PackD — Privacy Policy

Last updated: August 30, 2026

This Privacy Policy explains how DNZ Labs Xolo Go OÜ ("PackD," "we," "us") collects, uses, and protects personal data in connection with the PackD platform (app.packd.pro) and the packd.pro website.

1. Who we are

PackD is operated by:

DNZ Labs Xolo Go OÜ
Paju tn 1a, 50603, Tartu Maakond, Estonia
VAT: EE102156920

We are the data controller for the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR), except where noted in Section 4a below.

2. What data we collect

Depending on how you interact with PackD, we collect:

• Account data — name, work email, and role, when your organization (a "Tenant") sets up your account.
• Request Access form data — name, work email, company, WhatsApp number, and the other fields you submit when requesting access to PackD.
• Content you upload — packaging artwork files (PDFs), brand guideline documents, material specification documents, and any comments or notes you add within a project.
• Organization and contact data — information your organization records within PackD about its own clients, suppliers, or partners (company name, tax ID, address) and about individual contact people at those organizations (name, email, phone), to manage its packaging compliance workflow. See Section 4a for how we handle this category.
• External sharing data — if you share a compliance report through a PackD share link, we collect the recipient's email address (only if you choose to have PackD send the link automatically) and the name and comment text of anyone who submits feedback through that link.
• Usage data — basic technical logs (IP address, browser type, timestamps) generated automatically by our hosting infrastructure.
• Cookies — see Section 9.

We do not knowingly collect any special category of data (e.g. health, biometric, or similarly sensitive data). PackD is a B2B tool for packaging compliance and isn't intended to process this kind of data — please don't upload files containing it.

3. How we use your data, and our legal basis

4. Who we share it with

We share personal data only with the service providers ("sub-processors") that help us run PackD:

• Base44 — application hosting and infrastructure, and the underlying AI service used to power the PackD Copilot assistant (United States).
• OpenAI — AI-based processing of uploaded artwork (text and image analysis) to generate compliance findings (United States).
• Resend — transactional email delivery (notifications, Request Access confirmations, share link emails) (United States).
• Seshat — a sister regulatory-database service that PackD queries for regulatory citations relevant to your artwork. Seshat receives only the specific query needed to check compliance, not your account data.

We do not sell personal data, and we do not share it with anyone for their own marketing purposes.

4a. Data we process on your organization's behalf

For Organization/contact data and external sharing data described in Section 2, your organization decides what to record and with whom to share it — we process this data on your organization's instructions, acting as a processor, while your organization remains the controller for that data under GDPR. If your organization needs a separate Data Processing Agreement covering this, contact info@packd.pro.

5. International data transfers

Because several of our sub-processors (including Base44, OpenAI, and Resend) are located in the United States, personal data may be transferred outside the European Economic Area (EEA). Where this happens, we rely on appropriate safeguards recognized under GDPR — such as Standard Contractual Clauses, or the sub-processor's participation in an approved data transfer framework — to protect your data.

6. Data retention

We keep Tenant account and project data for as long as your organization's account is active. If an account is deactivated or terminated, we retain the associated data for 2 months, after which it's deleted — unless we're legally required to keep it longer.

7. Your rights

If you're located in the EEA, UK, or another jurisdiction with similar protections, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Request a copy of your data in a portable format
• Object to, or restrict, certain processing
• Lodge a complaint with your local data protection authority — in Estonia, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

To exercise any of these rights, email info@packd.pro. We handle these requests manually and respond as soon as we reasonably can.

8. Security

We rely on our infrastructure providers' security controls (access control, encryption in transit) and apply our own access restrictions within the PackD application — tenant isolation, and role-based permissions including granular, per-team custom Roles your organization's Admins can configure. No system is perfectly secure, and we can't guarantee absolute security.

9. Cookies

packd.pro uses a small number of cookies necessary for the site to function, and to remember that you've dismissed our cookie notice. We don't use third-party advertising or tracking cookies.

10. Children

PackD is a business-to-business service intended for use by working professionals. It's not directed at, and we don't knowingly collect data from, individuals under 18.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above.

12. Contact

Questions about this policy or your data: info@packd.pro