Privacy Policy

Last updated: 16 September 2026.

Data controller

Tomeu Bestard Puig (NIF 43161263S), Balearic Islands, Spain. Privacy contact: info@packmize.com. Additional operator information is available in the Legal Notice.

1. Public calculator inputs

The public optimization engines run primarily in your browser. Dimension, weight and cut-list inputs are not intentionally sent to PackMize analytics. If you are signed in and explicitly click Save result, the selected calculator state, summary and compact result snapshot are sent to your private workspace so they can be reopened later. A shareable URL may contain calculation state in the browser URL fragment; fragments are not normally sent to the web server as part of the HTTP request.

2. Workspace account data

When you create a workspace, PackMize stores the name, email address, optional company name, password hash when you use password authentication, email-verification status, account timestamps and plan state required to operate the account. Passwords are not stored in plaintext. For email/password registrations, PackMize sends a one-time activation link that expires after 24 hours; the workspace cannot be accessed until the email address is confirmed.

If you choose Sign in with Google, Google provides PackMize with a verified email address, display name and a stable Google account identifier used to link the sign-in to your workspace. PackMize does not receive or store your Google password. An existing PackMize workspace may be linked automatically when Google confirms ownership of the same verified email address.

Workspace features may also store data that you enter voluntarily, including product/SKU names, references, dimensions, weights, categories, project/client labels, quantities, notes, saved calculation snapshots, saved scenario comparisons and user-entered cost assumptions. CSV/XLSX imports are staged temporarily in restricted server storage only while you map and confirm the import; staged import files are automatically discarded after a short expiry window. Do not upload information that you do not have the right to process.

3. Purposes and legal bases

Account and workspace data are processed to create and provide the service you request, authenticate and secure access, maintain your projects and saved results and respond to support requests. Where the GDPR applies, these activities are based, as appropriate, on performance of the service relationship or steps requested before entering it (Article 6(1)(b)), compliance with legal obligations (Article 6(1)(c)) and PackMize's legitimate interests in service security, abuse prevention, reliability and product improvement (Article 6(1)(f)).

After a successful registration, PackMize may send an operational new-account notification to its own administration mailbox. That notice contains basic account details such as user ID, name, email, optional company, plan and registration time; it does not include the password or raw network address. This is an internal operational/security notification, not marketing. PackMize does not use account registration by itself as consent to receive marketing communications.

4. First-party analytics and abuse prevention

PackMize records first-party aggregate page views and product events such as calculator opens, successful calculations, result sharing and workspace interest. This limited first-party measurement is operated on PackMize's legitimate interest in understanding service use, improving the product and detecting abuse, subject to the applicable right to object. The analytics endpoint stores the page path, coarse device/browser category, browser language, referrer hostname, and a country code only when the hosting/CDN supplies one.

Full IP addresses and raw user-agent strings are not intentionally stored in analytics. They may be processed transiently in memory to create rotating HMAC-based pseudonymous visitor/session hashes and to classify obvious crawler traffic; the raw values are then discarded from the analytics record. PackMize also respects the browser Sec-GPC: 1 and DNT: 1 signals at its optional browser analytics collector. Login, registration and administrator abuse controls also use pseudonymous attempt keys for short security windows rather than storing raw network addresses in those attempt records.

5. Cookies and local storage

The public site does not use advertising cookies or third-party analytics cookies. Registration, sign-in, password recovery, Google OAuth state protection, authenticated workspaces and protected administration areas use strictly necessary session cookies for CSRF protection, authentication and security. Temporary browser storage may also be used for interface behavior such as the PWA install prompt. Google may set its own cookies on Google domains when you choose Google sign-in; those are governed by Google's own terms and privacy information. See the Cookie Policy.

6. Payments

The current PackMize registration and workspace flow does not collect payment-card details or create a paid subscription. If payment processing is introduced, the applicable privacy and commercial information will be provided before payment details are requested.

7. Required and optional data

For an email/password workspace, the name, email address and password are required to create and secure the account; the company field is optional. For Google sign-in, the verified email address and Google account identifier are required for authentication, while the company field remains optional. If required account data are not provided, PackMize cannot create or authenticate the workspace. Public calculators remain available without an account where indicated.

8. Retention and deletion

Workspace data are retained while the account remains active, subject to any legal or security retention that may apply. The account page includes a self-service deletion control that permanently deletes the user record and associated product library, projects, saved calculation snapshots and saved scenario comparisons from the active application store. Security-attempt records are kept only for limited anti-abuse windows. Aggregate/pseudonymous analytics are automatically pruned after approximately 400 days and may be used during that period for trend, product and security analysis where they are not reasonably linked back to an identified workspace user. Infrastructure backups, where generated, may follow separate limited technical retention cycles and may not reflect deletion immediately until they are overwritten in the ordinary backup cycle.

9. Recipients, processors and international transfers

PackMize does not sell personal data and does not run behavioral advertising. Hosting, email-delivery and infrastructure providers may process the limited data technically necessary to provide those services on PackMize's behalf or under their applicable service terms. The new-account notification, email-verification messages and password-reset messages necessarily pass through the configured email infrastructure. If you choose Google sign-in, Google acts as the authentication provider and exchanges the account information described above with PackMize.

Depending on the infrastructure used by a service provider, processing may involve data transfers outside the European Economic Area. Where the GDPR applies, such transfers must rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, together with any supplementary measures required in the circumstances. Additional information about relevant providers and safeguards may be requested through the privacy contact above.

10. Automated decisions

PackMize's optimization engines generate mathematical planning outputs, but PackMize does not use workspace personal data to make solely automated decisions that produce legal effects or similarly significant effects on an individual. Tool outputs are planning aids and are subject to the Calculation Disclaimer.

11. Your rights

Where the GDPR applies, you may exercise the rights of access, rectification, erasure, restriction, portability and objection, and where processing relies on consent, the right to withdraw that consent without affecting prior lawful processing. Workspace users can update profile data, export product and calculation CSV files, and delete their account from the Account page. For additional requests contact info@packmize.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), aepd.es, or another competent supervisory authority.

12. Security and limitations

PackMize uses password hashing, session-cookie protections, CSRF controls, per-user authorization, anti-abuse rate limiting, pseudonymous analytics identifiers and restricted application storage. No Internet service can guarantee absolute security, so avoid storing unnecessary confidential, regulated or special-category personal data in workspaces. Security also depends on correct production server configuration, TLS/HTTPS, access permissions, backups and the security of the hosting and email providers actually used.