Privacy Policy

1. Who we are

Packdroid provides browser-based software for generating packaging dielines. We are the data controller for the personal data described in this policy.

Packdroid is operated by INSOFTEN TEKNOLOJİ BİLİŞİM YAZILIM DANIŞMANLIK VE PAZARLAMA ANONİM ŞİRKETİ, a company registered in Türkiye. Our registered address is Başakşehir Mah. Nurettin Topçu Cad. Baytel Sitesi No: 23B İç Kapı No: 1 Başakşehir / İstanbul, and our MERSİS number is 0103145317700001.

You can reach us about anything in this document, including any request about your own data, at [email protected] or at the postal address above.

2. Data we collect

We collect only what the service needs to work. Specifically:

• Account details — your email address, an optional display name, and your password. Your password is never stored: we keep only an Argon2id hash of it, which cannot be reversed back into your password.
• Google sign-in (only if you choose it) — your Google account identifier, your email address, and your name, as supplied by Google. We request only the openid, email, and profile scopes. We never receive your Google password and have no access to your Gmail, Drive, Calendar, or contacts.
• Session data — a hashed session token, its expiry, your IP address, and your browser's user-agent string. The IP and user-agent let you see where your account is signed in and let you sign out a device you no longer recognise.
• Usage records — for each dieline you generate we record the template used, the dimensions and parameters you entered, and whether the render succeeded. This is what lets us reproduce and fix a problem you report.
• Problem reports — if you flag a template as producing wrong output, we store your description, the template, and the parameters that produced it.

3. Data we do not collect

• We do not store your password in a readable form, and nobody at Packdroid can see it.
• We do not collect or store payment card details. Subscriptions are sold by Paddle.com Market Ltd. as merchant of record, and it takes card details directly; they never reach our servers. We receive only the customer identifier, the plan bought, and its status.
• We do not sell your personal data, and we do not share it for advertising.
• We do not claim ownership of the dielines you design. See our Terms of Service.

4. Why we use it, and our legal basis

Each purpose below is followed by the legal basis we rely on for it, as the GDPR and KVKK require. Where the basis is your consent, you may withdraw it at any time, and withdrawing it does not affect what we did before you did so.

• To create and secure your account, and to keep you signed in — necessary to perform our contract with you.
• To send account emails: confirming your address, and resetting your password. These are transactional messages, not marketing — necessary to perform our contract with you.
• To generate, render, and deliver the dieline files you ask for — necessary to perform our contract with you.
• To investigate and fix incorrect template output that you or another customer reports — our legitimate interest in selling geometry that is correct, which we weigh against the little personal data a problem report contains.
• To protect the service against abuse — rate limiting sign-in attempts, for example, so nobody can guess their way into your account — our legitimate interest in keeping the service and your account secure.
• To measure which parts of the catalogue and studio are used, through Google Analytics — your consent, given on the cookie banner and withdrawable from “Cookie settings” at the foot of every page.
• To keep the sales, invoicing and tax records the law requires of us — a legal obligation.

5. Cookies

We use as few cookies as we can. The strictly necessary ones keep you signed in, secure that sign-in, remember your cookie choice, and let our payment provider take a payment; they cannot be turned off without breaking the service.

Everything else is opt-in. Google Analytics measures which parts of the catalogue and studio people use, and it does not load at all unless you allow it on the banner shown on your first visit. You can change or withdraw that at any time from the “Cookie settings” link at the bottom of every page — no analytics data is collected before you accept, or after you withdraw.

The Cookie Policy lists every cookie and browser storage key by name, with its purpose and how long it lasts.

6. Who we share it with

We use the external services below, and only for the purposes given. No count is stated here on purpose — a number is one more thing to go stale when a supplier changes.

• Hetzner Online GmbH — hosts the servers, so it holds everything described on this page. Our servers are in Helsinki, Finland, inside the European Economic Area.
• Paddle.com Market Ltd. — sells every Packdroid subscription as merchant of record. It takes your payment details directly; card numbers never reach our servers and we never store them. Because Paddle is the seller rather than a supplier acting on our instructions, it decides on its own account what it does with the billing data, and its own privacy notice covers that.
• Resend — delivers our account emails (address confirmation and password reset). Resend receives your email address and the contents of those messages. Our sending region is the EU (Ireland).
• Cloudflare — sits in front of the site to serve it quickly and absorb attacks. Every request passes through it, so it processes your IP address in transit.
• Google — if, and only if, you choose to sign in with Google. Google tells us your account identifier, email, and name. Separately, Google Analytics receives usage measurements as described above.
• We may also disclose data where the law requires it, or to protect the rights and safety of our users.

7. How long we keep it

• Account data — for as long as your account exists.
• Sessions — 30 days, then they expire and are deleted automatically.
• Email confirmation links — 24 hours. Password reset links — 1 hour. Both are single-use and only the hash is stored, so a copy of our database would not let anyone reset your password.
• Usage records and problem reports — kept while they remain useful for fixing the templates they describe.

8. How we protect it

• Passwords are hashed with Argon2id, the algorithm currently recommended by OWASP for password storage.
• Session tokens and email links are stored only as SHA-256 hashes. Even a full database disclosure would not yield a working session or a usable reset link.
• All traffic between your browser and Packdroid is encrypted with TLS.
• Changing your password immediately signs out every other device, so a reset actually ends an intruder's access.

9. Your rights

Under the GDPR and, in Türkiye, under KVKK (Law No. 6698), you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable format.

To exercise any of these, email [email protected]. We will respond within 30 days. If you are unhappy with our response you may complain to your local data protection authority — in Türkiye, the KVKK Authority (KVKK Kurumu).

10. International transfers

Our email provider processes messages in the European Union. Google may process sign-in and analytics data outside your country under its own safeguards. Where data leaves the EEA or Türkiye, it does so under the legal transfer mechanisms those regimes require.

11. Children

Packdroid is a professional tool for packaging design and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. For significant changes we will tell you by email.