Privacy
Version 2026-10-05In force from 20 Oct 2026
How N01, run by Kuldra Capital AB, handles your personal data.
In short
- We keep what an account, its payments, its cards and its deliveries need, and what the law makes us keep.
- We don't sell your data, build marketing profiles of you or send marketing email.
- Analytics runs only if you accept it in the cookie banner, and so does Marketing: measuring our ads on Facebook, Instagram and TikTok with Meta and TikTok, never with your name, email, phone, card or address.
- The public feed and fairness log never show your email, name or address.
- You can ask for a copy of your data, a correction, or erasure at any time at privacy@n01.gg.
01Who is responsible
Kuldra Capital AB, Skeppsbron 28, 111 30 Stockholm, Sweden, company number 559523-1340, is the controller of the personal data described here. Write to privacy@n01.gg about anything in this policy. For everything else, support is at support@n01.gg.
02What we collect, why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Account: email, password (stored only as a one-way hash by our sign-in provider), the country of your first payment (your billing address, else your card), your 18+ confirmation and when it was recorded, the terms version you accepted and when, member number, display name and Anonymous setting, account status | To run your account, check that you may buy, and apply the right terms | Contract; for the age check also our legitimate interest in not selling to minors |
| Sign-in and security: sign-in times and sessions, and the IP address and browser our sign-in provider logs; the result of the bot check on the sign-up and sign-in pages | To keep accounts secure and stop automated sign-ups | Legitimate interest |
| Purchases and the ledger: every order, payment, product, draw, card, trade-in, refund, points and wallet entry, with amounts, times and how each was paid | To deliver what you bought, keep your balances right, answer questions and keep accounts | Contract; legal obligation (bookkeeping) |
| Payments: the payment's id at Stripe, amount and status, the country of your card, a one-way hash of the card's fingerprint, and the 3D Secure result. We never see or store your card number | To take payment and refund you, limit how many cards an account uses, and spot one card used on several accounts | Contract; legitimate interest in preventing fraud |
| Payment evidence: the IP address and device details of the request that made a payment | To answer a card dispute. If you dispute a payment, we send the evidence for that payment (receipt, 3D Secure result, opening and delivery records, IP address) to Stripe and through it to your card issuer | Legitimate interest |
| Shipping: the name, address and phone number (if you give one) for a shipment, the carrier and the tracking number. While you type a delivery address, the text you type and the country you chose go to Google for address suggestions | To deliver your cards | Contract |
| Daily Drop: your drops and results; a one-way hash of a random id stored in your browser; a hash of your IP address made with a key that changes daily and is deleted after two days | To run the Daily Drop and spot many accounts played from one device or network. These signals only flag an account for a person to look at | Contract (the drop); legitimate interest (abuse checks) |
| Account checks: when you are signed in, claim the welcome pack or pay, a one-way hash of your network (your IP address; for IPv6 its first half) made with a key that never leaves our database, and a one-way hash of the random id stored in your browser. Never the address itself | To keep the welcome offer to one per person and spot one person running many accounts. An account on a device or network where the welcome offer was claimed already can lose what is unused of it, linked accounts are counted together for the payment check, and their first shipment is checked by a person | Legitimate interest in preventing fraud and abuse of promotions |
| Reviews of bonus cards and shipments: the signals above, other accounts on the same payment card, and the reviewer's decision and reason | To check promotions are used fairly before a bonus card is shipped or traded in, or a linked account's first shipment leaves | Legitimate interest |
| Fairness records: each draw's receipt, result and your seed periods | To prove that every draw was fair | Contract; legitimate interest in proving fairness |
| Support: what you write to us and our replies | To answer you | Contract; legitimate interest |
| Staff records: which of our staff looked at or changed your account, when and why | Security and accountability | Legitimate interest; legal obligation (security of processing) |
| Error reports: what broke on a page, with emails, tokens, payment ids, addresses and query strings removed before they are sent | To find and fix faults | Legitimate interest |
