Privacy Policy

1. Who we are

packpat (“we”, “us”) provides a web service for designing and ordering custom packaging. We decide how and why your personal data is used. Contact us about privacy at [email protected].

2. What we collect

• Account: your email address, and your name if you sign in with Google. We never receive your Google password.
• Your designs: text, logos, images and design files you enter or upload, and the prompts you give the AI.
• Orders: recipient name, delivery address, email, optional phone number, order contents, quote and status, tracking number, and messages about the order.
• Payments: handled by Stripe. We receive the status, amount and a reference, not your card number.
• Membership and AI usage: membership and voucher status, AI feature, provider, timestamp, outcome and allowance usage.
• Technical data: IP address, browser type and device information, used to keep the Service secure, limit abuse and diagnose errors. Our rate limits use a keyed hash of your IP address rather than the address itself.
• Messages to us: emails you send to support.

Where the law of your country requires it (for example the EU, the UK, Switzerland, South Korea and Canada), we ask first and record page and feature usage for product analytics, and separately remember ad-click identifiers, only with your permission. In countries where an opt-out is enough (for example the United States, Japan, Singapore, Australia and New Zealand) we do this from your first visit unless you opt out, and we never remember ad-click identifiers if your browser sends a Global Privacy Control signal. Use Privacy settings to change either choice at any time. AI usage logs are used to enforce allowances and diagnose failures.

3. How we use it, and why

We do not sell your personal data. We do not use Your Content to train AI models.

4. Who processes your data

We use these service providers (“processors”) and share only what each needs:

• AI generation: Google (Gemini) and fal.ai process the prompts and images you send for AI features, to generate or edit artwork, read text or build 3D models. See Section 6.
• Payments: Stripe processes card payments and refunds.
• Sign-in: Google, if you choose “Continue with Google” (see Section 5).
• Email: a mail provider (Microsoft Outlook) sends sign-in codes and order emails.
• Hosting and delivery: our servers run on Tencent Cloud in Singapore.
• Manufacturing and shipping partners: receive your design and print files, delivery name, address and phone so they can make and deliver your order.

We may also disclose data where the law requires it or to protect rights and safety.

5. Google user data

If you choose “Continue with Google”, we ask Google for only the basic sign-in scopes openid, email and profile. We do not request access to your Gmail, Drive, Calendar, Contacts or any other Google service data, and we do not receive your Google password.

• What we access and store: your email address, your name, and Google’s account identifier for you. We do not store a Google access or refresh token.
• How we use it: only to create your packpat account, sign you in, show your name, and send order emails to your address.
• Sharing: we do not sell it, share it with advertisers or data brokers, or use it for advertising. It is shared only with the processors listed above that need it to run the Service (for example our email provider, and Stripe for receipts), or where the law requires.
• AI: your Google account data is never sent to AI providers and is never used to train or improve AI models, ours or anyone else’s.
• People: our staff do not read it except to give you support, to investigate abuse or security issues, or where the law requires.
• Deleting it: delete your account on the account page and the data we hold from Google is deleted as described in Section 9. You can also remove packpat’s access in your Google Account settings.

packpat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use AI

packpat uses generative AI to propose designs, generate and edit artwork, read text in images and build 3D previews. When you use an AI feature:

• What is sent: the prompt you write, and the images, logos, design faces and masks needed for that feature, are sent to our AI providers (Google Gemini and fal.ai). We do not send your account email, delivery address or payment data to them.
• No training on your content: we use the providers’ paid API services, under terms that do not allow them to use your prompts, uploads or results to train or improve their models. We do not train models on Your Content either. Providers may keep logs for a limited period to detect abuse and meet legal duties.
• Do not upload sensitive data: do not put other people’s personal data, health, financial or other sensitive information in prompts or images.
• No automated decisions about you: AI is used to create design content you review and approve. It is not used to make legal or similarly significant decisions about you.
• AI can be wrong: AI output may contain errors or resemble existing works. You review every proof before ordering. See our Terms.
• Usage records: we log which AI feature was used, the provider, time and outcome to enforce allowances and diagnose failures.

7. International transfers

packpat is used from many countries. Your data is stored in Singapore and may be processed by providers in other countries, including the United States and China (for manufacturing and shipping partners). When your order is delivered, your delivery name, address and phone are also available to the carrier and to customs in the destination country. Where the law requires safeguards for such transfers, we rely on contractual protections with those providers.

8. Cookies and local storage

These cookies and storage entries keep the Service working:

• pf_session (named __Host-pf_session on secure connections): keeps you signed in (HttpOnly, up to 30 days, renewed while you use it).
• paperfold_ai: a short-lived signed token that lets guests use AI features within fair limits.
• pf_oauth: a 10-minute token used during Google sign-in.
• Your browser’s local storage and IndexedDB hold your draft designs, pictures and a list of your orders on this device.

These are strictly necessary, so we do not ask for consent to set them. With your permission (or, in opt-out countries, until you opt out), the pf_metrics cookie supports optional analytics or ad measurement. Clearing site data removes drafts saved only on your device.

9. How long we keep it

• Sign-in codes: 15 minutes to use, then deleted shortly after they expire.
• Sessions: up to 90 days from sign-in, or until you sign out.
• Account (including the name and email we received from Google) and saved designs: until you delete your account, when we delete them within 30 days (backups are overwritten on their normal cycle). Optional analytics is kept for up to 90 days and ad-click identifiers for up to 30 days.
• Orders and invoices: for as long as needed to fulfil the order, handle claims and meet tax and accounting rules. After you delete your account, orders are kept without a link to you.
• Support emails: as long as needed to help you and handle follow-ups.

10. Your choices and rights

From your account page you can download your data and delete your account. Depending on where you live (for example under GDPR or UK GDPR, or California’s CCPA) you may also have the right to access, correct, delete, restrict or object to the use of your personal data, to data portability, and to complain to your data protection authority. To use a right we do not offer in your account, email [email protected]. We may need to verify it is you. You can ask us to stop sending order updates, but we will still send essential messages about an order in progress.

11. Security

We use encryption in transit, hashed sign-in tokens and sessions, access limits and rate limiting, and keep payment card data off our systems. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

12. Children

packpat is for businesses and adults. It is not directed at anyone under 18, and we do not knowingly collect their data.

13. Changes

We may update this policy. If a change is material, or if we want to use Google user data in a new way, we will tell you by email or in the Service and ask for your consent where required. The date at the top shows when it last changed.