MYTHICAL GAMES AND MARKETPLACE PRIVACY POLICY

Last Updated: May 9, 2022

1. Overview

Mythical, Inc. respects the privacy of its online visitors, customers, and gamers (collectively "users"). This Privacy Policy describes how we collect the information on the websites located at www.blankos.com, www.mythical.market, and any other websites, games, apps, features, or other services ("Services") owned and operated by Mythical, Inc. that direct the viewer or user to this Privacy Policy.

1.1. Scope

In this Privacy Policy, the terms "Mythical," "we," and "us" refers to Mythical, Inc. and its respective subsidiaries and affiliated companies.

This notice describes how Mythical and its affiliates, collect and use personal data. Please note that websites, apps, features or other services that are owned and operated by Mythical may contain links to digital properties that are owned and operated by other companies. This Privacy Policy does not apply to websites and services that are owned and operated by unaffiliated third parties.

1.2. Data Controller and Transfer

Mythical is the data controller for the personal data collected in connection with use of Mythical's Services.

Mythical Marketplace. Mythical is the data controller for the personal data collected in connection with use of the Mythical Marketplace.

Blankos, and Other Games Developed by Us. Mythical is the data controller for the personal data collected in connection with your use of Blankos and other games developed by us.

Third-Party Games Using the Mythical Marketplace. Mythical Marketplace may be integrated into third-party games. In such instances, Mythical and the third-party game may act as independent controllers of your personal data. Please refer to the privacy policy of third-party games to understand how such third parties process your personal data.

Data Transfer. Mythical operates and processes data in the United States. We may also transfer data to countries other than the one where our users live or use Mythical's Services. We do so to fulfill our agreements with users, such as our game or marketplace related Terms of Use and/or Terms of Service, or based on users' prior consent, adequacy decisions for the relevant countries, or other transfer mechanisms as may be available under applicable law, such as the Standard Contractual Clauses.

2. Data Collection

2.1. The Data We Collect

Mythical collects:

• Data provided by users to Mythical, such as during account creation;
• Data created during use of our website and Services, such as gameplay data, log data, location, app usage, and device data;
• Data created during use of our games, such as game features viewed, game crashes and other system activity; and,
• Data from other sources, such as Mythical partners.

The following data is collected by or on behalf of Mythical:

2.1.1. Data Provided by Users

This includes:

• User profile: We collect data when users create or update their user profile, such as their Mythical Marketplace accounts. This may include their name, email, country, birthdate, display name or username and password, payment information (including related payment verification information).
• Commercial information: We may collect information about Services purchased, obtained, or considered.
• Demographic data: We may collect demographic data about users, including through user surveys. In some countries, we may also receive demographic data about users from third parties.
• User content: We collect the information users submit when they contact Mythical customer support, provide ratings or otherwise contact Mythical. This may include feedback, photographs, or other recordings collected by users.

2.1.2. Data Created During Use of Our Website and Mythical Marketplace

This includes:

• Location data: Mythical may collect this data during your use of the Mythical Services.
• Usage data: We collect data about how users interact with our Services. This includes data such as access dates and times, type of browser, and third-party sites or services used before interacting with our Services. In some cases, we collect this data through cookies, pixels, tags, and similar tracking technologies that create and maintain unique identifiers. To learn more about these technologies, please see our Cookie Policy.
• Device and log data: We may collect data about the devices used to access our Services, including the hardware models, device IP address, operating systems and versions, software, preferred languages, unique device identifiers, advertising identifiers, serial numbers, device motion data, and mobile network data.
• Communications data: We enable users to communicate with each other and Mythical through Mythical's Services. To provide this service, Mythical receives some data regarding the communications, including the date and time of the communications and the content of the communications. Mythical may also use this data for customer support services (including to resolve disputes between users), for safety and security purposes, to improve our products and Services, and for analytics.