| Marketing, only if you accept it: with the Meta and TikTok pixels, the addresses of the pages you visit on N01 (never the sign-in, account, checkout or password pages), the shop steps you take and your purchases, with each company's own cookie ids (Meta's _fbp and _fbc, TikTok's _ttp), your browser and your IP address, which your browser sends with every request. If you are signed in, each purchase you make with card or deposited funds (the order id, the amount and the time) is also sent from our server to Meta, with Meta's cookie ids, your browser, your country and a one-way hash of your account id, and to TikTok, with TikTok's cookie id (_ttp), the TikTok ad click id you arrived with (ttclid), your browser and the same hash. Your sign-up is also sent to TikTok (not to Meta), once, if you accept Marketing within a day of confirming your email. Never your name, email, phone, card, address or IP address. We also keep, in our own database only and shared with no one, the ad tags of the address you first arrived with in the last 30 days (which ad, campaign and source, and whether an ad click id came with it, never the id itself), so we can count which of our ads led to sign-ups and first purchases. Accepting Marketing while signed in applies to your account: purchases you make on your other devices are sent too, until you turn Marketing off under Cookie settings on any device where you are signed in, or six months pass and the banner asks again | To learn which of our ads on Facebook, Instagram and TikTok lead to visits and purchases, so we spend on the ones that work | Consent, which you can withdraw at any time under Cookie settings |
| Visit counts, without cookies: the page you open, the site that sent you there (its name only) and our campaign tags in the link, your country, whether you use a phone, tablet or computer and which browser. We count visitors with a code made from your IP address and browser that changes every day and can't be traced back to them; we never store your IP address and nothing is kept in your browser | To know how many people visit, which pages they open and which of our posts and ads bring them | Legitimate interest |
| Waitlist: the email you give to join the waitlist for Phase 2, the page's language, your country as our host sees it, the consent you gave and when, and, if you accepted Marketing, the ad tags of your first visit. To limit how often the form can be sent, a one-way hash of your network and browser is kept for an hour. We keep your email until Phase 2 opens plus 30 days, or until you ask us to remove it | To email you when Phase 2 opens | Consent, which you can withdraw at any time by writing to us or with the unsubscribe link in that email |
| Analytics, only if you accept it: pages visited, clicks, page speed and a few shop steps, tied to a random browser id, never to your account, name, email, card or address | To learn which pages work and which don't | Consent, which you can withdraw at any time under Cookie settings |
To open an account you must give an email, a password and the 18+ confirmation, and to ship you must give an address. Without them we can't open the account or send the parcel. Everything else comes from using N01.
We don't sell your data or build marketing profiles of you, and we send no marketing email. We use data for advertising only as described under Marketing above, and only if you accept it.
03Automated checks
Some checks run automatically: card payment limits for new accounts, 3D Secure on every card payment, a restriction of an account that pays with a card already used on another account or uses more cards than its limit allows, a restriction after a lost card dispute, and a review before a bonus card from a flagged account is shipped or traded in. They are needed to sell to you safely. A restricted account can still sign in and see its cards and balances. A person decides every flagged bonus review, and you can ask a person to review any automatic restriction, give your view and contest it, by writing to support.
04Who handles data for us
These companies process personal data on our behalf, under data processing agreements, only for the purposes above:
| Company | What it does for us | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | EU (Ireland) |
| Resend | Sends our emails: sign-in and password links, order confirmations, receipts, refund and shipping updates | Sending in the EU (Ireland); its account data in the United States |
| Vercel | Hosts the website | Functions in the EU (Dublin); a global network delivers the pages |
| Stripe | Card payments, 3D Secure, refunds and disputes. Stripe is also an independent controller for its own fraud prevention and legal duties | Stripe Payments Europe (Ireland) |
| Sentry | Error reports from the website | EU (Germany) |
| PostHog | Website analytics, only if you accept Analytics | EU (Germany) |
| Zernio | Passes the purchase events described under Marketing to Meta, only if you accept Marketing | United States |
| Google Workspace | Our email: support and privacy messages | EU and other regions |
| Cloudflare | The Turnstile bot check on sign-up and sign-in | Global network |
| Google (Google Maps Platform) | Address suggestions while you type a delivery address. It receives only the text you type and the country you chose, through our server, never your name, email or account | United States and other regions |
Some of these companies, or their support teams and subprocessors, are in the United States or elsewhere outside the EU and EEA. Transfers there rely on the EU-US Data Privacy Framework where the company is certified, or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
Meta. If you accept Marketing, Meta Platforms Ireland Ltd receives the data described under Marketing. For collecting it with the pixel and passing it to Meta, the purchases our server sends included, we and Meta are joint controllers: we decide that it is collected for measuring our ads, and Meta decides how it is processed after that, under its own privacy policy (www.facebook.com/privacy/policy). Meta is responsible for its own processing, and you can use your rights with Meta as well as with us. Withdrawing Marketing under Cookie settings stops the pixel at once, deletes its cookies from your browser and stops any purchase not yet sent.
