The short version
- · We collect what we need to run the shop: account email, transactions, address when you ship, and basic device and advertising-measurement data.
- · We never sell your data. We do share limited advertising-measurement data (including a scrambled, irreversible form of your email) with ad platforms so we can tell which ads work.
- · We email you about your account, and occasionally about offers — every promotional email has a one-click unsubscribe.
- · You can access, correct, delete, and export your data.
The summary is a courtesy; the full text below is what governs.
1. What we collect
Account data (email, password hash, age confirmation, and, if you choose "Continue with Google", the Google account identifier and verified email address we receive from Google to link your account; disconnecting Google from your account settings removes that link); transaction data (Sparks purchases, pack purchases, opens, sales, redemptions); shipping addresses when you redeem physical cards; contact-form submissions (name, email, message) when you write to us; device and usage data (IP address, browser type, pages viewed) for security, debugging, and fraud prevention; a payment-method identifier from our payment processor (Stripe returns an opaque "fingerprint" for the card you pay with — we never receive or store your full card number) which, together with your IP, device information, and shipping address, we use to detect fraud and abuse and to identify accounts that appear to belong to the same person, so we can enforce our one-account-per-person and promotion rules; and cookies and similar technologies for session authentication, preferences, analytics, and advertising measurement. We use privacy-friendly analytics (Plausible) and anonymous performance metrics (Vercel Web Analytics and Speed Insights — page-load and web-vitals timing, no cookies and no personal information) and, so we can measure which ads bring people to the site, advertising and conversion-tracking tools from Google Ads, Microsoft (Bing), TikTok, and Reddit (loaded on our pages, including through Google Tag Manager). When you sign up or make a purchase we may also send those ad platforms a record of that event from our servers, identified only by a scrambled, irreversible form of your email address (a "hash"), never your email in readable form. SAVED CARDS: if you choose to save a card for one-tap Sparks top-ups (Terms §3c), the card itself is stored by our payment processor (Stripe, PCI-compliant) — we store only its brand, last four digits, and expiry (for display), plus the fingerprint above and the date, terms version, and device of the authorization you gave to charge it. We NEVER receive or store your full card number. When you remove a saved card, or when your account is closed or deleted, we detach that card from Stripe and delete the stored brand, last four, expiry, and authorization details. If you pay with Apple Pay or Google Pay, that wallet provider also processes the payment under its own privacy terms. IDENTITY VERIFICATION (redemptions): if we ask you to verify your identity before shipping a card (Terms §7), the verification — a photo of your government-issued ID and a selfie, which for the identity-match check includes BIOMETRIC data (a facial geometry comparison of your selfie to your ID photo) — is collected and processed by our verification provider, Stripe (Stripe Identity), acting as our processor. Stripe performs the document and biometric checks, reads the date of birth from your ID to confirm you meet our 18+ requirement, and stores the ID and selfie images; PackLab RECEIVES AND STORES ONLY THE OUTCOME — a pass/fail status, the verified name, and whether you are 18 or older (a yes/no result; we do NOT receive or store your actual date of birth) — which we use solely to release your redemption, confirm your eligibility (18+), and prevent fraud. We do not receive or store the ID image, the selfie, the date of birth, or the underlying biometric identifiers, and we never use them for advertising or sell or share them. Verification is optional (you may instead wait out the clearance period in Terms §7), and you can ask us to delete a verification record as described in Sections 4 and 5. EARNING SPARKS (offerwall & surveys): if you choose to earn Sparks by completing third-party offers or surveys (Terms §3a), those offers are presented and operated by our INDEPENDENT offer partners (currently Lootably) and the advertisers behind each offer; when you engage an offer we pass the partner a pseudonymous per-user identifier for your account (and your IP) so it can attribute your completion and pay the reward, and the partner collects information directly from you under its OWN privacy policy as an independent controller, not as our processor (see Section 3a).
2. Why we collect it
To operate your account and wallet; to secure your account (verifying your email address, confirming a password reset, and, when you change your email address, sending a verification message to the NEW address before that change takes effect); to fulfill redemptions (card shipping, code emails); to meet legal obligations (age verification, anti-money-laundering review, tax reporting, unclaimed property); to prevent fraud and abuse; to measure our advertising; and to email you. We send two kinds of email. TRANSACTIONAL email keeps your account working (receipts, verification, password resets, shipment and redemption updates); because it is part of the service you cannot unsubscribe from it while your account is open. PROMOTIONAL email is occasional news about offers, rewards, and new sets; every promotional message is clearly identified as promotional, carries a working one-click unsubscribe link, and includes our postal address (compliant with CAN-SPAM in the United States and Canada's Anti-Spam Legislation, "CASL"). You can opt out of promotional email at any time, from the link in any such message or from Email preferences in your account settings, and we honor opt-outs promptly. Opting out never affects transactional email.
