Privacy Policy

1Who we are#

mistVCC is a reseller service operated by Mist Network (“we”, “us”). We are responsible for the personal data processed through the Service as described in this policy.

Contact for any privacy question or request: support@mistvcc.com. You can also reach us through a support ticket in the user panel or our official Telegram support.

2Data we collect#

• Account data — email address, username, password (stored only as a one-way hash), language preference and your account recovery code (stored encrypted and hashed).
• Identity verification (KYC) data — documents and information you upload when a card type or the Issuer requires verification. Uploaded files are stored encrypted.
• Financial and card data — account balance, top-ups and their crypto payment details (such as amount, network and transaction reference), cards issued to you, card balances and card transactions received from the Issuer. Full card numbers and CVV codes are fetched from the Issuer only when you ask to view them and are not stored in our database or logs.
• Support data — tickets, messages and attachments you send us.
• Telegram data — if you use our Telegram bot or mini app, your Telegram user ID, username and the messages you send to the bot.
• Technical and security data — IP address, browser and device information, login and security events, and audit logs of account actions.
• Referral data — the referral or partner code you arrived with, if any.
• Analytics data — with your consent, information about how you use our pages collected through Google Analytics and Google Ads measurement (see “Cookies”).

3How we use your data#

• To provide the Service — create and secure your account, credit top-ups, issue and operate cards, show transactions and answer support requests (necessary to perform our contract with you).
• To meet legal and Issuer requirements — identity verification, fraud and abuse prevention, record keeping and responding to lawful requests (legal obligation and legitimate interests).
• To keep the Service safe — detect suspicious logins, rate-limit abuse and investigate disputes (legitimate interests).
• To communicate with you — service notices about payments, cards, verification and tickets by email, in the panel or on Telegram.
• To measure and improve our website and advertising — only with your consent where required by law.

We do not sell your personal data, and we do not use your KYC documents for marketing.

4Who we share data with#

We share personal data only where needed for the purposes above:

• Card Issuers and their programme managers — to issue and operate your cards, including verification data where the Issuer requires it.
• Payment processors — the crypto payment providers that process your top-ups (for example mistket and Heleket).
• Infrastructure providers — hosting, email and messaging providers that run the Service (for example Hostinger and Telegram).
• Google — Google Analytics and Google Ads measurement, only according to your cookie choice.
• Mist Network services — the shared Mist Network account and referral system, to attribute referrals and provide network-wide support.
• Authorities — where we are legally required to disclose data or to protect our rights, users or the public.

These parties may process data outside your country. Where this happens, we rely on the safeguards available under applicable law.

5Cookies#

We use a small number of cookies:

• Essential — session and sign-in (vccsid), language (vcc_lang, mb_lang), referral attribution (ref_code, mn_ref, mn_pc and similar Mist Network cookies) and your cookie choice (mv_consent). These are needed for the site to work and do not require consent.
• Analytics and advertising — Google Analytics (_ga, _ga_*) and Google Ads (_gcl_*) cookies. These are set only after you click “Accept” in the cookie banner. In the EEA, the UK and Switzerland they are off by default.

You can change your choice at any time with the “Cookie settings” link in the footer, or delete cookies in your browser.

6How long we keep data#

We keep account data while your account is active. After an account is closed, we keep financial, transaction, verification and security records for as long as necessary for legal, accounting, fraud-prevention and dispute purposes, and then delete or anonymise them. Support tickets are kept for as long as needed to handle the request and any follow-up.

7Security#

All connections use HTTPS. KYC files and recovery codes are stored encrypted, passwords are hashed, full card details are not stored, and administrative access is restricted and logged. No method of transmission or storage is completely secure, so please keep your password, recovery code and email account safe.

8Your rights#

Depending on the law that applies to you, you may have the right to access, correct or delete your personal data, to restrict or object to certain processing, to data portability and to withdraw consent at any time. Some data must be kept for legal reasons even if you ask us to delete it.

To make a request, email support@mistvcc.com from the email address on your account. We may ask you to confirm your identity. You also have the right to complain to your local data protection authority.

9Children#

The Service is only for adults who have reached the age of legal majority. We do not knowingly collect data from children.

10Changes to this policy#

We may update this policy from time to time. The “Last updated” date shows when it last changed. Significant changes will be announced in the panel or by email.