Privacy Policy

01 Introduction & scope

This Privacy Policy ("Policy") describes how Calyx Containers, Inc. and its affiliates, operating the PackOS marketing website, the Quick Quote tools, and related packaging services (collectively, the "Services," and "PackOS," "we," "us," or "our"), collect, use, disclose, and protect Personal Information, and the choices and rights available to you. For the purposes of the GDPR, Calyx Containers is the controller of Personal Information processed through the Services except where we act as a processor on a customer's behalf under a separate agreement, in which case that customer's instructions and privacy notice govern and this Policy is secondary.

This Policy applies to Personal Information we process through the Services. It does not apply to third-party products, services, or websites, which are governed by their own privacy notices, nor to de-identified or aggregated information that is not reasonably capable of identifying you. By using the Services, you acknowledge this Policy. Where consent is a legal requirement, we obtain it separately.

02 Definitions

Capitalized terms have the meanings given below or where first used:

• Personal Information (or "personal data") — information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual or household, as defined by applicable law.
• Processing — any operation performed on Personal Information, whether or not by automated means.
• Sensitive Personal Information — categories treated as sensitive under applicable law (e.g., government identifiers, precise geolocation, account credentials). We do not seek to collect Sensitive Personal Information through the Services.
• Your Content — files and materials you submit, including artwork, dielines, specifications, invoices, and prior quotes.
• Service Provider / Processor / Sub-processor — a third party that processes Personal Information on our behalf and under our instructions.
• Sale and Share — have the meanings given under the CCPA/CPRA (Section 9).

03 Personal Information we collect

3.1 Information you provide

• Account & contact details — name, work email, company, role, and, for enterprise requests, the packaging environment details you enter (categories, SKU bands, facilities, systems, timeline).
• Your Content — the files you upload so we can detect the packaging, prepare proofs, and produce quotes.
• Communications — messages, support requests, survey responses, and, where you use the optional voice intake, the spoken input you provide (processed live; see Section 6).
• Payment information — where paid features apply, billing details processed by our payment processor; we do not store full payment card numbers.

3.2 Information collected automatically

• Device & connection data — IP address, browser and device type, operating system, and language.
• Usage data — pages and features viewed, actions taken, dates/times, and referring URLs.
• Cookies & similar technologies — as described in Section 7.
• Approximate location — derived from IP address (not precise geolocation).

3.3 Information from third parties

We may receive limited information from analytics providers, our affiliates, and business partners who refer you, and from service providers that help us secure the Services (e.g., fraud and abuse prevention).

3.4 Categories of Personal Information (CCPA/CPRA)

In the preceding 12 months we have collected the following statutory categories:

We do not use or disclose Sensitive Personal Information for purposes that would require a right to limit under the CPRA. We do not knowingly collect Personal Information from minors (Section 15).

04 How we use Personal Information

We use Personal Information to:

• Provide the Services — detect packaging, render proofs, and generate quotes, specifications, and packouts.
• Respond to quote, enterprise-preview, and support requests and communicate with you.
• Operate, maintain, secure, debug, and improve the Services and develop new features.
• Personalize your experience and remember your preferences.
• Measure and analyze usage and the performance of our marketing.
• Prevent, detect, and respond to fraud, abuse, security incidents, and unlawful activity.
• Comply with legal obligations and enforce our terms and agreements.
• With your consent, send product updates and marketing you can opt out of at any time.

We may create and use de-identified or aggregated information for any lawful purpose; we maintain such information without attempting to re-identify it except to test de-identification.

05 Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, you may object as described in Section 14. Withdrawing consent does not affect processing carried out before withdrawal.

06 Your files & content — special handling

Your Content receives heightened protection because it is unreleased commercial work:

• Purpose limitation. Detection, proofing, quoting, and packout run solely to produce the result you requested; we do not repurpose Your Content.
• No model training. We do not use Your Content to train, fine-tune, or improve machine-learning models, and we contractually restrict our AI sub-processors from doing so.
• Private storage. Your Content is stored in a private cloud vault — no public buckets, no public objects, no directory listings — with access on a need-to-know basis using time-limited internal links.
• Voice intake. The optional voice assistant streams over an encrypted session established with a short-lived key; we retain no recording and no transcript — only the values that populate the form you review.
• Deletion. You may request deletion of Your Content at any time; see Sections 11 and 14.

Technical detail is described on our security page.

07 Cookies & similar technologies

We and our providers use cookies, pixels, local storage, and similar technologies. The categories are:

You can control cookies through your browser and, where offered, our cookie controls. We honor Global Privacy Control (GPC) and similar opt-out preference signals where legally recognized, and we treat a valid signal as a request to opt out of any "sale"/"share" for that browser or device. Because there is no common standard, we may respond to browser "Do Not Track" settings via GPC handling.

