Privacy Policy

01 Introduction & scope

This Privacy Policy ("Policy") describes how Calyx Containers LLC and its affiliates, operating the PackOS marketing website, the Quick Quote tools, and related packaging services (collectively, the "Services," and "PackOS," "we," "us," or "our"), collect, use, disclose, and protect Personal Information, and the choices and rights available to you. For the purposes of the GDPR, Calyx Containers is the controller of Personal Information processed through the Services except where we act as a processor on a customer's behalf under a separate agreement, in which case that customer's instructions and privacy notice govern and this Policy is secondary.

This Policy applies to Personal Information we process through the Services. It does not apply to third-party products, services, or websites, which are governed by their own privacy notices, nor to de-identified or aggregated information that is not reasonably capable of identifying you. By using the Services, you acknowledge this Policy. Where consent is a legal requirement, we obtain it separately.

02 Definitions

Capitalized terms have the meanings given below or where first used:

• Personal Information (or "personal data") — information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual or household, as defined by applicable law.
• Processing — any operation performed on Personal Information, whether or not by automated means.
• Sensitive Personal Information — categories treated as sensitive under applicable law (e.g., government identifiers, precise geolocation, account credentials). We do not seek to collect Sensitive Personal Information through the Services.
• Your Content — files and materials you submit, including artwork, dielines, specifications, invoices, and prior quotes.
• Service Provider / Processor / Sub-processor — a third party that processes Personal Information on our behalf and under our instructions.
• Sale and Share — have the meanings given under the CCPA/CPRA (Section 9).

03 Personal Information we collect

3.1 Information you provide

• Account & contact details — name, work email, company, role, and, for enterprise requests, the packaging environment details you enter (categories, SKU bands, facilities, systems, timeline).
• Your Content — the files you upload so we can detect the packaging, prepare proofs, and produce quotes.
• Communications — messages, support requests, survey responses, and, where you use the optional voice intake, the spoken input you provide (processed live; see Section 6).
• Payment information — where paid features apply, billing details processed by our payment processor; we do not store full payment card numbers.

3.2 Information collected automatically

• Device & connection data — IP address, browser and device type, operating system, and language.
• Usage data — pages and features viewed, actions taken, dates/times, and referring URLs.
• Cookies & similar technologies — as described in Section 7.
• Approximate location — derived from IP address (not precise geolocation).

3.3 Information from third parties

We may receive limited information from analytics providers, our affiliates, and business partners who refer you, and from service providers that help us secure the Services (e.g., fraud and abuse prevention).

3.4 Categories of Personal Information (CCPA/CPRA)

In the preceding 12 months we have collected the following statutory categories:

We do not use or disclose Sensitive Personal Information for purposes that would require a right to limit under the CPRA. We do not knowingly collect Personal Information from minors (Section 15).

04 How we use Personal Information

We use Personal Information to:

• Provide the Services — detect packaging, render proofs, and generate quotes, specifications, and packouts.
• Respond to quote, enterprise-preview, and support requests and communicate with you.
• Operate, maintain, secure, debug, and improve the Services and develop new features.
• Personalize your experience and remember your preferences.
• Measure and analyze usage and the performance of our marketing.
• Prevent, detect, and respond to fraud, abuse, security incidents, and unlawful activity.
• Comply with legal obligations and enforce our terms and agreements.
• With your consent, send product updates and marketing you can opt out of at any time.

We may create and use de-identified or aggregated information for any lawful purpose; we maintain such information without attempting to re-identify it except to test de-identification.

05 Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, you may object as described in Section 14. Withdrawing consent does not affect processing carried out before withdrawal.

06 Your files & content — special handling

Your Content receives heightened protection because it is unreleased commercial work:

• Private storage. Your Content is stored in a private cloud vault — no public buckets, no public objects, no directory listings — with access on a need-to-know basis using time-limited internal links.
• Voice intake. The optional voice assistant streams over an encrypted session established with a short-lived key; we retain no recording and no transcript — only the values that populate the form you review.
• Deletion. You may request deletion of Your Content at any time; see Sections 11 and 14.

Technical detail is described on our security page.

07 Cookies & similar technologies

We and our providers use cookies, pixels, local storage, and similar technologies. The categories are:

We use Hotjar by Contentsquare on public marketing pages, and on the landing page of our quote tool, unless you disable analytics, to understand clicks, scrolling, and page use through heatmaps and session replays. In the quote tool, everything outside the landing page's own marketing content — the quote, the checkout and the file you upload — is recorded with its text masked, so names, file names and addresses are not captured; it is not loaded on links that open a saved quote, review, or file, nor in Vault or the staff application. Input values are suppressed everywhere. We do not send account identities or customer artwork to Hotjar. You can disable analytics using Cookie settings. Hotjar also honors Global Privacy Control and Do Not Track.

