birth, and information derived from them, collected and processed through our third-party verification provider; this may include facial images and biometric identifiers as described in Section 2;
- Payment information, which is collected and processed by our payment processors and our balance and payments provider, whose hosted checkout and deposit flows process your card, Apple Pay, Google Pay, bank transfer, or digital-asset payment; we do not receive or store your full card number or bank account details;
- Communications and information you provide when you contact us by email, support channels, or social media, or participate in a survey or promotion with us; and
- Device and technical information, which we may access and collect from localStorage, mobile device ID, cookies, web beacons, and geographical location tracking features used to enforce geographic eligibility, and other similar technologies.
Other Information Collected: Monster collects non-identifiable information, such as public on-chain data, and limited off-chain data (e.g., the device type or browser version used to access and use the Application or other Products), as necessary to provide the Products to you, as well as for internal evaluation and enhancement of our Products. Where your Account has an old wallet address from the previous login, or you fund or withdraw your balance with digital assets, we may collect and store the publicly-available addresses involved, which are publicly-available information and by themselves are not personal information, to evaluate your use of the Products and to screen those addresses for any prior illicit activity.
2. Biometric Information
If you complete identity verification where required for certain payouts, shipments, or compliance purposes, our third-party verification provider may collect a live facial capture and derive from it a scan of face geometry or similar biometric identifier for the sole purpose of verifying your identity against your identification document and preventing fraud. We do not use biometric information for any other purpose, do not sell it, and do not use it to make marketing decisions. Biometric information is retained by us or our provider only as long as reasonably necessary to complete verification and comply with legal obligations, and in any event is permanently destroyed no later than the earlier of (i) satisfaction of the purpose for which it was collected and (ii) one (1) year after your last interaction with us.
3. How Your Information is Collected and Used
We collect most of your information from your use of the Products. However, we may also collect information:
- From publicly accessible sources (e.g., on-chain data);
- Directly from a third party (e.g., identity verification, screening, or due diligence providers, and our payment processors);
- From a third party with your consent;
- From cookies and geo-location tracking features; and
- Automated monitoring of our Products and other technical systems, such as our computer networks and connections, communications systems, email and messaging systems.
We use the personal information listed above for the following business purposes:
- To provide our Products to you, including fulfilling pack purchases, maintaining Vault records of your Cards, shipping Cards to you, operating the Marketplace, calculating and crediting sellback proceeds, and administering Points and promotions;
- To enforce geographic and eligibility requirements;
- To verify your identity and comply with our legal and regulatory obligations, including sanctions screening and anti-fraud and anti-money laundering obligations;
- To contact you about Monster offerings, products and services, from which you may opt out at any time via the unsubscribe link or by emailing info@mnstr.xyz;
- For our legitimate interests or those of a third party; and
- Where you have given consent.
The table below explains what we use your personal information for and our reasons for doing so:
| What we use your personal information for | Our reasons |
|---|---|
| To provide the Products to you, including fulfilling pack purchases, maintaining Vault custody records, shipping Cards, and operating the Marketplace | To provide, monitor, maintain, customize, update, and improve the Products being utilized by you |
| To enforce geographic and eligibility requirements, including checks against the excluded jurisdictions list | To comply with our legal and regulatory obligations and the eligibility requirements of the Products |
| To verify your identity before withdrawals or where otherwise required, including through our third-party verification provider | To comply with our legal and regulatory obligations and to prevent fraud |
| To prevent and detect fraud against you, the Application and/or our Products, including screening wallets for prior illicit activity and detecting multi-account and promotional abuse | For our legitimate interests or those of a third party (i.e. to minimize fraud that could be damaging for us and for you) |
| Screening for financial and other sanctions or embargoes, and other processing necessary to comply with professional, legal and regulatory obligations that apply to our business | To comply with our legal and regulatory obligations |
| Gathering and providing information required by or relating to audits, inquiries or investigations by regulatory bodies | To comply with our legal and regulatory obligations |
| To administer giveaways, and Partner Program features | For the performance of our contract with you and for our legitimate interests (i.e. to run promotions fairly) |
| To contact you about Monster offerings, products and services, from which you may opt out at any time | With your consent or for our legitimate interests (i.e. to keep you informed of relevant offerings) |
| Operational reasons, such as improving efficiency, training and quality control | For our legitimate interests or those of a third party (i.e. to be as efficient as we can so we can deliver the best Products for you) |
| Preventing unauthorized access and modifications to systems, and addressing security risks | For our legitimate interests or those of a third party, and to comply with our legal and regulatory obligations |
5. How Long Your Personal Information Will Be Kept
We will only keep your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. As a general rule: account and contact information is kept while your access is active and for two (2) years thereafter; purchase, Vault, balance, withdrawal, and identity verification records are kept while your access is active and for seven (7) years thereafter to satisfy legal and audit obligations; biometric information is retained as described in Section 2; and marketing preferences are kept until you opt out. We may retain information longer where necessary to resolve disputes, prevent fraud or abuse, comply with law, or enforce our agreements. When no longer needed, we delete or anonymize it. On-chain data is public by nature, cannot be deleted or altered by us, and is outside our control.