3. Who sees it
Service providers acting for us: payment processors, our identity-verification provider (Stripe Identity, which processes the government ID and selfie — including the biometric identity-match — for redemptions as described in Section 1), email delivery, cloud hosting, and shipping carriers, each bound to use data only to provide their service. We disclose data when the law requires (subpoena, unclaimed-property reporting, AML obligations). WE DO NOT SELL YOUR PERSONAL DATA, and we never receive money for it. We do share limited advertising-measurement data with the ad platforms named in Section 1 (Google, Microsoft, TikTok, Reddit): the pages you view on our site and, for signups and purchases, a scrambled, irreversible form of your email address, so those platforms can tell us which ads worked. Under some U.S. state privacy laws (for example California's) this counts as "sharing" personal information for cross-context behavioral advertising, so we disclose it plainly here, and you can opt out as described in Section 4. For residents of Quebec, Quebec's Law 25 requires consent for this kind of advertising-measurement sharing; you can give or withdraw that consent at any time using the email route in Section 4, and we will honor it. Separately, our OFFERWALL PARTNER (Lootably), which lets you earn Sparks by completing offers, are NOT service providers acting for us: they are independent third-party controllers who, together with their downstream advertisers, decide their own use of the information you give them when you engage an offer, under their own privacy policies (see Section 3a).
3a. Offerwall & survey partners (earning Sparks)
If you choose to earn Sparks by completing third-party offers or surveys (Terms §3a), those offers are hosted and operated by INDEPENDENT offer partners — currently Lootably — together with the advertisers and survey providers behind each individual offer. These partners are third-party controllers in their own right, NOT our service providers or processors: they decide what personal information to collect from you and how to use it, under their own privacy policies and terms, which govern that activity and which you should review before starting an offer. To attribute a completion and pay your reward, we pass the partner a pseudonymous per-user identifier for your account and, from the partner, receive back only the completion status, the reward amount, and a transaction identifier; we do NOT receive the survey answers, profile data, or other information you provide to the partner. We share this identifier solely to run the earning feature and to prevent fraud and abuse, and we do not sell it. Earning is entirely optional: if you never open an offer, none of this sharing happens. You can exercise your privacy rights with us as described in Section 4; rights over the data a partner collects directly are exercised with that partner.
4. Your rights
Wherever you live, we extend the rights of the current U.S. state privacy laws: access a copy of your data; correct it; delete it (subject to records we must keep, like transaction history); port it; opt out of the advertising-measurement sharing described in Section 3; and appeal a refusal. To opt out of that sharing, or to exercise any other right, email support@packlab.gg and we will action it for your account and respond within 30 days. To stop the ad-measurement tools in your browser generally, you can also use your browser's tracking protection or an ad blocker; note that we do not currently detect Global Privacy Control (GPC) browser signals automatically, so please use the email route above and we will honor it. To stop promotional email, use the unsubscribe link in any promotional message or Email preferences in your account settings.
4a. Canada: PIPEDA and Quebec Law 25
If you are in Canada, we handle your personal information in line with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Quebec's Law 25. ACCESS AND CORRECTION: you have the right to access the personal information we hold about you and to request correction of information that is inaccurate or incomplete; email support@packlab.gg and we will respond within 30 days. CROSS-BORDER PROCESSING: PackLab is operated from the United States, and our service providers (payment processing, email delivery, cloud hosting, analytics, and advertising measurement, listed in Sections 1 and 3) process and store data in the United States and other countries. Your personal information is therefore transferred outside Canada and, while there, is subject to the laws of those countries, including lawful access by their courts and authorities; by using the service you acknowledge this transfer, and we use contractual and technical safeguards to protect it. BREACH NOTIFICATION: if a breach of our security safeguards creates a real risk of significant harm to you, we will notify you and report to the Office of the Privacy Commissioner of Canada (OPC), and keep records of breaches, as PIPEDA requires. QUEBEC LAW 25: Quebec residents also have rights of access and correction and, where applicable, data portability and de-indexing; Law 25 requires consent for the advertising-measurement sharing described in Section 3, and you can give or withdraw that consent at any time via support@packlab.gg — we will honor it. PRIVACY CONTACT: our privacy contact is Tyler Mailman, support@packlab.gg, 74 Old Orchard Rd, Saco, ME 04072, USA. You may also complain to the OPC (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec.
5. Retention and security
Account and transaction records are kept for as long as your account is open plus the period required by tax, AML, and unclaimed-property law (typically 5–7 years). Identity-verification records we hold (the pass/fail status, verified name, and 18-or-older result — never the ID image, selfie, date of birth, or biometric identifiers, which stay with Stripe) are kept only as long as needed to fulfill the redemption and meet fraud-prevention and legal-record obligations; on request, or when your account is deleted, we delete our verification record and instruct Stripe to redact the underlying ID and biometric data it holds. Passwords are stored only as salted hashes; data in transit is encrypted (TLS); access to production data is limited to personnel who need it.
6. Children
The service is for adults 18 and over. We do not knowingly collect data from anyone under 18; accounts found to belong to minors are closed and their data deleted, with that account's Sparks purchases refunded to the payment source.
7. Changes and contact
We may update this policy at any time. The current version always lives at this URL and takes effect when posted, with the "Updated" date above as the notice of record. Where the law requires advance or individual notice of a particular change, we will give it. Questions and requests: support@packlab.gg · Tyler Mailman (d/b/a PackLab), 74 Old Orchard Rd, Saco, ME 04072, USA.