This Privacy Policy describes how Novaxcarry (NOVA LAB COMPANY LIMITED, 1st Floor, 202 Le Lai, Ben Thanh Ward, Ho Chi Minh City, Viet Nam) processes personal data when you browse, purchase, or contact support. NOVA LAB COMPANY LIMITED is the data controller.
Data we collect
- Account & order: email, Discord handle (optional), order configuration, payment references
- Credentials you submit to the vault for hands-off services (encrypted, access-logged, retention-limited)
- Technical: IP, device/browser basics, cookies/consent where required
- Support: ticket messages and attachments you send
- Marketing: UTM/referral parameters stored on the order snapshot
How we use data
- Fulfill orders and communicate status
- Prevent fraud and abuse
- Improve the Service and measure ads performance (with consent where required)
- Comply with legal obligations
Legal bases
- To perform the contract with you: orders, payments, delivery and support
- Our legitimate interests: fraud prevention, security, improving the Service and defending claims
- Your consent: analytics and advertising measurement tags (see Cookies and similar storage)
- Legal obligations: tax, accounting and lawful requests
Sharing
We share data with payment providers, infrastructure vendors, and the PROs assigned to your order strictly as needed to fulfill your order. We do not sell personal data.
Processors and recipients
- Payment providers: the provider you choose at checkout (for example NOWPayments for crypto; card and local-method providers as they go live). They receive what the payment needs and process it under their own privacy terms
- Hosting: Hetzner Online GmbH
- Email delivery: Google Workspace (Google LLC / Google Ireland Ltd), for order, sign-in and support messages
- Error monitoring: GlitchTip (self-hosted, Sentry-compatible), with personal data scrubbed
- Analytics and advertising measurement, only with your consent: Google Tag Manager, Google Analytics 4 and Google Ads (Google Ireland Ltd / Google LLC), Meta Pixel (Meta Platforms Ireland Ltd), TikTok Pixel (TikTok Technology Ltd), and our self-hosted analytics (Umami) when enabled
- Discord, if you join our server or link your Discord account
- The PRO assigned to your order: your character name and, for hands-off orders, the credentials you place in the vault, shown to that PRO only while the order is active
International transfers
Our team and PROs work mainly from Viet Nam; our servers and most providers are in the European Union and the United States. Where data leaves your country we rely on the provider's standard contractual clauses or an equivalent safeguard, and on the minimum data needed for each purpose.
Retention
Order and payment records are kept as required for operations and compliance. Vault credentials follow a short retention schedule after order completion. You may request deletion of account data subject to legal holds.
Cookies and similar storage
- Necessary, no consent needed: your consent choice (novax_consent_v2), the checkout snapshot, order access tokens, language and currency preferences, the referral code (30 days) and the campaign parameters of the link you arrived on (90 days)
- Analytics, with consent: Google Analytics cookies (_ga, _ga_*); Umami when enabled (no cookie)
- Advertising measurement, with consent: Google Ads (_gcl_au, _gcl_aw), Meta Pixel (_fbp, _fbc), TikTok Pixel (_ttp)
- Withdraw at any time with Cookie settings in the footer
Your choices
Where required, we show a consent banner before non-essential tags. You can update notification preferences in your account when that feature is enabled. At checkout you can tick a box to get season-start offers and guides by email; it is off unless you tick it, we record when you opted in, and you can unsubscribe at any time with the link in every such email or in your account notification settings. Contact support to exercise access/deletion requests. You can ask for access, correction, deletion, restriction or portability of your data, or object to processing, by emailing the privacy address below. Residents of the EU and the UK may also complain to their supervisory authority.
Children
The Service is for adults. We do not knowingly process data of anyone under 18; contact us and we will delete it.
Contact
Privacy requests: privacy@novaxcarry.com.