2.1.3. Data Created During Use of Our Games

This includes:

• Location data: Mythical may collect this data during your use of the Mythical games.
• Gameplay data: We collect data about how users interact with our games. This includes data such as gameplay dates and times, game features or pages viewed, game crashes and other system activity, and other game statistics. In some cases, we collect this data through cookies, pixels, tags, and similar tracking technologies that create and maintain unique identifiers. To learn more about these technologies, please see our Cookie Policy.
• Device and log data: We may collect data about the devices used to access our Services, including the hardware models, device IP address, operating systems and versions, software, preferred languages, unique device identifiers, advertising identifiers, serial numbers, device motion data, and mobile network data.
• Communications data: We enable users to communicate with each other and Mythical through Mythical's Services. To provide this service, Mythical receives some data regarding the communications, including the date and time of the communications and the content of the communications. Mythical may also use this data for customer support services (including to resolve disputes between users), for safety and security purposes, to improve our products and Services, and for analytics.

2.1.4. Data from Other Sources

This includes:

• Blockchain Data: We may analyze public blockchain data to ensure parties utilizing our Services are not engaged in illegal or prohibited activity under our Terms, and to analyze transaction trends for research and development purposes.
• User feedback.
• Users participating in our referral programs. For example, when a user refers another person, we receive the referred person's personal data from that user.
• Users or others providing information in connection with claims or disputes.
• Mythical business partners through which users create or access their Mythical account, such as payment providers, social media services, or apps or websites whose APIs Mythical uses.
• Publicly available sources.
• Marketing service providers.
• Information from our affiliates.

Mythical may combine the data collected from these sources with other data in its possession.

2.1.5. Information on Blockchain or Cryptocurrency Platforms.

Please note that if you choose to make purchases of cryptocurrency and/or blockchain assets, the cryptocurrency platform, blockchain platform, and/or online wallet will indefinitely retain a publicly available transaction identifier in connection with your purchase. These platforms have their own privacy policies governing the use of user and account data, and we encourage you to refer to the specific platform's privacy policy in connection with your purchase.

3. How We Use Personal Data

Mythical collects and uses data to provide its game sites and marketplace Services. We also use the data we collect:

• To enhance the safety and security of our users and Services;
• For customer support;
• For research and development;
• To enable communications between users;
• To send marketing and non-marketing communications to users; and,
• In connection with legal proceedings.

Mythical does not sell or share user personal data with third parties for their direct marketing, except with users' consent.

Mythical uses the data it collects for purposes including:

3.1. Providing Services and Features

Mythical uses the data we collect to provide, personalize, maintain, and improve our products and Services. This includes using the data to:

• Provide the Services;
• Create and update users' accounts;
• Facilitate access to third-party blockchain, cryptocurrency and/or wallets;
• Offer, process, or facilitate payment for our Services;
• Enable features that allow users to share information with other people, such as when users refer a friend to Mythical;
• Enable features to personalize users' Mythical accounts;
• Enable Accessibility features that make it easier for users with disabilities to use our Services; and,
• Perform internal operations necessary to provide our Services, including to troubleshoot software bugs and operational problems; to conduct data analysis, testing, and research; and to monitor and analyze usage and activity trends.

3.2. Safety and Security

We use personal data to help maintain the safety, security, and integrity of our Services and users. This includes:

• Using device, location, profile, usage, and other data to prevent, detect, and combat fraud or unsafe activities.

3.3. Customer Support

Mythical uses the information we collect (including recordings of customer support calls with notice to and the consent of the user) to provide customer support, including to:

• Direct questions to the appropriate customer support person;
• Investigate and address user concerns; and,
• Monitor and improve our customer support responses and processes.

3.4. Research and Development

We may use the data we collect for testing, research, analysis, product development, and machine learning to improve the user experience. This helps us to improve and enhance the safety and security of our Services, improve our ability to prevent the use of our Services for illegal or improper purposes, develop new features and products, and facilitate insurance and finance solutions in connection with our Services.

3.5. Marketing

Mythical may use the data we collect to market our Services to our users. This includes sending users communications about Mythical games, Services, features, promotions, sweepstakes, studies, surveys, news, updates, and events.

We may use the data we collect to personalize the marketing communications (including advertisements) that we send, including based on user location, past use of Mythical's games and Services, and user preferences and settings.

3.6. Non-Marketing Communications

Mythical may use the data we collect to inform users of changes to our terms, services, or policies; or send other communications that aren't for the purpose of marketing the services or products of Mythical or its partners.

3.7. Legal Proceedings and Requirements

We may use the personal data we collect to investigate or address claims or disputes relating to use of Mythical's Services, or as otherwise allowed by applicable law, or as requested by regulators, government entities, and official inquiries.