We use Google Analytics on our public pages, the quote tool and the Vault order page unless you disable analytics, to understand how the Services are used and which campaigns bring visitors. It receives the page address with only campaign parameters (never a quote, file or review reference), the quote and order steps listed below for the Meta Pixel, and identifiers such as a cookie ID and your IP address. Disabling analytics in Cookie settings, Global Privacy Control, or Do Not Track stops it setting or reading cookies; the Google tag may still send Google a cookieless signal that a page was viewed. Under the same controls, Google's advertising cookies are also used, so that Google Ads can measure our campaigns and show our ads to people who visited.

We use the LinkedIn Insight Tag on the same pages as the Meta Pixel, under the same controls, to measure our advertising on LinkedIn and build advertising audiences. It sends LinkedIn the page you visit and identifiers such as cookie IDs, your IP address and browser details. It is not loaded on links that open a saved quote, review, or file, nor in Vault or the staff application, and we do not send it form contents, email addresses, account identities, or customer artwork. Disabling analytics in Cookie settings, Global Privacy Control, or Do Not Track keeps it from loading.

We use the Meta Pixel on the same public marketing pages, and on the landing page of our quote tool, under the same controls, to measure the performance of our advertising on Meta platforms and to build advertising audiences. It sends Meta the page you visit and identifiers such as cookie IDs, your IP address and browser details. It also reports the steps that show whether an ad worked: a contact, enterprise, newsletter or download form sent, a file uploaded, a quote shown, a quote emailed, a meeting booked, a checkout started and an order placed, with at most the product type, the quote value and our order reference. In the quote tool it is not loaded on links that open a saved quote, review, or file, and it does not record clicks. When you place an order from a saved quote in Vault, we send Meta that one order step, using the cookie identifier the Pixel already set and without the page's address or quote reference; the Pixel itself is not loaded in Vault or the staff application. We do not send it form contents, account identities, or customer artwork, and we send email addresses and phone numbers only in hashed form, as described below. We also send the lead and order steps to Meta from our servers, and, when an order is won, its value, with the same cookie identifiers, IP address and browser details, so that they are counted when a browser blocks the Pixel; this happens only for browsers where the Pixel is allowed. For visits that came from a Google ad, we report the same steps and the value of a won order to Google Ads against the ad click identifier. Disabling analytics in Cookie settings, Global Privacy Control, or Do Not Track keeps it from loading, and disabling analytics while a page is open revokes it on that page.

Matching by hashed email and phone, and advertising audiences. When you give us your email address or phone number to receive a quote or to place an order, and your browser allows advertising measurement (analytics is not disabled, and it sends no Global Privacy Control or Do Not Track signal), we convert them into a one-way code (a SHA-256 hash) and send only that code, never the address or number itself, to Meta with the lead and order steps above, and to Google Ads with those steps and the value of a won order. Meta and Google compare the code with their own users' so that a quote or an order can be counted against the ad that led to it, including an ad you saw on another device. We keep these codes for a browser for 95 days so that a later step can be matched. We also use them to build customer lists that we upload to Google and Meta, to show our ads to people who asked for a quote and have not ordered, and to leave existing customers out of ads meant for new ones; these lists contain only the hashed codes. Disabling analytics in Cookie settings, Global Privacy Control, or Do Not Track before you give us your email stops this for that browser, and a browser that later opts out is left off our lists. You can also ask us to stop at any time using the contact details below.

Recognising you across devices. Under the same conditions, when you give us your email for a quote, place an order, or sign in, we store a cookie (packos_uid, up to 400 days) holding an identifier we derive from your email with a secret key. It is not your email and cannot be turned back into it. We give it to Google Analytics as a user ID, and to Meta in hashed form, so that your visits on different devices are counted as one person's. It is never set for our staff, and disabling analytics removes it.

You can control cookies through your browser and, where offered, our cookie controls. We honor Global Privacy Control (GPC) and similar opt-out preference signals where legally recognized, and we treat a valid signal as a request to opt out of any "sale"/"share" for that browser or device. Because there is no common standard, we may respond to browser "Do Not Track" settings via GPC handling.

08 How we disclose Personal Information

We disclose Personal Information only as follows:

• Service providers & sub-processors that process on our behalf under written terms limiting their use (see table below).
• Affiliates within the Calyx Containers group to operate and support the Services.
• Professional advisors (lawyers, auditors, insurers) under duties of confidentiality.
• Legal, safety & rights — to comply with law or valid legal process, enforce our terms, or protect the rights, property, or safety of PackOS, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor notice.
• With your direction or consent — for example, when you ask us to share a proof or quote.

