Privacy Policy
Last updated: 10 August 2026
The short version. We collect what we need to take your order, ship it, and email you about it. We do not sell your personal information. You can unsubscribe from marketing at any time, and you can ask us to delete your data by emailing privacy@mysteryfc.com.
This policy explains how Mystery FC ("we", "us", "our") collects, uses and protects your personal information when you use shopmysteryfc.com (the "Site"). Mystery FC is operated from 555 West Beech Street, San Diego, CA 92101, United States.
1. Information we collect
(a) Information you give us
When you place an order we collect your name, email address, shipping and billing address, phone number where provided, and your product preferences (size, type, league, and any clubs you ask us to avoid).
We do not collect or store your card number. Payments are processed by Stripe, Inc. Your card details go directly to Stripe and never reach our servers. See Stripe's privacy policy at stripe.com/privacy.
(b) Information collected automatically
Like most websites, our servers log your IP address, browser type, referring page, and the date and time of your visit. We use this for security, fraud prevention and troubleshooting.
(c) Cookies and similar technologies
We use a small number of cookies to keep your selections during checkout and to measure whether our marketing is working. Most browsers accept cookies by default; you can refuse or delete them in your browser settings, though parts of the Site may stop working if you do.
Our cookies cannot read files on your device or access other information on your computer.
(d) Children
We do not knowingly collect personal information from anyone under 13. If you are under 13, please do not submit information to us. If you believe a child has given us personal information, email privacy@mysteryfc.com and we will delete it.
2. How we use your information
- To process, pack and ship your order, and to select the jerseys that match the preferences you gave us;
- To email you about your order — confirmations, tracking, and delivery updates. You cannot opt out of these, because they are part of the transaction;
- To send marketing emails, only where you have bought from us before or opted in. Every marketing email has an unsubscribe link;
- To prevent fraud and abuse, and to enforce our Terms;
- To meet our legal, tax and accounting obligations.
3. Who we share it with
We do not sell, rent or trade your personal information. We share it only with service providers who need it to do their job for us:
- Stripe — payment processing;
- Shipping carriers (such as USPS, UPS, DHL) — to deliver your order. They receive your name, address, email and phone number;
- Our email provider — to send order and marketing email;
- Cloudflare — website hosting and security.
We may also disclose information where required by law — in response to a subpoena, court order or lawful request from law enforcement — or where necessary to protect our legal rights or prevent fraud.
If we are acquired by or merge with another company, your information may transfer as part of that transaction. It would remain subject to a privacy policy at least as protective as this one.
4. How long we keep it
- Order records — seven years, for tax and accounting.
- Marketing contacts — until you unsubscribe or ask for deletion.
- Server logs — up to 12 months.
5. Your California privacy rights
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to:
- Know what personal information we have collected about you and how we use it;
- Delete personal information we hold about you, subject to legal exceptions such as our tax record-keeping obligations;
- Correct inaccurate personal information;
- Opt out of sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of;
- Not be discriminated against for exercising any of these rights. We will not refuse service, change prices, or reduce quality because you made a request.
To exercise any of these, email privacy@mysteryfc.com with the subject line "Privacy Request". We will verify your identity by confirming details of an order you placed, and respond within 45 days.
6. If you are outside the United States
Our servers and our business are in the United States. If you order from elsewhere, your information is transferred to, stored in, and processed in the US, where data protection law may differ from your own country's.
If you are in the UK or EEA, you also have rights of access, rectification, erasure, restriction, portability and objection under the UK GDPR / EU GDPR. Our lawful bases are performance of a contract (to fulfil your order), legitimate interests (fraud prevention, and marketing to existing customers), and consent (marketing where you opted in). Email the address above to exercise any of these.
7. Marketing and how to opt out
Every marketing email includes a one-click unsubscribe link in the footer. It takes effect immediately. You can also reply to any email and ask, or write to privacy@mysteryfc.com.
Unsubscribing from marketing does not stop transactional email about an order you have already placed.
8. Security
We use HTTPS across the Site, and payments run through Stripe's PCI-compliant infrastructure. We restrict access to personal information to people who need it to do their job.
No system is completely secure, online or offline, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by law.
9. Changes to this policy
We may update this policy. The "last updated" date at the top will change. Material changes will be announced on this page. Continuing to use the Site after a change means you accept the updated policy.
10. Contact
Mystery FC
555 West Beech Street, San Diego, CA 92101
privacy@mysteryfc.com