Summary
- Without an account, your projects stay in your browser. We never receive them.
- With an account, we store your email, your saved projects and your payment records, to run the Service for you.
- Card, UPI and bank details go to Razorpay, not to us.
- We do not sell your data, and we do not use advertising or analytics trackers.
- You can ask us to see, correct or delete your data at any time: .
1. Who we are
("we") runs Pack Studio and is responsible for the personal data described here. We aim to handle personal data in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and their rules.
2. What we collect
| Data | When | Why |
|---|---|---|
| Email address (and your name and profile picture, if you sign in with Google) | When you create an account | To sign you in and contact you about your account |
| Saved projects: sizes, settings, artwork, logos and images you add, and a small preview image | When you save while signed in | To store your work and show it back to you on any device |
| Payment records: plan, amount, date, Razorpay order and payment IDs | When you buy a plan | To activate your plan, handle refunds and keep tax records |
| Messages you send us | When you contact us | To reply and help you |
| Basic technical data (IP address, browser, time of request) in server logs | When you use the website or sign in | Security, preventing abuse and fixing problems |
We do not collect card numbers, UPI IDs or bank details. Razorpay collects these directly under its own privacy policy.
3. Data stored in your browser
If you save projects without signing in, they are kept in your browser's storage (IndexedDB) on your device and are never sent to us. Clearing your browser data deletes them. When you sign in, your browser also keeps a sign-in token so you stay logged in. We do not use advertising or analytics cookies.
4. How we use data
Only to provide and improve the Service: signing you in, saving and syncing projects, processing payments and refunds, providing support, keeping the Service secure, and meeting legal obligations such as tax record-keeping. We will ask for your consent before using your data for anything else, such as marketing emails, and you can withdraw it at any time.
6. How long we keep it
Saved projects are kept until you delete them or close your account. Account data is deleted within 30 days of a deletion request, except payment records, which we keep for as long as tax and accounting laws require. Server logs are kept for a short time for security.
7. Your rights
You can ask us to: tell you what personal data we hold about you; correct or update it; delete it; or withdraw consent you have given. You can delete individual projects yourself in the Service. To make any other request, email from the address on your account. We will reply within 30 days.
8. Security
Data is sent over encrypted connections (HTTPS). Database access rules make sure each account can read only its own projects and payments, and payment confirmations are cryptographically verified. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.
9. Children
The Service is meant for businesses and adults. It is not directed at children, and we do not knowingly collect data from anyone under 18 without a parent's or guardian's consent. If you believe a child has given us personal data, contact us and we will delete it.
10. Grievance officer
For questions or complaints about your personal data, contact our grievance officer:
We aim to resolve complaints within 30 days. If you are not satisfied, you may also complain to the Data Protection Board of India once it is accepting complaints.
11. Visitors in the UK and EU
If you use Pack Studio from the European Economic Area or the United Kingdom, the EU and UK General Data Protection Regulation (GDPR) give you these additional points:
- Legal bases: we process account and project data to perform our contract with you, payment and tax records to meet legal obligations, and security logs for our legitimate interest in keeping the Service safe. Anything else, such as marketing emails, only with your consent.
- Your rights: access, correction, deletion, restriction, objection, data portability (a copy of your projects in a machine-readable format), and withdrawing consent at any time. Email ; we reply within one month.
- International transfers: our providers may store and process data outside the EEA and UK, including in India. Where they do, we rely on the safeguards the law allows, such as the European Commission's standard contractual clauses offered by those providers.
- Complaints: you can also complain to the data protection authority in the country where you live or work.
12. Changes
We will update this policy when our practices change, revise the effective date above, and tell signed-in users about significant changes.