This list may change as the Services evolve; a current list is available on request at privacy@packos.ai.

09 Sale and sharing of Personal Information

We do not sell your Personal Information for money. Our public marketing pages and the landing page of our quote tool use the Meta Pixel, the LinkedIn Insight Tag and Google advertising cookies (see Cookies), which disclose identifiers and internet activity to Meta, LinkedIn and Google for advertising, and we send Meta and Google hashed email addresses and phone numbers and customer lists of them (see Matching by hashed email and phone). Under the CCPA/CPRA that may be a "share" for cross-context behavioral advertising, or a "sale." You can opt out at any time with Cookie settings (disable analytics), or by sending a Global Privacy Control signal, which we treat as a valid opt-out for that browser or device. We do not knowingly sell or share the Personal Information of anyone under 16. Disclosures to service providers for the business purposes described above are not a "sale" or "share."

10 International data transfers

We are based in the United States and process information there and in other countries where we or our service providers operate. When we transfer Personal Information from the EEA, the UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA), together with supplementary measures where needed. You may request a copy of the relevant safeguards at privacy@packos.ai.

11 Data retention

We retain Personal Information only as long as necessary for the purposes in this Policy, then delete or de-identify it. We determine retention based on the criteria below:

Longer retention may apply where required by law, to resolve disputes, or to enforce agreements.

12 Information security

We maintain administrative, technical, and organizational measures designed to protect Personal Information appropriate to the risk — including encryption in transit and at rest, access controls, least-privilege and fail-closed design, logging, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our controls and the reasoning behind them are described on the security page.

13 Automated decision-making

The Services use automated processing to detect packaging and prepare estimates. These outputs are decision support: quotes are non-binding estimates that you review, and we do not make decisions that produce legal or similarly significant effects about you solely by automated means without a lawful basis and appropriate safeguards. Where such processing occurs and the GDPR applies, you may request human review.

14 Your privacy rights & choices

14.1 Available to everyone

You may access, update, or delete your account and contact information, request deletion of Your Content, and unsubscribe from marketing email using the link in any message or by contacting us.

14.2 EEA, UK & Switzerland (GDPR)

Subject to conditions and exemptions, you have the rights to: access; rectification; erasure; restriction of processing; data portability; objection (including to processing based on legitimate interests and to direct marketing); and to withdraw consent. You may lodge a complaint with your local supervisory authority. If we have designated an EU/UK representative, contact details are available at privacy@packos.ai.

14.3 California (CCPA/CPRA)

California residents have the rights to: know and access the categories and specific pieces of Personal Information collected; delete Personal Information; correct inaccurate Personal Information; opt out of any "sale" or "share" (note: we do neither); limit the use of Sensitive Personal Information (not applicable as described); and to non-discrimination for exercising these rights. We do not offer financial incentives for Personal Information. You may use an authorized agent, and you may appeal a decision by replying to our response.

14.4 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. We honor these rights as required and provide an appeal mechanism.

14.5 How to exercise your rights

Submit a request to privacy@packos.ai. We will verify your identity (and an agent's authority) before acting, respond within the timeframe the law requires, and will not discriminate against you for exercising a right. We may decline or limit a request as permitted by law and will explain our reasons.

15 Children's privacy

The Services are intended for business use by adults and are not directed to children under 16. We do not knowingly collect Personal Information from children. If you believe a child has provided us Personal Information, contact us and we will delete it.

16 Third-party links & services

The Services may link to or integrate third-party sites and services that we do not control. This Policy does not apply to them; review their privacy notices. We are not responsible for their practices.

17 Data breach notification

If we become aware of a security incident affecting your Personal Information, we will investigate and, where required by law, notify affected individuals and applicable authorities within the timeframes the law requires. Where we act as a processor for a customer, we will notify that customer without undue delay.

18 Changes to this Policy

We may update this Policy to reflect changes in our practices, technology, or the law. We will revise the effective date above and, for material changes, provide additional notice (such as a banner or email). Your continued use of the Services after an update takes effect constitutes acknowledgment of the revised Policy.

19 Contact, complaints & data protection

For privacy questions or to exercise a right: privacy@packos.ai. For security matters: security@packos.ai. By mail: Calyx Containers, Attn: Privacy, Salt Lake City, UT, USA. If you are unsatisfied with our response, you may have the right to complain to your local data protection authority.

This Policy is provided for transparency and general information and is not legal advice. Where we act as a processor under a customer agreement or where an enterprise data processing agreement is in place, that agreement governs to the extent of any conflict with this Policy.