Privacy Policy

Introduction

Welcome to PackTist ("PackTist," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy under applicable United States federal and state laws. This Privacy Policy governs all personal information we collect through our website packtist.com, our platform, related applications, and any other services we offer (collectively, the "Services").

By accessing or using PackTist, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy. If you do not agree with the terms of this policy, please discontinue use of our Services.

This Privacy Policy has been prepared to comply with applicable U.S. federal laws, including the Federal Trade Commission Act (FTC Act, 15 U.S.C. § 45), the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.), the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.), and the Electronic Communications Privacy Act (ECPA, 18 U.S.C. § 2510 et seq.), as well as comprehensive state privacy laws including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), and the New York SHIELD Act.

Who We Are

PackTist is a custom printing and packaging company based in West Sacramento, California. We design and produce custom packaging, from rigid boxes and mailer boxes to retail packaging, with full-color print, specialty finishes and a Dedicated Packaging Manager on every order.

For purposes of U.S. state privacy laws, PackTist is a "business" as defined under CCPA/CPRA and a "controller" as defined under the VCDPA, CPA, CTDPA, UCPA, and TDPSA. We determine the purposes and means by which personal information is collected and processed through our Services.

• Company: PackTist, a trading name of IMT Solutions LLC
• Website: packtist.com
• Privacy Contact: support@packtist.com
• Mailing Address: PackTist, 640 Harbor BLVD, West Sacramento, California 95691, USA

Information We Collect

We collect personal information in several ways: directly from you when you interact with our Services, automatically when you visit our website, and occasionally from trusted third parties. The categories below align with CCPA/CPRA definitions of personal information.

3.1 Information You Provide Directly

• Identifiers: Full name, email address, mailing/billing/shipping address, phone number, and company name.
• Commercial Information: Order history, product selections, quantities, custom specifications, pricing, payment status, artwork file uploads, and quote request details.
• Financial Information: We do not store your full payment card number, CVV, or PIN. All payment transactions are processed exclusively by Stripe, a PCI-DSS Level 1 certified processor. We retain only limited payment metadata: last four digits of a card, card type, billing zip, payment status, and transaction reference IDs.
• Communications Content: Emails, live chat messages, support ticket content, and any other correspondence you send us.
• User-Generated Content: Logos, artwork files, brand assets, and design templates you upload for packaging customization.
• Professional or Employment Information: Job title, company role, company size, or industry, provided in quote requests or order correspondence.
• Survey and Feedback Responses: Voluntary responses to satisfaction surveys, testimonials, or product reviews.
• Job Application Information: Resumes, cover letters, work history, and contact details submitted by employment applicants.

3.2 Information Collected Automatically

• Internet or Network Activity: IP address, browser type and version, operating system, device type and identifiers, referring URL, pages visited, time on page, links clicked, and navigation paths.
• Geolocation Data: City- and country-level location inferred from your IP address. We do not collect precise GPS-level location without your explicit consent.
• Log Files: Server-generated logs recording access timestamps, HTTP request types, response codes, and error events, used for security and debugging.
• Cookie and Tracking Data: Data collected through cookies, the Meta Pixel and local storage. See Section 7 and our Cookie Policy for full details.

3.3 Information from Third Parties

• Advertising and Analytics Platforms: We receive aggregate reports from Google Analytics, Google Ads, Meta and Microsoft Clarity that show how our site and ads perform. We do not use this data to build individual profiles for sale.
• Business Data Enrichment: We may supplement business customer records with publicly available company data (industry, company size) from professional sources.

3.4 CCPA/CPRA Personal Information Categories

How We Use Your Information

We use personal information only for legitimate business purposes consistent with the context in which it was collected, as permitted by the FTC Act and applicable state laws. We do not use your data for any purpose that would constitute an unfair or deceptive trade practice under Section 5 of the FTC Act.

4.1 Providing and Operating the Services

• Processing and fulfilling your packaging orders, custom quote requests, and reorder instructions.
• Sending transactional communications: order confirmations, production updates, shipping notifications, and delivery tracking.
• Receiving your design files and managing artwork proofs and revisions for your order.
• Providing live chat support, resolving customer service tickets, and responding to inquiries.
• Improving the functionality, usability, and performance of the PackTist platform.

