Unboxs

Privacy Policy

Last updated October 23, 2026

This policy explains what data Unboxs (unboxs.shop) and the China Shopping Copilot extension use, why, and how you control it. Unboxs is run from Brazil and follows the Brazilian General Data Protection Law (Law 13.709/2018, LGPD). If you are in the European Union or the United Kingdom, you also have the rights given by the GDPR and the UK GDPR.

1. Who is responsible

Unboxs is a catalog of products from Chinese suppliers with links to buy through the CSSBuy shopping agent. The store owner is responsible for your data and can be reached by email at [email protected]. This is also the contact for our data protection officer.

2. Data we use

• Your Google account, when you sign in: name, email and profile photo. Your password stays with Google; we never receive it.
• Store usage: pages viewed, products opened, links unlocked each day, declaration copies and VIP clicks. To count visitors without knowing who they are, your browser keeps a random ID.
• Approximate country: the country of your internet address, provided by Cloudflare, used only to pick the language and currency of your first visit. We don't store it.
• VIP: your subscription end date and, if you pay through Stripe, the customer ID Stripe creates. Card details stay with Stripe.

We don't ask for ID numbers, addresses or phone numbers.

3. Why we use it

• To keep your account and manage your daily free links and VIP access.
• To show the store in your language and currency.
• To see, in aggregate numbers, what works in the catalog and improve the store.
• To prevent abuse, such as fake accounts or automated use.

We don't sell your data or use it for third-party advertising.

Our legal bases are performing the service you asked for (account and VIP), legitimate interest (language, metrics and security) and legal obligations (payment records).

4. Who holds the data

We use companies that store or process data on our behalf:

• Supabase: database and sign-in.
• Railway: website hosting.
• Google: sign-in with your Google account.
• Cloudflare: website delivery, attack protection and approximate visitor country.
• Stripe: VIP payments, when used.

Some of them run servers in other countries. In those cases, transfers follow the safeguards required by the LGPD (art. 33) and, where applicable, the GDPR.

CSSBuy: when you open a product link, you go to the CSSBuy website, which has its own privacy policy. The link carries Unboxs's referral code, and CSSBuy may pay us a commission on your purchases at no extra cost to you. CSSBuy doesn't receive your data from our store.

5. What stays in your browser

Your browser keeps your sign-in session, light or dark theme, visitor ID and, in two cookies, the language and currency you choose. We don't use advertising cookies. Clearing this site's data in your browser removes all of it.

6. How long we keep it

Account data is kept while the account exists. When you ask for deletion, we delete the account and the data linked to it; usage history loses your name and remains only in aggregate numbers. Payment records are kept for as long as the law requires.

7. Your rights

At any time you can ask for confirmation that we process your data, access, correction, deletion, portability, information about who we share it with, and withdrawal of consent. Send your request by email at [email protected]. We reply within 15 days. You can also complain to the Brazilian data protection authority (ANPD) or to the data protection authority in your country.

8. China Shopping Copilot extension

The extension only works on Xianyu (Goofish), Taobao, Tmall, Weidian and 1688 pages. There it hides the login wall, shows the approximate price in your currency, adds the CSSBuy buttons and translates the page when you ask.

• Stays in your browser: your extension preferences (language, currency and buttons) and the store settings. Translation uses Chrome's built-in translator, which runs on your computer.
• Connections it makes: it fetches from unboxs.shop the store name, exchange rates, referral code and the language and currency suggested for your country, without sending anything about you; it checks the daily rate at open.er-api.com when the store doesn't respond; and when you click a CSSBuy button, it goes through the unboxs.shop short link, which counts the visit without identifying you.
• What it doesn't do: it doesn't read your browsing history, passwords or forms, doesn't access your accounts on those sites and doesn't sell data.
• Referral: CSSBuy links created by the extension carry Unboxs's referral code.

9. Security and audience

Database access is protected by rules that only let each person see their own data, and the store dashboard requires an administrator account. The store is intended for people aged 18 and over.

10. Changes to this policy

When this policy changes, the date at the top is updated. Important changes will be announced on the store.