Privacy Policy

1. Who we are

Repackd Ltd ("Repackd", "we", "us") is a UK-registered company providing AI-powered packaging compliance software. Our registered address is 4th Floor, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We are the data controller for personal data processed through our platform. For questions about this policy, contact us at privacy@repackd.com.

2. What data we collect

Account data

When you sign up, we collect your name, email address, company name, and role. This is necessary to create and manage your account.

Packaging data

You provide packaging information including material types, weights, component structures, and supplier details. This is the core data required to deliver our compliance services (RAM assessments, DEFRA reporting, fee calculations).

Usage data

We collect information about how you use the platform, including pages visited, features used, and actions taken. This helps us improve the product and support you better.

Documents

If you upload documents for AI extraction, we process them to extract packaging data. Documents are processed by Google's Gemini API and are not retained by Google after processing.

3. How we use your data

• Service delivery — Running RAM assessments, generating DEFRA CSV exports, calculating fees, and providing compliance insights
• Communications — Sending transactional emails (submission confirmations, export notifications), compliance deadline reminders, and product updates
• Improvement — Analysing aggregate, anonymised usage patterns to improve our platform and RAM assessment accuracy
• Support — Responding to your queries and providing technical assistance

We never sell your data. We never use your packaging data to train AI models. Your compliance data is yours.

4. Legal basis for processing

• Contract performance — Processing your packaging data is necessary to provide the services you've signed up for
• Legitimate interests — Usage analytics and product improvement, where this doesn't override your rights
• Consent — Marketing communications (you can opt out at any time)
• Legal obligation — Where we're required to retain data by law

5. Data storage and security

Your data is stored on Neon (PostgreSQL database) with servers located in the EU (Frankfurt). All data is encrypted in transit (TLS 1.3) and at rest (AES-256).

We implement industry-standard security measures including:

• HMAC-signed session tokens for authentication
• Rate limiting on all API endpoints
• Input validation and sanitisation on all user-submitted data
• Regular security reviews and dependency audits
• Role-based access controls

6. Data sharing

We share data only with the following processors, all of whom are bound by data processing agreements:

• Neon (EU) — Database hosting
• Vercel (US, with EU processing) — Application hosting and edge functions
• Resend (US) — Transactional email delivery
• Google Gemini API (US) — Document extraction and AI column mapping (data not retained by Google)

Where data is processed outside the UK/EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

7. Data retention

• Account data — Retained while your account is active, deleted within 30 days of account closure
• Packaging data — Retained while your account is active. We recommend keeping at least 4 years of data for DEFRA audit purposes
• Uploaded documents — Processed and metadata retained; original document data is not stored long-term
• Audit logs — Retained for 2 years for compliance and security purposes
• Email logs — Delivery metadata retained for 1 year

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data (we can export everything we hold)
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent for marketing communications at any time

To exercise any of these rights, email privacy@repackd.com. We'll respond within 30 days.

9. Cookies

We use a single essential cookie (session-token) to keep you logged in. This is strictly necessary for the platform to function and does not require consent. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

10. Changes to this policy

We may update this policy from time to time. We'll notify you of material changes by email and update the "last updated" date above. Continued use of the platform after changes constitutes acceptance.

11. Contact & complaints

For privacy queries: privacy@repackd.com

If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.