PackFlow EPR Privacy Policy

1. Overview & Data Minimization Commitment

PackFlow EPR ("PackFlow", "we", "our") provides packaging data calculation, volume aggregation, and statutory Extended Producer Responsibility (EPR) compliance reporting software for e-commerce merchants. We are committed to strict data minimization. We only collect and process data necessary to accurately determine packaging material fractions and fulfill statutory reporting obligations under European regulations (including German VerpackDG).

2. Information We Process

When a merchant installs and connects PackFlow EPR via Shopify, we process:

• Merchant & Store Information: Shopify shop domain (e.g. store.myshopify.com), merchant contact email (if provided), and OAuth authentication credentials. Access tokens are stored in AES-256-GCM encrypted format.
• Product Catalog Data: Product titles, variant IDs, SKUs, barcodes, and product dimensions/weights to enable packaging material mapping.
• Fulfillment & Shipment Data: Fulfilled order line quantities, product SKUs, and shipping destination country codes (e.g. DE) required to allocate packaging volumes to statutory jurisdictions.
• Statutory Registration Information: Merchant-provided ZSVR LUCID registration numbers, registered brand names, and Dual System operator contract IDs.

3. Shopper Personal Information (Consumer Data)

We minimize consumer personal data. PackFlow does not require, store, or sell shopper personal data. During fulfillment synchronization, order payloads are ephemeral in memory to extract product SKU quantities and the destination country code. Individual consumer names, email addresses, phone numbers, and physical residential street addresses are never stored in our persistent databases.

4. Infrastructure & Subprocessors

PackFlow utilizes enterprise-grade cloud hosting providers to operate our services:

• Vercel Inc.: Application frontend and serverless edge API execution.
• Neon Inc. (AWS us-east-1): Encrypted serverless PostgreSQL database storage.
• Shopify Inc.: Store authorization, product catalog ingestion, and fulfillment webhook delivery.

5. Cookies & Tracking Technologies

PackFlow uses strictly essential cookies only (specifically packflow_session) for merchant authentication and CSRF security token validation. We do not use advertising cookies, marketing pixels, or third-party behavioral trackers.

6. Shopify Privacy Webhooks & Data Deletion

We adhere fully to Shopify's Privacy and GDPR Webhook framework. When an app uninstall webhook (shop/redact) is received, all stored tokens, credentials, and merchant catalog links are automatically deactivated and scheduled for permanent database purge within 48 hours.

7. Merchant Rights & Contact

Merchants retain the right to access, rectify, or request deletion of their stored catalog and packaging configuration data at any time. For all data protection and privacy inquiries, please contact privacy@geniebhai.in.