Terms of Service

1. The Service

onpack provides a platform for brands to generate unique product identifiers, track consumer engagement via QR code scans, and run loyalty and promotional programs. Consumers can scan products, collect them, earn points, and redeem rewards.

2. Brand Accounts

• You must provide accurate company information upon registration.
• You are responsible for all activity under your account, including API usage.
• Generated unit codes are unique and licensed to your account. You may not resell or transfer codes to third parties.
• You are responsible for the accuracy of reward descriptions and for fulfilling rewards to consumers.

3. Consumer Accounts

• You must be at least 16 years old to create an account.
• One account per person. Duplicate accounts may be merged or removed.
• Points and rewards have no cash value and cannot be transferred between accounts.
• We reserve the right to void points or rewards obtained through fraudulent activity.

4. Pricing and Billing

• Brand subscriptions are billed monthly in advance via Stripe.
• Unit overage is calculated monthly and billed at the end of each billing period.
• Prices may change with 30 days notice. Existing subscriptions are honoured until the next renewal.
• All prices are in EUR and exclude applicable VAT.

5. Acceptable Use

You may not:

• Attempt to enumerate, brute-force, or reverse-engineer unit codes
• Use automated tools to scan codes at scale without permission
• Create fake consumer accounts to manipulate loyalty points or promotion outcomes
• Use the platform for illegal products or deceptive promotions

6. Intellectual Property

Brand logos, product names, and descriptions remain the property of the respective brand. onpack retains ownership of the platform itself — including its software, design, infrastructure, and the algorithms used to generate codes. Brands receive a licence to use their generated codes for the duration of their subscription.

7. Data Ownership and Licence

You own your data. Brand owns all data generated through its account on the platform, including SKU information, batch records, scan events attributed to its products, points balances of consumers in relation to its brand, and redemption records of its rewards ("Brand Data").

You grant onpack a licence to operate and improve the service. Brand grants onpack a worldwide, royalty-free, non-exclusive licence to host, store, process, transmit, analyse, and create derivative works from Brand Data for the following purposes: (a) providing the service to Brand and its consumers; (b) operating, securing, and improving the platform; (c) generating aggregated and anonymised insights, benchmarks, and statistical models across the platform as a whole. This licence lasts for the duration of the subscription and, in respect of irreversibly aggregated or anonymised data, indefinitely thereafter.

What we will not do. We will never sell raw Brand Data to third parties. We will never share one brand's raw data with another brand. We will never expose a consumer's activity with one brand to a different brand on the platform — consumers are platform-level participants, and each brand only sees consumer activity within its own brand context.

Right to leave. Brand may terminate the subscription at any time (see §9). Upon termination, Brand may export all of its Brand Data via the API or admin interface. Brand may also request deletion of its Brand Data at any time by emailing [email protected]; we will delete it within 30 days, except for data that has already been irreversibly aggregated or anonymised, and except where retention is required by law (e.g. invoice records under tax law).

8. Consumer Data and Privacy

Consumer accounts (including email, display name, and cross-brand scan history) are owned and controlled by onpack as the data controller for consumer-facing services. Brands receive consumer-level data only in two cases: (a) aggregated and anonymised statistics about engagement with their own brand; (b) the minimum data needed to fulfil a reward when a consumer voluntarily redeems one (e.g. reward code and consumer ID). Brands never receive consumer email addresses or any data about consumer activity on other brands. See our Privacy Policy for full details.

9. Termination

• Either party may terminate with 30 days written notice.
• Upon termination, brand access is revoked and your public product pages stop serving content immediately. A code already printed and in market does not break: the URL responds with a permanent "withdrawn" status rather than a dead link, so a scanner is told the page is gone rather than that it never existed.
• The records behind those pages — passports, published versions and supporting documents — are kept for at least a year after termination, and longer while any production lot on record is still within its date of minimum durability. See § 5 of the Privacy Policy. Deletion after that point is carried out by a person, not automatically.
• We may suspend accounts for violation of these terms without notice.

10. Continuity

• If we stop operating. Should onpack cease to provide the service, we will give at least 90 days' written notice before any public product page stops resolving. Throughout that period your data remains exportable in full, and every published passport revision remains retrievable.
• Your data is portable by design. Every passport field, every published revision and every production lot is available to you at any time in machine-readable form, over the API and from the admin interface. Nothing in the product is stored in a format only we can read.
• The printed code. A GS1 Digital Link printed on packaging resolves through a domain we operate. You may request the full set of GTIN-to-content mappings needed to serve those codes yourself at any time, during the term or after it.
• What we do not promise. We do not hold source code in escrow, and we do not undertake to transfer the platform itself.

11. Availability

• Public product pages. We target 99.9% monthly availability for public product pages and the GS1 resolver — the URLs printed on your packaging.
• The brand application. We target 99.5% monthly availability for the brand dashboard and the API.
• Scheduled maintenance is announced at least 48 hours in advance and is excluded from both figures. We schedule it outside 07:00–21:00 CET wherever possible.
• These are targets we hold ourselves to, not a service-credit scheme. They do not create a financial remedy, and unavailability remains subject to § 12.

12. Liability

onpack is provided "as is". Our aggregate liability is limited to the amount paid by the brand in the 12 months preceding any claim. We are not liable for brand-side reward fulfilment, printing errors, or consumer disputes with brands.

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited or excluded under Austrian law.

13. Governing Law

These terms are governed by the laws of Austria. Disputes shall be resolved in the courts of Vienna, Austria.

14. Contact

Questions about these terms: [email protected]