Privacy Policy

1. Controller

Email: info@moritz-mergenthaler.de

2. Anonymous sessions

PackNavi can create an opaque anonymous-session identifier before an email address is provided. The browser sends this identifier to the API so that products, packaging scenarios, answers, progress and uploads can be stored server-side and returned only to the same authorized context.

“Anonymous” means that an account is not initially required; it does not mean that all associated data is necessarily anonymous under data-protection law. Submitted content or technical records may permit identification. The current application has no automatic product-defined expiry for anonymous sessions. This retention design must be finalized before production.

3. Email, accounts and authentication

When an email is saved, PackNavi stores the normalized address and a hash used for matching, creates or locates a user and organization association, and links only the current work as permitted. Existing profile data is not exposed without authentication.

For profile login, a six-digit OTP is sent by email, stored only as a one-way hash, limited to five failed attempts and valid for 30 minutes. After verification, PackNavi stores a hashed authentication-token record; the browser holds the corresponding token for up to 30 days. Local development can be configured for email-only login and is not the production authentication flow.

4. Products and packaging assessment

PackNavi processes product names and descriptions, dimensions, mass, materials, surfaces, packaging context, logistics, environmental exposure, quantities, process and automation information, regulatory context and other packaging requirements.

It also records progress, unknown or skipped fields, assistance use, confidentiality choices, revision relationships and timestamps. These data are used to preserve work, adapt the experience, calculate completeness and generate professional documents. Generic application logs are not intended to contain sensitive answer contents.

5. Images and documents

Users may upload product and production-line images and supporting documents. These files can contain confidential business information or personal data. Files are validated, placed in protected Laravel-managed storage and served through ownership-checked API endpoints rather than predictable public URLs. Large images can be reduced to a Full-HD envelope.

Uploaded content may be embedded in an authorized generated document. A user can instead record the confidentiality exception where the service permits an image to be withheld.

6. Generated documents

PackNavi processes stored specification data and protected images to generate an authorized, localized PDF on the backend. Downloads are delivered with private/no-store response controls. The current implementation does not provide public RFQ share links or automated RFQ email delivery.

If protected sharing, immutable RFQ snapshots or email delivery are activated later, this notice must be updated before those data flows are used.

7. Technical and security data

Requests necessarily expose network information such as IP address, request time, requested path and user-agent information to the hosting and web-server environment. Depending on production server configuration, these may appear in access or security logs. Laravel keeps operational error logs; OTP plaintext and file contents are not deliberately logged.

Security records include opaque identifiers, hashed session/authentication tokens, OTP attempt counts, expiry and verification timestamps, last-use or last-seen timestamps and ownership information.

8. Cookies and local storage

First-party cookies retain the anonymous-session token, authentication token, current product/scenario identifiers and language preference for requested core functionality. The consent choice is retained for up to 180 days. Only after analytics consent, Google Analytics may set _ga and _ga_<measurement-id> cookies for up to 180 days.

Local storage is used only as a temporary resilience queue when saving a specification to the server fails. Pending changes are retried and removed after a successful save. It is not intended to be the normal questionnaire database. Details are provided in the Cookie and Storage Information.

9. Email, hosting, analytics and recipients

Production hosting, database/file storage and transactional email are intended to use STRATO services. Transactional email is currently used for OTP login. Local development uses a non-delivering array mailer unless configured otherwise.

If the visitor actively consents, Google Analytics, provided by Google Ireland Limited, measures page views and navigation using the page path without query parameters, page title, device/browser information, approximate location derived from the IP address and online identifiers. PackNavi disables advertising storage, advertising user data, personalization and Google signals. The Google tag is not loaded before consent.

Data may be disclosed to hosting and email infrastructure providers where necessary to operate the service, to Google only after analytics consent, and to public authorities or advisers where legally required. Processor terms, configuration and the final recipient list require review before production.

10. Purposes and legal bases

Processing supports the requested service, pre-contractual or contractual steps, authentication, security, abuse prevention, document generation, communication and compliance with legal obligations. Depending on the relationship and data, possible GDPR bases include Article 6(1)(b) for requested contractual steps, Article 6(1)(f) for secure operation and B2B communication, and Article 6(1)(c) for legal obligations.

Optional Google Analytics processing is activated only after consent and is based on Article 6(1)(a) GDPR together with the applicable terminal-device rule. Consent is not used as a blanket basis for core service processing and may be withdrawn at any time through the privacy-settings control.

11. Retention and deletion

Account, product, specification and document data are retained while needed to provide the profile and service, until a valid deletion request or account closure, and thereafter only where required for legal obligations, security, evidence or claims. Uploaded files follow the related product/content lifecycle.

Anonymous sessions currently have no automatic product-defined expiry. OTP challenges expire after 30 minutes but database cleanup timing for expired records has not yet been finalized. Authentication tokens expire after up to 30 days or are deleted on logout; server-log, backup and transactional-email retention depends on the finalized production configuration. Exact periods and deletion/anonymization rules require legal and operational approval before launch.

Browser cookies expire according to their configured lifetime or when removed by the user. Failed-write local storage remains until successful synchronization or browser removal.

12. International transfers

Google Analytics may involve access or processing by Google group companies outside the EEA, including in the United States. Applicable transfer mechanisms, Google contractual terms and the final production configuration must be verified before launch. Other production-provider locations and transfer mechanisms must also be reviewed.

13. Security

PackNavi uses measures such as non-guessable identifiers, one-way token and OTP hashing, ownership checks, protected file delivery, validation, rate and attempt limits, and minimized public exposure. No system can guarantee absolute security. Users should avoid uploading information beyond what is necessary and should protect access to their email and devices.

14. Automated decisions

Rule-based branching and completeness calculations adapt the questionnaire and identify missing information. They do not currently make decisions that produce legal or similarly significant effects about an individual within the meaning of Article 22 GDPR.

15. Your rights

Subject to the statutory conditions, individuals may request access, rectification, erasure, restriction, data portability and may object to processing based on legitimate interests. Where processing relies on consent, consent may be withdrawn for the future. Individuals also have the right to complain to a competent data-protection supervisory authority.

Requests can be sent to info@moritz-mergenthaler.de. Identity verification may be required to protect data from unauthorized disclosure. Rights can be limited by applicable law and the rights of others.

Official GDPR text (EUR-Lex) (opens in a new window)

16. Changes to this notice

This notice will be updated when processing changes. Material changes will be reflected in the version, last-updated and effective-date information and communicated where required.