08 How we disclose Personal Information

We disclose Personal Information only as follows:

• Service providers & sub-processors that process on our behalf under written terms limiting their use (see table below).
• Affiliates within the Calyx Containers group to operate and support the Services.
• Professional advisors (lawyers, auditors, insurers) under duties of confidentiality.
• Legal, safety & rights — to comply with law or valid legal process, enforce our terms, or protect the rights, property, or safety of PackOS, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor notice.
• With your direction or consent — for example, when you ask us to share a proof or quote.

This list may change as the Services evolve; a current list is available on request at privacy@packos.ai.

09 No sale or sharing of Personal Information

We do not sell your Personal Information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not sold or shared Personal Information, including that of any individual we know to be under 16, in the preceding 12 months. Disclosures to service providers for the business purposes described above are not a "sale" or "share."

10 International data transfers

We are based in the United States and process information there and in other countries where we or our service providers operate. When we transfer Personal Information from the EEA, the UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA), together with supplementary measures where needed. You may request a copy of the relevant safeguards at privacy@packos.ai.

11 Data retention

We retain Personal Information only as long as necessary for the purposes in this Policy, then delete or de-identify it. We determine retention based on the criteria below:

Longer retention may apply where required by law, to resolve disputes, or to enforce agreements.

12 Information security

We maintain administrative, technical, and organizational measures designed to protect Personal Information appropriate to the risk — including encryption in transit and at rest, access controls, least-privilege and fail-closed design, logging, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our controls and the reasoning behind them are described on the security page.

13 Automated decision-making

The Services use automated processing to detect packaging and prepare estimates. These outputs are decision support: quotes are non-binding estimates that you review, and we do not make decisions that produce legal or similarly significant effects about you solely by automated means without a lawful basis and appropriate safeguards. Where such processing occurs and the GDPR applies, you may request human review.

14 Your privacy rights & choices

14.1 Available to everyone

You may access, update, or delete your account and contact information, request deletion of Your Content, and unsubscribe from marketing email using the link in any message or by contacting us.

14.2 EEA, UK & Switzerland (GDPR)

Subject to conditions and exemptions, you have the rights to: access; rectification; erasure; restriction of processing; data portability; objection (including to processing based on legitimate interests and to direct marketing); and to withdraw consent. You may lodge a complaint with your local supervisory authority. If we have designated an EU/UK representative, contact details are available at privacy@packos.ai.

14.3 California (CCPA/CPRA)

California residents have the rights to: know and access the categories and specific pieces of Personal Information collected; delete Personal Information; correct inaccurate Personal Information; opt out of any "sale" or "share" (note: we do neither); limit the use of Sensitive Personal Information (not applicable as described); and to non-discrimination for exercising these rights. We do not offer financial incentives for Personal Information. You may use an authorized agent, and you may appeal a decision by replying to our response.

14.4 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. We honor these rights as required and provide an appeal mechanism.

14.5 How to exercise your rights

Submit a request to privacy@packos.ai. We will verify your identity (and an agent's authority) before acting, respond within the timeframe the law requires, and will not discriminate against you for exercising a right. We may decline or limit a request as permitted by law and will explain our reasons.

15 Children's privacy

The Services are intended for business use by adults and are not directed to children under 16. We do not knowingly collect Personal Information from children. If you believe a child has provided us Personal Information, contact us and we will delete it.

16 Third-party links & services

The Services may link to or integrate third-party sites and services that we do not control. This Policy does not apply to them; review their privacy notices. We are not responsible for their practices.

17 Data breach notification

If we become aware of a security incident affecting your Personal Information, we will investigate and, where required by law, notify affected individuals and applicable authorities within the timeframes the law requires. Where we act as a processor for a customer, we will notify that customer without undue delay.

18 Changes to this Policy

We may update this Policy to reflect changes in our practices, technology, or the law. We will revise the effective date above and, for material changes, provide additional notice (such as a banner or email). Your continued use of the Services after an update takes effect constitutes acknowledgment of the revised Policy.

19 Contact, complaints & data protection

For privacy questions or to exercise a right: privacy@packos.ai. For security matters: security@packos.ai. By mail: Calyx Containers, Attn: Privacy, Salt Lake City, UT, USA. If you are unsatisfied with our response, you may have the right to complain to your local data protection authority.

This Policy is provided for transparency and general information and is not legal advice. Where we act as a processor under a customer agreement or where an enterprise data processing agreement is in place, that agreement governs to the extent of any conflict with this Policy.