Privacy Policy

1. Who We Are

onpack ("we", "us", "our") operates the onpack.io platform. We provide brands with digital product identity and consumer engagement tools. This policy explains how we handle personal data under the EU General Data Protection Regulation (GDPR).

2. What We Collect

For Consumers (people who scan products)

Account data: email address, display name (if you sign up)
Scan data: which product was scanned, timestamp, device type
Location data: approximate country, region and city derived from IP address (only if you accept cookies). This is not GPS or a precise address.
Points and redemption data: loyalty points earned, rewards redeemed, reward codes

For visitors to onpack.io

Site usage: which pages of this website were opened, the site that linked here, browser family and device type, and the country the request came from. If you accept cookies, we also record the approximate region and city. Recorded on our own server without a tracking cookie; your IP address is not stored. Deleted after one year.
Site analytics (DataFast): the same page-view data — page, referrer, language, timezone, screen size — sent by a script on the marketing pages to DataFast, which receives your IP address with the request and turns it into a pseudonymous identifier that changes daily. No cookie is set. This runs on onpack.io's public pages only, never on a product page you scan or in a brand's account.

For Brands (business accounts)

Account data: company name, email address, brand prefix
Signup security: we record signup timing, browser and IP location, email-provider characteristics and repeated submissions to detect automated registrations. An optional IP-reputation lookup identifies VPN/proxy networks. AI summarises these signals without receiving your full email address, raw IP, password or browser identifier. Accounts needing review can prepare a product catalogue while an onpack admin decides access. IP, city and browser details are removed after 90 days. You can request human review at [email protected].
Sign-in records: successful and failed sign-ins to a brand account are recorded for account security. Successful sign-ins include the time, IP address, approximate location and browser. Failed attempts against existing accounts include the time, IP address, approximate country, region and city, and the reason access was denied. Submitted passwords and 2FA codes are never stored in this history. Failed-attempt history is visible only to authorised onpack admins. IP addresses, city, region details and browser information are deleted after 90 days; country, date and outcome are kept for two years. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), account security.
Private demo security: for demo logins, we also record private-page requests (paths, not query strings or form contents), timestamps, account identity, IP address and approximate country/region, and the exact demo terms acknowledged. These records are available only to authorised onpack admins to secure demo access and investigate misuse (legitimate interests, Art. 6(1)(f) GDPR). Raw IPs are removed after 90 days, page history after one year and acknowledgements after two years. A necessary, first-party browser cookie remembers the acknowledgement for up to two years in trusted regions. Outside or unknown locations require acknowledgement at each login, unless an admin enables the exception for verified 2FA logins; an optional region restriction can instead prevent access. A shared account or IP address does not identify an individual. You may object to this processing by contacting us below.
Product data: SKU names, descriptions, batch quantities
Billing data: processed by Stripe; we do not store card numbers

3. Why We Collect It

To provide the service: generating codes, tracking scans, managing loyalty points (legal basis: contract)
To show analytics to brands: scan counts, geographic distribution, trends (legal basis: legitimate interest)
Optional visitor location analytics: region and city are collected with your cookie consent. The account-security records described above use a separate legitimate-interest basis.

4. Who Sees Your Data

Brands see aggregated scan analytics for their own products. They do not see individual consumer emails or names unless you explicitly claim a product or redeem a reward.
Service providers: Hetzner Online GmbH, Cloudflare, Inc., Cloudinary, Google Ireland Limited (Google Workspace), Stripe Payments Europe, Ltd. / Stripe, Inc., IPinfo, LLC, Anthropic, PBC, JustShipIt Pte. Ltd. (DataFast), and Functional Software, Inc. (Sentry). What each one does, where it sits and its transfer basis is set out at onpack.io/subprocessors.
Tags a brand switches on: a brand can add its own Google Analytics or Meta Pixel ID in its settings, and we then render that tag on that brand's collector pages. Both are off by default. The brand is the controller for whatever its tag collects; onpack receives nothing from either.
We never sell personal data.

4a. International Transfers

The platform and its database run in Germany, and everything that constitutes the product — accounts, product records, passports, scans, collector data — is stored there. 7 of the 9 providers above involve a transfer outside the EEA: the CDN in front of the site, outbound email, billing, an IP-to-country lookup, brand media storage, and the marketing site's analytics.

Each of those transfers rests on the Standard Contractual Clauses under Art. 46(2)(c) GDPR, incorporated in that provider's own data processing agreement. Where a provider is additionally self-certified under the EU–US Data Privacy Framework, we treat that as an alternative rather than a substitute for the clauses.

5. Data Retention

Account data: kept until you delete your account
Scan data: kept for 3 years, then anonymised
IP addresses: deleted or anonymised after 90 days

Brand accounts: closing a brand account takes its public product pages down immediately. The product records behind them — passports, published versions and supporting documents — are kept for at least a year afterwards, and longer while any production lot on record is still within its date of minimum durability. Packaging stays in circulation after a business relationship ends, and a product page that disappears while the jar is still on a shelf leaves a shopper with no ingredient or allergen information. Deletion after that point is carried out by a person, not automatically.

6. Your Rights (GDPR)

You have the right to:

Access your personal data
Correct inaccurate data
Delete your account and associated data
Receive a portable copy of your data (Art. 20). There is no self-serve export button yet — email the address below and we will send a machine-readable copy within one month.
Withdraw consent for location tracking at any time (clear the onpack_consent cookie or decline in the banner)
Object to processing based on legitimate interest

To exercise these rights, email [email protected].

7. Cookies

onpack_consent: stores your cookie preference (accepted/declined). Expires after 1 year.
Session cookies: required for login. Cleared when you close your browser or sign out.

We do not use third-party tracking cookies, advertising pixels, or analytics tools that track you across websites.

Nor do we load fonts or stylesheets from a third-party CDN on the pages you visit. Our typefaces are served from onpack.io, so reading this site does not disclose your IP address to anyone we have not named above. Two exceptions, both named above: the cookieless DataFast analytics script on the marketing pages, and our investor deck at /pitchdeck, which loads its presentation library from a public CDN.

8. Security

All data is encrypted in transit (TLS) and at rest. API tokens are stored as hashed values. We use role-based access controls and conduct regular security reviews.

9. Contact

Data Controller: Onpack GmbH, Nibelungengasse 1, 1010 Vienna, Austria
Email: [email protected]
Full corporate identification: onpack.io/impressum

We have not appointed a Data Protection Officer. Art. 37 does not require one of a company of this size and processing profile, and naming a placeholder would be worse than saying so. Data protection enquiries go to the address above and are answered within two working days.

Brands: the Art. 28 processing terms are at onpack.io/dpa and apply automatically to every brand account.

If you believe your data rights have been violated, you may lodge a complaint with your local data protection authority. In Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna.