Privacidade
Versão 2026-10-05Em vigor desde 4/10/2026
Como a N01, gerida pela Kuldra Capital AB, trata os teus dados pessoais.
Em resumo
- Em resumo: não carregamos rastreadores antes de concordares, guardamos apenas o que uma conta, os seus pagamentos, cartas e envios precisam e o que a lei exige, nunca vendemos os teus dados, e podes pedir a qualquer momento uma cópia dos teus dados ou o encerramento da conta.
O texto completo abaixo está em inglês, e prevalece o texto em inglês.
Esta tradução foi feita com apoio automático e ainda não foi revista por um falante nativo. Prevalece o texto em inglês.
In short
- We keep what an account, its payments, its cards and its deliveries need, and what the law makes us keep.
- We don't sell your data, use it for advertising or send marketing email.
- Analytics runs only if you accept it in the cookie banner.
- The public feed and fairness log never show your email, name or address.
- You can ask for a copy of your data, a correction, or erasure at any time at privacy@n01packs.com.
01Who is responsible
Kuldra Capital AB, Skeppsbron 28, 111 30 Stockholm, Sweden, company number 559523-1340, is the controller of the personal data described here. Write to privacy@n01packs.com about anything in this policy. For everything else, support is at support@n01packs.com.
02What we collect, why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Account: email, password (stored only as a one-way hash by our sign-in provider), country, your 18+ confirmation and when it was recorded, the terms version you accepted and when, member number, display name and Anonymous setting, account status | To run your account, check that you may buy, and apply the right terms | Contract; for the age check also our legitimate interest in not selling to minors |
| Sign-in and security: sign-in times and sessions, and the IP address and browser our sign-in provider logs; the result of the bot check on the sign-up and sign-in pages | To keep accounts secure and stop automated sign-ups | Legitimate interest |
| Purchases and the ledger: every order, payment, product, draw, card, trade-in, refund, points and wallet entry, with amounts, times and how each was paid | To deliver what you bought, keep your balances right, answer questions and keep accounts | Contract; legal obligation (bookkeeping) |
| Payments: the payment's id at Stripe, amount and status, the country of your card, a one-way hash of the card's fingerprint, and the 3D Secure result. We never see or store your card number | To take payment and refund you, limit how many cards an account uses, and spot one card used on several accounts | Contract; legitimate interest in preventing fraud |
| Payment evidence: the IP address and device details of the request that made a payment | To answer a card dispute. If you dispute a payment, we send the evidence for that payment (receipt, 3D Secure result, opening and delivery records, IP address) to Stripe and through it to your card issuer | Legitimate interest |
| Shipping: the name, address and phone number (if you give one) for a shipment, the carrier and the tracking number | To deliver your cards | Contract |
| Daily Drop: your drops and results; a one-way hash of a random id stored in your browser; a hash of your IP address made with a key that changes daily and is deleted after two days | To run the Daily Drop and spot many accounts played from one device or network. These signals only flag an account for a person to look at | Contract (the drop); legitimate interest (abuse checks) |
| Reviews of bonus cards: the signals above, other accounts on the same payment card, and the reviewer's decision and reason | To check promotions are used fairly before a bonus card is shipped or traded in | Legitimate interest |
| Fairness records: each draw's receipt, result and your seed periods | To prove that every draw was fair | Contract; legitimate interest in proving fairness |
| Support: what you write to us and our replies | To answer you | Contract; legitimate interest |
| Staff records: which of our staff looked at or changed your account, when and why | Security and accountability | Legitimate interest; legal obligation (security of processing) |
| Error reports: what broke on a page, with emails, tokens, payment ids, addresses and query strings removed before they are sent | To find and fix faults | Legitimate interest |
| Analytics, only if you accept it: pages visited, clicks, page speed and a few shop steps, tied to a random browser id, never to your account, name, email, card or address | To learn which pages work and which don't | Consent, which you can withdraw at any time under Cookie settings |
To open an account you must give an email, a password, your country and the 18+ confirmation, and to ship you must give an address. Without them we can't open the account or send the parcel. Everything else comes from using N01.
We don't sell your data, use it for advertising or build marketing profiles of you, and we send no marketing email.
