Privacy policy

Last updated 2026-10-27

1. About this policy

This privacy policy explains how Agspeedy HiT Technologies L.L.C. ("Trophy", "we", "us" or "our") collects, uses, shares and protects personal information when you use gettrophy.xyz, any related apps, and our pack-opening, vault, sell-back and Reward Quest features (together, the "service"). It also explains your choices and rights.

For the purposes of data protection laws such as the EU and UK General Data Protection Regulation ("GDPR"), Agspeedy HiT Technologies L.L.C. is the controller of your personal information. We have not appointed an EU or UK representative or a data protection officer. You can contact us about data protection at [email protected].

Please read this policy together with our terms of service at gettrophy.xyz/terms.

2. Who the service is for

The service is only for adults aged 18 or over, or the age of majority where they live if higher. We do not knowingly collect personal information from anyone under that age. If we learn that we have, we will close the account and delete the information unless we must keep it by law. If you believe a minor has given us personal information, contact [email protected].

3. Information we collect

Information you give us

• Account and sign-in details: email address, username, and the sign-in method you choose (for example a social login identifier).
• Invitation details: the invite code you used and who invited you, because the beta is invite-only.
• Identity and eligibility information (if requested): full name, date of birth, address, nationality, government ID images, a selfie or liveness check, and the results of identity, age, sanctions and fraud checks. We collect this only when a check is needed, through our identity verification provider.
• Payment and payout details: limited payment details from our payment provider (such as the last four digits, card type and payment status) and the payout details you give us for withdrawals. We do not receive or store full card numbers.
• Communications: messages you send to support, feedback, survey answers and anything you share in community channels we run.
• Reward Quest and promotions: quest progress, rewards earned, referral information, and any handles or links you give us to complete a quest.

Information we collect automatically

• Activity on the service: packs viewed and bought, pulls and results, vault contents, sell-back offers made and accepted, rewards, and timestamps.
• Device and log data: IP address, approximate location derived from IP address (country or city level), browser and device type, operating system, language, referring pages, pages viewed, errors and crash data.
• Cookies and similar technologies: see section 7.

Information from third parties

• Privy (authentication): when you sign in, Privy, our authentication provider, shares with us your account identifier, the login method used, and linked email or social account identifiers.
• Payment providers: transaction status, amounts, and fraud or risk signals from Stripe, our payment processor.
• Identity verification and compliance providers: verification results and, where needed, the underlying identity data, from our identity verification provider.
• Analytics and advertising partners: information about how you found us and interacted with our ads.

4. How we use your information

Automated decisions. Pack results are generated automatically at random in line with the published odds; they are not based on your personal information. We may use automated tools to flag possible fraud or sanctions matches. Where an automated decision has a legal or similarly significant effect on you (for example closing your account), a person will review it on request.

5. How we share your information

We do not sell your personal information. We share it only as described below.

• Service providers who act on our instructions, including:
  • Privy, for authentication (sign-in);
  • Stripe, for payments;
  • identity verification and sanctions screening providers, for identity and compliance checks;
  • cloud hosting and database providers, for hosting and storage;
  • analytics and error tracking providers, for product analytics and diagnostics;
  • email and messaging providers, for emails and notifications;
  • Collector Crypt, our card inventory and fulfilment partner;
  • Speedy Comics, our vault and custody partner, for storing slabs;
  • customer support tools, and professional advisers such as lawyers, accountants and auditors.
• Advertising and analytics partners, where you have agreed to it or the law allows, to measure our marketing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• Other users and the public. Your username, notable pulls on a public feed or leaderboard, and Reward Quest rankings may be visible to other users. You can choose whether these are shown in your account settings.
• Law enforcement, regulators and others when we believe in good faith that disclosure is required by law or legal process, or needed to prevent fraud, protect people's safety or protect our rights.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred as part of that deal, subject to this policy.
• With your consent or at your direction.

6. International transfers

We operate internationally, and your information may be processed in the United Arab Emirates, the United States, the European Union and other countries where we or our providers operate. These countries may have different data protection laws from yours. Where required, we protect transfers with appropriate safeguards, such as the European Commission's standard contractual clauses, the UK addendum or equivalent mechanisms under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which allows transfers to countries with adequate protection or where appropriate safeguards or another lawful basis apply. You can ask us for more information about these safeguards.

7. Cookies and similar technologies

We use cookies, local storage and similar technologies to:

• keep the service working (strictly necessary): keep you signed in, secure your session, prevent fraud and remember your preferences;
• understand usage (analytics): see which features are used and fix problems using analytics providers; and
• measure marketing (advertising): see which campaigns bring people to Trophy using advertising measurement tools, only where you have agreed.

Where the law requires it (for example in the EU and UK), we ask for your consent before setting non-essential cookies, and you can change your choice at any time through the cookie settings link in the footer of our website. You can also block or delete cookies in your browser, but parts of the service may not work if you block essential cookies. Where the law requires it, we treat a Global Privacy Control signal from your browser as a valid opt-out request.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymise it. Proposed periods:

We may keep information longer where we must by law, to resolve disputes, or to enforce our agreements.

9. How we protect information

We use technical and organisational measures designed to protect personal information, such as encryption in transit, access controls on a need-to-know basis, and vetting of our service providers. No system is completely secure. Please protect your sign-in method and devices, and tell us straight away at [email protected] if you suspect unauthorised access. If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy;
• correct inaccurate or incomplete information;
• delete your information (subject to legal exceptions);
• restrict or object to certain uses, including direct marketing and processing based on legitimate interests;
• data portability: receive information you gave us in a structured, machine-readable format;
• withdraw consent at any time, where we rely on consent (this does not affect earlier processing);
• not be subject to a decision based solely on automated processing that significantly affects you, and ask for human review; and
• complain to your local data protection authority.

California and other US state residents. If you live in California or another US state with a consumer privacy law, you may have the right to know what personal information we collect, use and disclose; to delete or correct it; to opt out of the "sale" or "sharing" of personal information or targeted advertising; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information. We do not share personal information for cross-context behavioural advertising, and we honour Global Privacy Control signals. Sensitive information such as government ID or biometric data is used only for identity verification, fraud prevention and legal compliance. You may use an authorised agent to make a request on your behalf.

UAE residents. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you have the right to receive information about the personal data we process; to request a copy of it and transfer it to another controller; to have inaccurate data corrected and to have data erased where it is no longer needed or processed unlawfully; to restrict or object to processing, including for direct marketing; to withdraw consent at any time; and to object to decisions based solely on automated processing that have legal effects on you. You may also complain to the UAE Data Office.

How to make a request. Email [email protected] from the email linked to your account, or use your account settings. We will verify your identity before acting on a request, and respond within the time the law requires (usually one month under GDPR, or 45 days under California law). We do not charge a fee unless a request is clearly unfounded or excessive.

Marketing. You can unsubscribe from marketing emails at any time using the link in each email or in your settings. We will still send you service messages, such as receipts and security alerts.

11. Third-party links and services

The service links to or relies on third-party services, such as Privy, Stripe and Collector Crypt. Their own privacy policies apply to how they handle your information, and we encourage you to read them.

12. Changes to this policy

We may update this policy from time to time. We will change the "last updated" date and, for material changes, tell you by email or in the service before the change takes effect, or ask for your consent where the law requires it.

13. Contact us

Agspeedy HiT Technologies L.L.C.
Times Square Center, Sheikh Zayed Road, Al Quoz Industrial First, Dubai, United Arab Emirates
Privacy questions and requests: [email protected]
We have not appointed an EU or UK representative or a data protection officer. Data protection contact: [email protected]