Privacy Policy

1. Data Controller

The controller responsible for processing your personal data under GDPR Art 4(7) is the operator of Packt. For any privacy-related questions or to exercise your rights under GDPR, contact us at privacy@packtapp.com.

Packt
Packt is currently in closed beta. The service is offered free of charge; no payments are accepted. Full legal identification per §25 MedienG and §5 ECG will be published before the paid tier launches.
Vienna, Austria
The operator of Packt is responsible for the content of this website during the beta. Full identification under §25 MedienG will be published before the paid tier launches.

2. What We Collect

When you create a Packt account, we collect:

• Your name and email address (via Clerk authentication)
• Profile photo if provided by your auth provider
• Trip content you create: messages, timeline stops, expenses, photos, pins, and locations
• Usage analytics (page views, feature usage) via PostHog, only if you consent
• Technical data needed to deliver the service: IP address, user agent, session tokens

3. Legal Basis for Processing (GDPR Art. 6)

• Contract (Art. 6(1)(b)): We process your account and trip content to provide the Packt service you signed up for.
• Consent (Art. 6(1)(a)): Product analytics via PostHog are processed only after you grant consent through the cookie banner. You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): We process minimal security logs to protect against abuse and fraud.
• Legal obligation (Art. 6(1)(c)): We may process data to comply with tax, billing, or law-enforcement obligations.

4. How We Use Your Data

• To provide the service: storing your trips, syncing data in real time, enabling collaboration.
• To send transactional emails: invitations, welcome emails, account notifications.
• To improve the product: aggregate analytics help us understand which features are used (consent-gated).

We do not sell your data. We do not show ads. We do not share your personal information with advertisers.

5. Third-Party Processors

Packt relies on the following sub-processors:

• Clerk — Authentication and user management (USA, GDPR-compliant via SCCs)
• Convex — Backend database and real-time sync (USA, SCCs)
• Resend — Transactional email delivery (USA, SCCs)
• PostHog — Product analytics, hosted in the EU (Frankfurt). Only active after consent.
• Vercel — Application hosting (USA, SCCs)
• Stripe — Payment processing, when you buy a trip pass (USA + Ireland, SCCs)
• GIPHY — GIF search, delivery, and usage analytics (USA, SCCs). Search terms, device IP, and aggregate engagement data (view/click/send) are sent to GIPHY when you use the GIF picker.

Each processor has its own privacy policy and is bound by a data processing agreement with us.

6. International Data Transfers

Some of our sub-processors are based in the United States. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures such as encryption in transit and at rest.

7. Data Retention

We keep your account data for as long as your account exists. If you wish to delete your account, please contact us at privacy@packtapp.com and we will process the deletion. Upon account deletion, your personal data may be permanently and irretrievably removed from our systems and those of our sub-processors.

Content you contributed to shared groups (messages, photos, expenses, timeline data) may remain visible to other group members after your account is deleted. Backups are rotated on a regular schedule and are not guaranteed to be recoverable.

Packt does not guarantee the continued availability or preservation of stored content. We recommend that you maintain your own copies of any information shared through the Service that is important to you.

8. Your Rights (GDPR Art. 15–22)

You have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (“right to be forgotten”, Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, from the footer “Cookie Settings” button or your dashboard settings.
• Lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

To exercise any of these rights, email us at privacy@packtapp.com. We respond within 30 days.

9. Cookies & Tracking

Packt uses strictly necessary cookies for authentication (Clerk session cookies) and basic app function. Analytics cookies (PostHog) only run after you grant consent via the banner. We also set a first-party consent-preference cookie named packt_consent that stores your analytics choice so we can remember it across visits — this cookie is used only to remember your cookie preferences and is never sent to third parties. You can change your choice any time from the footer “Cookie Settings” button or under dashboard settings. We do not use third-party advertising cookies.

10. Contact

For privacy questions or data subject requests, email us at privacy@packtapp.com.