03Automated checks
Some checks run automatically: card payment limits for new accounts, 3D Secure on every card payment, a restriction of an account that pays with a card already used on another account or uses more cards than its limit allows, a restriction after a lost card dispute, and a review before a bonus card from a flagged account is shipped or traded in. They are needed to sell to you safely. A restricted account can still sign in and see its cards and balances. A person decides every flagged bonus review, and you can ask a person to review any automatic restriction, give your view and contest it, by writing to support.
04Who handles data for us
These companies process personal data on our behalf, under data processing agreements, only for the purposes above:
| Company | What it does for us | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | EU (Ireland) |
| Resend | Sends our emails: sign-in and password links, order confirmations, receipts, refund and shipping updates | Sending in the EU (Ireland); its account data in the United States |
| Vercel | Hosts the website | Functions in the EU (Dublin); a global network delivers the pages |
| Stripe | Card payments, 3D Secure, refunds and disputes. Stripe is also an independent controller for its own fraud prevention and legal duties | Stripe Payments Europe (Ireland) |
| Sentry | Error reports from the website | EU (Germany) |
| PostHog | Website analytics, only if you accept Analytics | EU (Germany) |
| Google Workspace | Our email: support and privacy messages | EU and other regions |
| Cloudflare | The Turnstile bot check on sign-up and sign-in | Global network |
Some of these companies, or their support teams and subprocessors, are in the United States or elsewhere outside the EU and EEA. Transfers there rely on the EU-US Data Privacy Framework where the company is certified, or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
Other recipients. The carrier that delivers your parcel receives your name and address. When a card we buy for you is sent straight from the marketplace seller we buy it from, that seller and the marketplace receive your name and delivery address; we record each time we do this. They use the data for the delivery as controllers in their own right. Stripe and your card issuer receive dispute evidence as described above. We give data to authorities only when the law requires it.
05What is public: the latest pulls feed and the fairness log
Latest pulls. The site shows recent pulls: the card, its N01 value and tier, the product, the minute it was drawn, and whether it was a bonus card. Next to a pull it may show your display name ("Collector" and a number), unless you have switched on Anonymous on your account page. It never shows your email, country, member number or anything else about your account.
Fairness log. So that anyone can check that draws are fair, every pool, draw receipt and result is published in a public, permanent log. The log names a customer only by a random code that changes with every seed period, so pulls can't be linked to you, or to each other across periods. It shows no name, email or payment. Because the log must stay unchanged to prove fairness, entries can't be removed from it. Nothing in it identifies you without our records, but a pull shown with your display name in the feed can be matched to its log entry.
06How long we keep data
- Account data: while your account is open. When you close it or ask us to erase your data, we delete your email, sign-in identity, addresses and support messages and keep an anonymous record in their place.
- Purchases and the ledger: seven years after the end of the year of the transaction, because Swedish bookkeeping law requires it, without your name or email once the account is erased.
- IP address and device details kept as payment evidence: 18 months after the latest of the payment, the last shipment of a card it paid for and the close of its last dispute. Then they are erased.
- Shipping addresses: for as long as the shipment, any complaint about it and the payment evidence for it need them, and no longer than the account.
- Daily Drop: the daily IP key is deleted after two days, after which the IP hash can no longer be linked to an IP address. Drops and their device hashes are kept while the account is open.
- Fairness records: for good, because they prove the draws, without your name or email.
- Support messages: while the account is open, and as long as a complaint or claim about them may still be raised.
- Analytics: events are tied only to a random browser id, never to your account, and kept in PostHog's EU region only as long as they help us improve the site. Withdrawing consent stops new events at once.
07Your rights
You can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive the data you gave us in a machine-readable format. Where we rely on your consent you can withdraw it at any time. Write to privacy@n01packs.com from the email on your account, so we know it's you. We answer within one month.
Much of your data is already on your account pages: orders, products, cards, wallet, shipments and fairness receipts.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or to the data protection authority where you live.
08Security
Account and payment data sit in a private part of our database that the website reaches only through checked functions. Every money movement is recorded in an append-only ledger. Our staff have access by role, and every view and change they make is logged. We never store card numbers. If a breach puts your data at risk, we tell you and IMY as the law requires.
09Children
N01 is for people 18 and over. If we learn that an account belongs to someone under 18, we close it, refund what was paid and delete the data we don't have to keep by law.
11Changes to this policy
When we change this policy we publish the new version here with its date, and tell you by email and on the site when the change matters to you.