Privacy & Cookies

1. Who we are

Puro Classico ("we") operates this catalogue. For privacy questions, reach us on our Discord.

2. What we collect

• Account: your email address, so you can sign in. If you use Google or Discord sign-in, we receive your email and a basic profile identifier from them.
• Your activity: the items you save and the comments you post. Members' saved items and opened finds are also counted together anonymously to suggest related finds, using only pairs of finds that at least three members share.
• Usage: which product pages are opened (product, brand and category, linked to your account if you are signed in), used to rank popular items. We also count how many people are viewing the site right now, using a random identifier that is not linked to you.
• Emails: every new member gets a welcome email with the MyCNBox sign-up link and a how-to-order email. Newsletters, saved-item reminders and the MyCNBox reminder go only to members who ticked "Email me new drops & deals". Every email has an unsubscribe link, and you can also ask us to stop on Discord.
• Referrals: if you arrive through a referral link, we note which referral code brought you when you create an account.
• Buy clicks: when you tap a link to a shopping agent, we record the agent, the item, the page, your country (worked out by Cloudflare from your connection) and where your visit came from, such as a search engine, an app or a referral code, plus the campaign tag on the link you arrived through (for example "drop" on our Discord posts). We do not store your IP address or your account with it.
• Product page counts: when a product page loads, our server adds one to a daily count for that product, together with the kind of place the visit came from (such as Google, an email, Discord, TikTok, or no referrer) and the campaign tag on the link, if any. Nothing is stored on your device for this, and we do not store your IP address, your browser, your country, the full address you came from or your account with it. Search engines and other automated visits are not counted. These daily counts are kept for about 25 months.
• Site searches: when you search the finds, we record the words you searched (in lower case, cut to 80 characters), how many finds matched, whether you opened a find afterwards, and the kind of page. Searches that look like an email address, a phone number or a link are never sent. We do not store your IP address, your account or anything else about you with it, and we delete these rows after 30 days.
• Site statistics: Cloudflare Web Analytics counts page views and page speed. It sets no cookies and stores nothing on your device.
• Technical: standard server and security data (such as IP address) processed by our hosting provider.

We do not collect payment details. Purchases happen entirely on your agent's site.

Why we use it: your account, the emails that come with it and the buy links are needed to run the service you signed up for. Marketing emails rely on your consent, which you can withdraw at any time. View and click counts, statistics and security logs rely on our legitimate interest in running and improving the site.

3. Cookies and local storage

We use only what the site needs to work, plus a referral cookie when you use a referral link:

Sign-in	Set by our authentication provider (Supabase) to keep you logged in.
Referral (pc_ref)	A first-party cookie set only when you open a referral link (/r/…). It stores the referral code for 30 days so the referrer can be credited.
Preferences	Your language, currency, theme, saved items, email choice and whether you closed the sign-up window are stored in your browser (local storage). If you arrive through a link with a referral code (?ref=…), that code is kept there too, so the referrer can be credited if you sign up. For the Swipe Finds feed (/feed) and the "For you" sort, your last 40 searches, the last 150 finds you opened and how long you looked at each, your last buy clicks, the finds whose QC photos you looked at, the finds you rested the mouse on, the finds that were on screen that you did not open, the categories, brands, filters and sorts you picked, the finds you removed from your saved list, and your swipes and what the feed learned from them are kept there as well, so the feed and the "For you" sort can show finds you like. They never leave your browser; clear your browser storage, or use "Reset what it learned" in the feed, to delete them.
Visit source (pc.src, pc.cmp)	Kept in this browser tab only (session storage) and gone when you close it. It notes where this visit came from and the link's campaign tag, so buy clicks can be counted per source and campaign.

We do not currently use advertising or third-party tracking cookies. If that changes, we will ask for your consent first.

4. Who we share with

Service providers that run the site on our behalf: Supabase (accounts, database), Cloudflare (hosting, security, site statistics), Brevo (sends all our emails, so it holds every member's email address), qualit.ly (product and QC data; we send it no personal data), and Google or Discord if you choose their sign-in. We do not sell your data.

Shopping assistant: when you use the "Ask" chat, the messages of that conversation are sent to Anthropic, which runs the AI model that writes the answers. We save each question and answer so we can improve the assistant: the text of your question (with email addresses and phone numbers blanked out), the answer, the find you were looking at, the finds the answer suggested, your chosen agent and currency, and a random conversation code. We do not save your IP address, your account or anything else that identifies you with it, and we delete saved chats after 6 months. Your browser tab also keeps the conversation (session storage) until you close the tab. Anthropic processes the messages to answer them and handles them under its own commercial terms and privacy policy. Do not type personal details such as your name, address or order numbers into the chat. To limit abuse we count messages per IP address for 10 minutes, using a one-way hash of the address and no message content.

5. Your rights

Under the GDPR you can request access to your data, correction, deletion, or a copy to take elsewhere, and you can object to certain processing. To exercise any of these, message us on our Discord. You can also delete your comments and saved items yourself while signed in, and you may complain to the Norwegian Data Protection Authority (Datatilsynet).

6. Keeping your data

We keep account data while your account is active and delete it on request. Comments remain until you or we remove them.

7. Children

The site is not directed at children under the age required for consent in your country.

8. Changes

We will post any updates on this page with a new date above.