3.8. Automated Decision-Making

We use personal data to make automated decisions relating to use of our Services. This includes:

• Deactivating users who are identified as having engaged in fraud or activities that may otherwise harm Mythical, its users, and others.

To object to a decision resulting from these processes, please contact us using the information in the "Contact Us" section below.

4. Data Sharing and Disclosure

Some of Mythical's products, Services, and features require that we share data with other users or at a user's request. We may also share data with our affiliates, subsidiaries, and partners, for legal reasons or in connection with claims or disputes.

Mythical may share the data we collect:

4.1. With Other Users During Your Use of a Mythical Game

We may share gameplay and other Mythical game-related data with other Mythical users during gameplay.

This includes:

• User's username/display name/account name.
• Public leaderboard.

4.2. With Games that Integrate the Mythical Marketplace

Certain data, such as your Mythical Marketplace public account information, and your ownership of NFTs, will be shared across games developed by Mythical and third-party games which integrate the Mythical Marketplace.

4.3. At a User's Request or for Jointly-Offered Services

This includes sharing data with:

• Other people at the user's request;
• Users participating in Mythical's referral program,
• Mythical service and platform partners
  • For example, if a user requests a service through a partnership or promotional offering made by a third party, Mythical may share certain data with those third parties. This may include, for example, other services, wallets, NFT, cryptocurrency, and blockchain platforms, apps, or websites with an API or service with which we integrate.

4.4. With the General Public

Questions or comments from users submitted through public forums such as Mythical blogs and Mythical social media pages may be viewable by the public, including any personal data included in the questions or comments submitted by a user.

4.5. With Mythical Subsidiaries and Affiliates

We share data with our subsidiaries and affiliates to help us provide our Services or conduct data processing on our behalf.

4.6. With Mythical Service Providers and Business Partners

Mythical provides data to vendors, consultants, marketing partners, research firms, and other service providers or business partners.

These include:

• Online wallets and cryptocurrency platforms (e.g., MetaMask, Ethereum);
• NFT marketplaces that mint and process NFTs;
• Cloud storage providers;
• Marketing partners and marketing platform providers, including social media advertising services;
• Data analytics providers;
• Research partners, including those performing surveys or research projects in partnership with Mythical or on Mythical's behalf;
• Vendors that assist Mythical to enhance the safety and security of our Services;
• Consultants, lawyers, accountants, and other professional service providers; and,
• Insurance and financing partners.

Some external service providers may also collect information directly from you (for example, an online wallet, cryptocurrency platform, or marketplace may request your government-issued identity document or billing and financial information) in accordance with their own privacy policies. These external service providers do not share your financial information or identity documents with us, but may share limited information with us related to your purchase or account, like a transaction ID.

4.7. For Legal Reasons or in the Event of a Dispute

Mythical may share users' personal data if we believe it's required by applicable law, regulation, operating license or agreement, legal process or governmental request, or where the disclosure is otherwise appropriate due to safety or similar concerns.

This includes sharing personal data with law enforcement officials, public health officials, other government authorities, or other third parties as necessary to enforce our terms of use and/or terms of service, user agreements, or other policies; to protect Mythical's rights or property or the rights, safety, or property of others; or in the event of a claim or dispute relating to the use of our Services.

This also includes sharing personal data with others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.

4.8. With Consent

Mythical may share a user's personal data other than as described in this notice if we notify the user and they consent to the sharing.

5. Anonymized And Aggregated Data

We may also aggregate or otherwise strip information of all personally identifying characteristics and may share that aggregated, anonymized data with third parties or publish it. This data does not personally identify you and helps us to measure the success of the Services and its features and to improve your experience. We reserve the right to make use of any such aggregated data as we see fit. Types of data we may anonymize include, transaction data, click-stream data, performance metrics, and fraud indicators.

6. Cookies And Third-Party Technologies

Mythical and its partners use cookies and other identification technologies on our games, apps, websites, emails, and online ads for purposes described in this notice.

Cookies are small text files that are stored on browsers or devices by websites, apps, online media, and advertisements. Mythical uses cookies and similar technologies for purposes such as:

• Authenticating users;
• Remembering user preferences and settings;
• Determining the popularity of content;
• Delivering and measuring the effectiveness of advertising campaigns; and,
• Analyzing site traffic and trends, and generally understanding the online behaviors and interests of people who interact with our Services.