TikTok. If you accept Marketing, TikTok Technology Limited (Ireland) receives the data described under Marketing, from its pixel and from our server. For collecting it with the pixel and passing it to TikTok, the events our server sends included, we and TikTok are joint controllers: we decide that it is collected for measuring our ads, and TikTok decides how it is processed after that, under its own privacy policy (www.tiktok.com/legal/privacy-policy-eea). You can use your rights with TikTok as well as with us. Withdrawing Marketing under Cookie settings stops the pixel at once, deletes its cookies from your browser and stops any purchase or sign-up not yet sent.
Other recipients. The carrier that delivers your parcel receives your name and address. When a card we buy for you is sent straight from the marketplace seller we buy it from, that seller and the marketplace receive your name and delivery address; we record each time we do this. They use the data for the delivery as controllers in their own right. Stripe and your card issuer receive dispute evidence as described above. We give data to authorities only when the law requires it.
05What is public: the latest pulls feed and the fairness log
Latest pulls. The site shows recent pulls: the card, its N01 value and tier, the product, the minute it was drawn, and whether it was a bonus card. Next to a pull it may show your display name ("Collector" and a number), unless you have switched on Anonymous on your account page. It never shows your email, country, member number or anything else about your account.
Fairness log. So that anyone can check that draws are fair, every pool, draw receipt and result is published in a public, permanent log. The log names a customer only by a random code that changes with every seed period, so pulls can't be linked to you, or to each other across periods. It shows no name, email or payment. Because the log must stay unchanged to prove fairness, entries can't be removed from it. Nothing in it identifies you without our records, but a pull shown with your display name in the feed can be matched to its log entry.
06How long we keep data
- Account data: while your account is open. When you close it or ask us to erase your data, we delete your email, sign-in identity, addresses and support messages and keep an anonymous record in their place.
- Purchases and the ledger: seven years after the end of the year of the transaction, because Swedish bookkeeping law requires it, without your name or email once the account is erased.
- IP address and device details kept as payment evidence: 18 months after the latest of the payment, the last shipment of a card it paid for and the close of its last dispute. Then they are erased.
- Shipping addresses: for as long as the shipment, any complaint about it and the payment evidence for it need them, and no longer than the account.
- Daily Drop: the daily IP key is deleted after two days, after which the IP hash can no longer be linked to an IP address. Drops and their device hashes are kept while the account is open.
- Account checks: the network and device hashes are deleted after 12 months.
- Fairness records: for good, because they prove the draws, without your name or email.
- Support messages: while the account is open, and as long as a complaint or claim about them may still be raised.
- Marketing: a purchase or sign-up waiting to be sent to Meta or TikTok is kept until it is sent, and for at most 7 days if it can't be; every record of it is deleted after 90 days. The cookie ids we keep for your account (Meta's, TikTok's and the TikTok ad click id you arrived with) are kept while your Marketing choice is valid, at most six months from it, and deleted when you withdraw it. The ad tags of your first visit are kept with your account until you withdraw Marketing or your account is erased. What Meta and TikTok keep is set by their own policies.
- Visit counts: each page visit is kept for 30 days, then only daily totals stay. The daily code is made with a key that is deleted at the end of each day.
- Analytics: events are tied only to a random browser id, never to your account, and kept in PostHog's EU region only as long as they help us improve the site. Withdrawing consent stops new events at once.
07Your rights
You can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive the data you gave us in a machine-readable format. Where we rely on your consent you can withdraw it at any time. Write to privacy@n01.gg from the email on your account, so we know it's you. We answer within one month.
Much of your data is already on your account pages: orders, products, cards, wallet, shipments and fairness receipts.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or to the data protection authority where you live.
08Security
Account and payment data sit in a private part of our database that the website reaches only through checked functions. Every money movement is recorded in an append-only ledger. Our staff have access by role, and every view and change they make is logged. We never store card numbers. If a breach puts your data at risk, we tell you and IMY as the law requires.
09Children
N01 is for people 18 and over. If we learn that an account belongs to someone under 18, we close it, refund what was paid and delete the data we don't have to keep by law.
11Changes to this policy
When we change this policy we publish the new version here with its date, and tell you by email and on the site when the change matters to you.