4.2 Billing and Financial Administration

• Processing payments and generating invoices, receipts, and credit memos.
• Managing refunds, disputes, and chargebacks in accordance with our Returns Policy.
• Verifying billing information and detecting and preventing fraudulent transactions.
• Maintaining financial records as required under federal tax law (IRS record retention obligations, 26 U.S.C.).

4.3 Marketing and Communications

• Sending promotional emails, product announcements, and newsletters, only to users who have opted in, or to existing customers under the CAN-SPAM Act's existing business relationship exemption.
• Serving targeted or retargeted advertisements on third-party platforms (Google, Meta) where you have not exercised an opt-out.
• Measuring marketing campaign performance through analytics and attribution tools.

4.4 Analytics and Platform Improvement

• Analyzing how users navigate our platform to identify usability issues and improve features.
• Conducting internal research and development to create new products and services.
• Generating aggregated, de-identified analytics that cannot reasonably be used to identify individuals.

4.5 Legal Compliance and Safety

• Complying with applicable U.S. federal and state laws, regulations, and binding court or government orders.
• Responding to lawful requests from U.S. government authorities, courts, or law enforcement agencies, consistent with ECPA requirements.
• Establishing, exercising, or defending legal claims against or by PackTist.
• Enforcing our Terms of Service, acceptable use policies, and other agreements.
• Detecting, investigating, and preventing fraud, security incidents, and other unlawful activity.

Sharing & Disclosure of Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing or business purposes. We disclose personal information only in the limited circumstances described below, consistent with FTC guidance and applicable state law.

5.1 Service Providers

We engage third-party service providers that process personal information solely on our behalf and under our instruction. Each provider handles your information to deliver its service to us, under its own terms and privacy policy. They include:

• Cloud Hosting and Infrastructure: our website hosting provider (U.S. data centers), Neon (PostgreSQL database), Cloudinary (image/file storage)
• Payment Processing: Stripe, a PCI-DSS Level 1 certified processor
• Email Delivery: Resend, for transactional and promotional email delivery
• Customer Support / Live Chat: our own customer service system, for live chat support
• Analytics: Google Analytics 4 and Microsoft Clarity
• Shipping and Logistics: DHL, FedEx, UPS, and other carriers for order fulfillment and delivery tracking
• CRM and Sales Tools: Our own internal tools, used by our Packaging Managers and sales team

5.2 Business Transfers

If PackTist undergoes a merger, acquisition, asset sale, reorganization, or bankruptcy, personal information may be transferred as part of that transaction. We will provide affected users with at least 30 days' prior notice via email and a prominent website notice before personal information becomes subject to a materially different privacy policy, and will offer an opportunity to opt out where required by applicable state law.

5.3 Legal Process and Law Enforcement

We may disclose personal information in response to lawful legal process, including valid subpoenas, court orders, or government agency demands, provided those requests satisfy applicable legal standards (including ECPA requirements for electronic communications). Where permitted by law, we will notify you before disclosing your information. We may also share information to protect the rights, property, or safety of PackTist, our users, or the public.

5.4 With Your Consent

We will share your personal information with third parties in any circumstance not described above only when you have given us clear, affirmative, informed consent to do so.

Do Not Sell or Share My Personal Information

Under the California Privacy Rights Act (CPRA) and comparable state privacy laws, you have the right to opt out of the "sale" of your personal information and of "sharing" it for cross-context behavioral advertising, even where no money changes hands.

PackTist does not sell personal information. We do use the Meta Pixel on our site, and when an inquiry came from an ad, we report it back to Google Ads or Meta so they can measure which ads work. Under California's definition, this may count as "sharing". Residents of California, Colorado, Connecticut, Virginia, Texas and other states with opt-out rights can opt out in these ways:

• Email support@packtist.com with the subject line "Do Not Sell or Share Request." We will stop reporting your inquiries to Google Ads and Meta.
• Block or delete cookies for our site in your browser, which stops the Meta Pixel. Our Cookie Policy shows where to find these settings in each browser.
• Manage the Google ads you see at myadcenter.google.com.
• Manage the Meta ads you see at facebook.com/adpreferences.