Cross-Border Data Transfers. We may transfer your personal information to a third party that is located in a jurisdiction other than the one from which we collected your personal information, including to countries that have not been deemed to have an adequate level of protection for the rights and freedoms of data subjects. If we do transfer your personal information to another jurisdiction, we will do so following due diligence and provided that the data recipient is subject to contractual agreements imposing obligations on it to ensure appropriate technical and organization measures are implemented and maintained at all times to prevent the unauthorized and unlawful processing of personal information, and the accidental loss or destruction of, or damage to, personal information, consistent with our obligations under applicable data protection laws.
6. Your Rights Under the GDPR
If you are an EU or UK resident, you are entitled to certain rights under the GDPR and UK GDPR with respect to personal information that we have collected. We have listed below how these rights operate in the context of using our Products.
| Right | Description |
|---|---|
| Right to Access | The right to be provided with a copy of your personal information |
| Right to Rectification | The right to require us to correct any mistakes in your personal information |
| Right to be Forgotten | The right to require us to delete your personal information - in certain situations. Note: information recorded on a public blockchain cannot be deleted or altered by us |
| Right to Restriction of Processing | The right to require us to restrict processing of your personal information - in certain circumstances (e.g. if you contest the accuracy of the data) |
| Right to Data Portability | The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party - in certain situations |
| Right to Object | The right to object: at any time to your personal information being processed for direct marketing (including profiling); and in certain other situations to our continued processing of your personal information (e.g. processing carried out for the purpose of our legitimate interests) |
| Right Not to be Subject to Automated Individual Decision-Making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. Where automated identity verification produces a rejection, you may request human review |
If you would like to exercise any of the above rights or if you have questions about your privacy rights, please use the contact details in the How to Exercise Your Rights section.
7. Your Rights Under California Law
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), provides you with the following rights: the right to know the categories and specific pieces of personal information we collect, use, and disclose; the right to delete personal information, subject to exceptions; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined in the CCPA); the right to limit use of sensitive personal information (we use sensitive personal information, such as identification documents and biometric information, only for the purposes of verifying identity, preventing fraud, and complying with law, which do not require a limit right); and the right not to be discriminated against for exercising your rights. You may exercise these rights using the contact details in the How to Exercise Your Rights section; we will verify requests using the email and account information associated with your access, and authorized agents may submit requests with proof of authorization.
“Shine the Light” and “Eraser” Laws: Residents of the State of California may request a list of all third parties to which we have disclosed certain information during the preceding year for those third parties’ direct marketing purposes.
Do-Not-Track Disclosures: We do not support Do Not Track (“DNT”) requests. Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track by visiting the Preferences or Settings page of your web browser. We honor the Global Privacy Control and other opt-out preference signals transmitted by your browser or device.
8. Other U.S. State Privacy Rights
Residents of other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) may have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, subject to the terms of the applicable law. We will honor verified requests as required by the law of your state, using the contact details in the How to Exercise Your Rights section, and you may appeal a refusal by replying to our decision.
Cookies and Similar Technologies. We and our service providers use cookies, localStorage, mobile device identifiers, pixels, and similar technologies to keep you signed in, remember your preferences, secure the Application, enforce geographic eligibility, and measure how the Application is used. You can control cookies through your browser settings, and disabling them may prevent parts of the Application from working. Where required by applicable law, we will obtain your consent before setting any non-essential cookie, and we honor opt-out preference signals as described in Section 7.
9. Keeping Your Personal Information Secure
We have appropriate security measures in place designed to prevent personal information from being accidentally lost or used or accessed in an unauthorized way. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. We do not collect or store your private keys, recovery phrase, or credentials for any old wallet or external wallet, and you are solely responsible for their security.
10. How to Exercise Your Rights
If you would like to exercise any of your rights as described in this Privacy Policy, please email us at info@mnstr.xyz.
11. GDPR Complaint
We hope that we can resolve any query or concern you raise about our use of your information. The General Data Protection Regulation gives you right to lodge a complaint with a supervisory authority, in the European Union (or European Economic Area) state where you work, normally live, or where any alleged infringement of data protection laws occurred.
12. Children
Our Products are not directed to children under the age of 18 and we do not knowingly solicit, collect, use, or disclose Personal Information from children under the age of 18. We require each user to confirm that they are at least eighteen (18) years of age at account creation and again before their first purchase. If we become aware that a child has provided us with personal information in violation of applicable law, we will delete any personal information we have collected, unless we have a legal obligation to keep it.
13. Changes to This Privacy Policy
This privacy notice was published on October 11, 2026 and last updated on October 11, 2026. We may change this Privacy Policy from time to time, when we do, we will inform you via mnstr.xyz or other means of contact, such as email or Discord. We will notify you of material changes at least seven (7) days before they take effect. We maintain an archive of prior versions, available upon request.
14. How to Contact Us
Please contact us by email if you have any questions about this Privacy Policy or the information we hold about you. Our contact details are shown below:
Monster Strategy, Inc.
223 Bedford Ave PMB 78, Brooklyn, NY 11211