We may also allow others to provide audience measurement and analytics services for us, to serve advertisements on our behalf across the Internet, and to track and report on the performance of those advertisements. These entities may use cookies, web beacons, SDKs, and other technologies to identify the devices used by visitors to our websites, as well as when they visit other online sites and services.

Google Analytics. We may use Google Analytics. We use the information we get from Google Analytics only to improve the Sites. We do not combine the information collected through the use of Google Analytics with personally identifiable information. Please refer to Google's Privacy Policy for more information. You may also choose to download the Google Analytics opt-out browser add-on.

You may wish to restrict the use of cookies. Please be aware that some of the features of our Site may not function correctly if you disable cookies.

Most modern browsers allow you to change your cookie settings. You can usually find these settings in the options or preferences menu of your browser. To understand these settings, the following links for commonly used browsers may be helpful:

• Cookie settings in Chrome
• Cookie settings in Firefox
• Cookie settings in Internet Explorer
• Cookie settings in Safari web and iOS

Personalized Advertising. We may also use targeted advertising cookies, such as Google Ads, to deliver tailored advertising on our Sites and other websites that you may visit. You can learn more about how to control advertising cookies by visiting the Network Advertising Initiative's Consumer Opt-Out link, the DAA's Consumer Opt-Out link for browsers, or the DAA's opt-out link for mobile devices. Please note that electing to opt-out will not stop advertising from appearing in your browser or applications and may make the ads you see less relevant to your interests.

Please see our Cookie Policyfor more information regarding the use of cookies and other technologies described in this section.

7. Do-Not-Track-Signals

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. We do not recognize or respond to browser-initiated DNT signals, as the Internet industry is currently still working toward defining exactly what DNT means, what it means to comply with DNT, and a common approach to responding to DNT.

8. International Transfer of Personal Data

Any data that you provide to us may be accessed, shared or processed by our offices, located in the United States, and service providers located in the United States, if such data transfer is necessary for the specific purpose for which you submitted your data (such as the provision of goods or services under a written contract). This may entail a transfer of your personal information across international borders. The data protections standards may differ and be lower than the standards enforced in your jurisdiction.

9. Children

Our websites and Services are not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us using the contact details provided in the "Contact Us" section below. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information.

10. Data Retention

We may retain your personal data for a period of time consistent with the original purpose of collection (see the "Purposes for which we process personal data" section above) or as long as required to fulfill our legal obligations. We determine the appropriate retention period for personal data on the basis of the amount, nature, and sensitivity of the personal data being processed, the potential risk of harm from unauthorized use or disclosure of the personal data, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation).

After expiry of the applicable retention periods, your personal data will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will implement appropriate measures to prevent any further use of or access to such data.

Information on Blockchain or Cryptocurrency Platforms. Please note that if you choose to make purchases of cryptocurrency and/or blockchain assets, the cryptocurrency platform, blockchain platform, and/or online wallet will indefinitely retain a publicly available transaction identifier in connection with your purchase. These platforms have their own privacy policies governing the retention of personal data, and we encourage you to refer to the specific platform's privacy policy in connection with your purchase.

11. Your Rights Relating to Your Personal Data

11.1. Your Rights

You may have certain rights relating to your personal data, subject to local data protection laws. Depending on the applicable laws these rights may include the right to:

• Access your personal data held by us;

• Know more about how we process your personal data;

• Erase or delete your personal data, to the extent permitted by applicable data protection laws;

• Restrict our processing of your personal data, to the extent permitted by law;

• Object to our processing of your personal data. Where we process your personal data for direct marketing purposes or share it with third parties for their own direct marketing purposes, you can exercise your right to object at any time to such processing without having to provide any specific reason for such objection;

• Opt-out of certain disclosures of your personal data to third parties; and

• Not be discriminated against for exercising your rights described above.

  11.2. Additional Disclosures for California, Colorado or Virginia Residents

We have listed the privacy rights for several U.S. state jurisdictions below, but we understand you may have additional rights in your jurisdiction. You may contact us directly at any time about exercising your data protection rights. We will consider your request in accordance with applicable laws.

Certain state laws require that we detail the categories of personal data that we disclose for certain "business purposes," such as to service providers that assist us with securing our Services or marketing our products.