We process opt-out requests within 15 business days. We will not discriminate against you for exercising this right, whether by denying services, charging different prices or reducing service quality.

Cookies & Tracking Technologies

We use a small set of cookies and similar technologies to keep the site secure, understand how it is used, measure our advertising and run our live chat. Our Cookie Policy lists every cookie by name, with what it does and how long it lasts. This section summarizes it.

7.1 What Are Cookies?

Cookies are small text files a website saves in your browser, so it can recognize your browser or remember something about your visit. Local storage works in a similar way. Some cookies are strictly necessary for the site to work; others are used for analytics or advertising.

7.2 Cookie Categories

7.3 Your Cookie Controls

• Browser Settings: You can block or delete cookies in Chrome, Safari, Firefox or Edge. The site keeps working if you do.
• Google Analytics Opt-Out: Install Google's opt-out browser add-on.
• Meta Ads: Manage the ads you see in Meta's Ad Preferences.
• Industry Opt-Outs: You can also opt out of interest-based advertising from participating companies at optout.aboutads.info and optout.networkadvertising.org.

Email Communications & CAN-SPAM Compliance

All commercial email communications we send are governed by the federal CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.) and its implementing regulations (16 C.F.R. Part 316). We fully comply with all CAN-SPAM requirements:

• Accurate Header Information: The "From," "To," "Reply-To," and routing information in all our emails accurately identifies PackTist as the sender. We do not use deceptive addresses or domains.
• Non-Deceptive Subject Lines: Subject lines accurately reflect the content of the email and do not use misleading or false language.
• Advertising Identification: Commercial emails are clearly identified as advertisements where required by law.
• Physical Postal Address: Every commercial email we send includes our valid physical mailing address, as required by 15 U.S.C. § 7704(a)(5).
• Clear Opt-Out Mechanism: Every promotional email contains a clearly visible, functioning unsubscribe link or opt-out mechanism.
• Prompt Opt-Out Processing: We process all opt-out requests within 10 business days as required by 15 U.S.C. § 7704(a)(4). We do not charge fees or require unnecessary information to process an opt-out.
• No Post-Opt-Out Commercial Emails: Once you opt out, we do not send you commercial emails and do not sell or transfer your email address to another party for their commercial email use after opt-out.
• No Third-Party Violations: We do not authorize third parties to send commercial emails on our behalf in violation of the CAN-SPAM Act.

Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods reflect applicable U.S. federal and state records retention requirements.

When personal information is no longer required, we securely delete or irreversibly anonymize it so that it cannot reasonably be linked to any individual. You may request earlier deletion at any time, subject to our legal obligations to retain certain records (see Section 10).

Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your personal information. We honor these rights for all U.S. users to the extent required by applicable law. We will not discriminate against you for exercising any privacy right.

How to Submit a Request

• Email: support@packtist.com, subject line "Privacy Rights Request"

We will acknowledge receipt within 10 business days and fulfill your request within 45 calendar days (extendable by an additional 45 days for complex requests, with written notice of the extension and reason). We will verify your identity before processing any request. Authorized agents may submit requests on your behalf with a written authorization signed by you.

California Residents: CCPA / CPRA

This section applies to residents of the State of California and supplements Section 10. It is provided pursuant to the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), codified at California Civil Code § 1798.100 et seq., and regulations adopted by the California Privacy Protection Agency (CPPA).

11.1 Your CCPA/CPRA Rights

• Right to Know (Cal. Civ. Code § 1798.110): Request disclosure of categories and specific pieces of personal information collected, categories of sources, business or commercial purposes, and categories of third parties, covering the preceding 12-month period. You may make up to two such requests per 12-month period at no charge.
• Right to Delete (§ 1798.105): Request deletion of personal information, subject to statutory exceptions.
• Right to Correct (§ 1798.106): Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing (§ 1798.120): Direct us to stop selling or sharing your personal information, including for cross-context behavioral advertising. Exercise it by emailing us as described in Section 6.
• Right to Limit Use of Sensitive Personal Information (§ 1798.121): To the extent we process sensitive personal information, you may limit our use to authorized purposes. (We do not intentionally collect sensitive personal information; see Section 3.)
• Right to Non-Discrimination (§ 1798.125): We will not deny services, charge different prices, or reduce service quality because you exercised any CCPA/CPRA right.

