Privacy Policy

PackFlow provides a branded customer portal for packaging manufacturers (“Vendors” — labels, pouches, cartons, corrugated) and their brand customers (“Customers”). The Vendor is the data controller for its Customer data; PackFlow acts as processor. This policy covers our marketing site and the portal app.

1. What we collect

• Account: name, work email, org, role, approval rights, last-active.
• Operational: SKUs, POs, forecasts, job cards, proofs viewed/approved, QC verdicts, deliveries, invoices, support tickets, documents you upload.
• Technical: auth sessions, audit timestamps, device/browser basics, error logs.
• Demo/contact: name, email, phone, company, message when you request a demo.

2. Why we use it

To run the portal (auth, org isolation, approvals, tracking, COAs, billing), secure and improve it, and — with consent — to contact you about demos. We never sell personal data and never show one Customer org’s data to another.

3. Sharing

Subprocessors: Supabase (database/auth/storage) and Vercel (hosting), region-pinned at onboarding. We share only what’s needed to operate, under DPAs. We disclose if required by law and will notify the Vendor unless prohibited.

4. Retention

Operational records are kept for the Vendor’s contract term + 3 years for audit/COA traceability (or longer where pharma/FMCG law requires). Marketing contacts until you unsubscribe. Backups roll off within 30 days of deletion.

5. Your rights

Access, correct, export, or delete your data via your Vendor admin or [email protected]. We respond within 30 days. Customers should first contact their Vendor (the controller).

6. Security

TLS in transit, encryption at rest, Supabase RLS org isolation, role-based approvals, private storage buckets. See /security.

7. Cookies

Essential auth/session cookies only. No advertising trackers. Any future analytics will be opt-in.

8. Children & grievance

Business tool — not for under-18s. Grievance / DPO: [email protected]. PackFlow is an Indian company; India DPDP Act 2023 applies; EU/UK GDPR addendum on request.

9. Changes

We’ll post updates here and notify Vendor admins for material changes.