We disclose the following categories of personal data for our business purposes, as further described in Section 4. Data Sharing and Disclosure:

• Identifiers;
• Personal information under California Civil Code section 1798.80;
• Commercial information;
• Internet activity and electronic information; and
• Inferences drawn from any of the above information categories.

Sensitive Categories of personal data:

• Account log-in information;
• Financial account information;
• Geolocation data; and,
• Contents of communications.

Several jurisdictions grant state residents certain rights, including the right to access specific types of personal data, the right to learn how we process personal data, the right to know whether and how we disclose or sell personal data, the right to opt out of any sale of personal data, the right to request deletion of personal data in certain circumstances, and the right not to be denied goods or services for exercising these rights.

Third Party Marketing. California law further permits you to request information regarding the disclosure of your personal information to third parties for the third parties' direct marketing purposes. We do not disclose your personal information to third parties for the third parties' direct marketing purposes.

Do Not Sell My Personal Information. In the preceding twelve months we have not sold personal information for monetary consideration, but we recognize that some state privacy laws define "personal information" in such a way that some sharing of personal information necessary to provide you with personalized ads may be considered a "sale," even if no money is exchanged. Please use our cookie banner or refer to our Cookie Policyon how to opt out of personalized ads.

Authorized Agents.If you are an authorized agent wishing to exercise rights on behalf of a state resident, please contact us using the information in the "Contact us" section below and provide us with a copy of the consumer's written authorization designating you as their agent. We may need to verify your identity and place of residence before completing your rights request.

11.3. Additional Disclosures for Data Subjects in the EEA and the U.K.

Residents in the European Economic Area and the United Kingdom (together, for purposes of this section of the Privacy Policy, "EEA"), as well as certain other jurisdictions, are entitled to certain rights and disclosures with respect to their personal data.

Our legal bases for collecting and using your personal data include:

• The performance of your contract or to enter into the contract and to take action on your requests. For example, the processing of your account registration, providing our Services and products to you, providing customer service to you.
• Our legitimate business interests. For example, fraud prevention, maintaining the security of our network and Services, direct marketing to you, and maintaining, analyzing, and improving our products and Services.
• Compliance with a mandatory legal obligation. For example, maintaining administrative records which are subject to mandatory retention periods. We may also collect your personal data to record your requests to exercise your rights and to verify your identity for such requests.
• Consent you provide where we do not rely on another legal basis. Consent may be withdrawn at any time.

In some countries, and in particular if you are located in the EEA, you may have the right to:

• Access your personal data;
• Correct inaccurate personal data;
• Request erasure of your personal data without undue delay;
• Request the restricted processing of your personal data;
• Request portability of the personal data that you have given us; and
• To object to the processing of your personal data.

To exercise any of these rights, please contact us as set forth in the "Contact Us" section below and specify which privacy right(s) you wish to exercise. We may need to verify your identity in order to honor your request.

If you have any issues with our compliance, you have the right to lodge a complaint with an EEA supervisory authority. We would, however, appreciate the opportunity to first address your concerns and would welcome you directing an inquiry first to us per the "Contact us" section below.

11.4. How to Exercise Your Rights

To exercise your rights, please contact us by using the information in the "Contact Us" section below. Your personal data may be processed in responding to these rights. We will respond to all legitimate requests in a timely manner and in accordance with applicable laws, and will contact you if we need additional information from you in order to honor your request or verify your identity.

10.5. Your Preferences for Marketing Communications

We may use your personal data to contact you with newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt out of receiving any, or all of these communications from us by following the unsubscribe instructions provided in any email we send, or you can contact us using the contact details provided in the "Contact Us" section below. You will still continue to receive service-related messages concerning products and Services you have purchased (unless we have indicated otherwise).

12. How We Secure Your Personal Data

We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information.

However, no website, application, or transmission can guarantee security. Thus, while we have established and maintain what we believe to be reasonable procedures to protect the confidentiality, security, and integrity of personal information obtained through the websites, we cannot ensure or warrant the security of any information you transmit to us.

13. Changes to This Privacy Policy

We may change our Privacy Policy at any time. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to periodically review this Privacy Policy to ensure you are familiar with the most current version.

14. Contact Us

If you wish to contact us or have any questions about or complaints in relation to this Privacy Policy, please contact us at the following contact details: [email protected] or [email protected].