11.2 Shine the Light: Cal. Civ. Code § 1798.83

California residents may request a list of categories of personal information shared with third parties for their direct marketing purposes during the prior calendar year. PackTist does not share personal information with third parties for their own direct marketing purposes. You may still submit a Shine the Light inquiry to support@packtist.com, subject line "California Shine the Light."

11.3 Financial Incentives Notice

PackTist does not currently offer financial incentives, price differences, or service differences in exchange for the collection, retention, or sale of personal information. Any future program will comply with CPRA § 1798.125(b) disclosure requirements and be offered only with your prior opt-in consent.

Other State Privacy Rights

Several U.S. states have enacted comprehensive consumer privacy laws that grant residents specific data rights. PackTist honors all applicable state privacy laws. If you reside in one of the following states, your rights under that state's law are recognized and honored:

To exercise rights under any applicable state law, email support@packtist.com and state your state of residence and the specific right you wish to exercise. We apply the most protective standard applicable to your request.

Children's Privacy: COPPA Compliance

PackTist is a commercial platform intended exclusively for adults. Our Services are not directed to children under the age of 13, and we do not knowingly collect, use, or disclose personal information from children under 13, in full compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501–6506, and implementing regulations at 16 C.F.R. Part 312.

We do not knowingly collect personal information from users under the age of 18. You must be at least 18 years old to request quotes, place orders, or use our Services. We do not verify age but rely on users' agreement to our Terms of Service confirming they meet this age requirement.

If you are a parent or legal guardian and believe your child under 13 has provided us with personal information without your verifiable parental consent, please contact us immediately:

• Email: support@packtist.com, subject line "COPPA Concern"
• We will promptly delete the child's information, notify you upon completion, and take steps to prevent future collection.
• We will respond within 5 business days.

We do not condition any service or feature on a child providing more personal information than is reasonably necessary to participate. If we discover that we have inadvertently collected personal information from a child under 13, we will delete it immediately and, where required, report the incident to the Federal Trade Commission.

Security of Your Information

We take reasonable steps to protect personal information against unauthorized access, use, alteration, disclosure or destruction. The safeguards in place today are:

• Every page and form on our website is served over encrypted HTTPS, so information you send us is encrypted in transit.
• Card payments are handled by Stripe, a PCI-DSS Level 1 certified processor. PackTist never receives or stores full card numbers.
• Our database provider encrypts stored data at rest, and our database backups are encrypted with AES-256.
• Only PackTist staff can sign in to our internal systems. Staff passwords are hashed and never stored in readable form, staff can protect their sign-in with two-factor authentication, repeated failed sign-ins are blocked, and we are alerted to unusual sign-ins.
• Staff access is role-based, so each team member sees only the information their role needs.

While we take every reasonable precaution, no electronic system is 100% secure. We cannot guarantee absolute security. Please keep the invoice and payment links we send you private, and contact us immediately at support@packtist.com if you suspect any unauthorized activity involving your orders.

Third-Party Websites & Links

Our website and Services may contain links to third-party websites, plug-ins, and applications. Clicking those links may allow third parties to collect or share data about you. PackTist does not control these external websites, is not responsible for their content or privacy practices, and this Privacy Policy does not apply to them.

We encourage you to review the privacy policy of every third-party website you visit. The FTC may have jurisdiction over deceptive data practices by U.S.-based operators. Concerns about specific third parties can be reported to the FTC at reportfraud.ftc.gov. Notable third-party integrations you may encounter on our platform include:

• Google Analytics: analytics, subject to Google's Privacy Policy.
• Microsoft Clarity: session recordings and heatmaps, subject to the Microsoft Privacy Statement.
• Stripe, subject to its own PCI-DSS-compliant privacy policy and security standards.
• Google Ads / Meta Pixel: advertising measurement, subject to Google's and Meta's privacy policies and your ad preference settings.
• