The short version
- · We collect what we need to run the shop: account email, transactions, address when you ship, and basic device data.
- · We never sell your data.
- · You can access, correct, delete, and export your data, and we honor Global Privacy Control signals.
The summary is a courtesy; the full text below is what governs.
1. What we collect
Account data (email, password hash, age confirmation); transaction data (Sparks purchases, pack purchases, opens, sales, redemptions); shipping addresses when you redeem physical cards; contact-form submissions (name, email, message) when you write to us; identity-verification data if requested at redemption (processed by our verification provider); device and usage data (IP address, browser type, pages viewed) for security and debugging; and cookies limited to session authentication and preferences — we do not run third-party advertising trackers.
2. Why we collect it
To operate your account and wallet; to fulfill redemptions (card shipping, code emails); to meet legal obligations (age verification, anti-money-laundering review, tax reporting, unclaimed property); to prevent fraud and abuse; and to send transactional email (receipts, shipment updates, redemption decisions). We currently send ONLY transactional email — there is no marketing list. If we ever introduce marketing email it will be strictly opt-in, with a working unsubscribe link in every message (CAN-SPAM).
3. Who sees it
Service providers acting for us: payment processors, identity-verification providers, email delivery, cloud hosting, and shipping carriers — each bound to use data only to provide their service. We disclose data when the law requires (subpoena, unclaimed-property reporting, AML obligations). We do not sell or share personal data for cross-context behavioral advertising.
4. Your rights
Wherever you live, we extend the rights of the current U.S. state privacy laws: access a copy of your data; correct it; delete it (subject to records we must keep, like transaction history); port it; and appeal a refusal. We honor Global Privacy Control (GPC) browser signals as an opt-out of any data sale or sharing — though we don't sell data in the first place. Exercise rights at legal@packlab.gg; we respond within 45 days.
5. Retention and security
Account and transaction records are kept for as long as your account is open plus the period required by tax, AML, and unclaimed-property law (typically 5–7 years). Passwords are stored only as salted hashes; data in transit is encrypted (TLS); access to production data is limited to personnel who need it.
6. Children
The service is for adults 18 and over. We do not knowingly collect data from anyone under 18; accounts found to belong to minors are closed and their data deleted, with any balance refunded to the payment source.
7. Changes and contact
Material changes to this policy will be announced on the site and by email before they take effect. Questions and requests: legal@packlab.gg · Tyler Mailman (d/b/a PackLab), 74 Old Orchard Rd, Saco, ME 04072, USA.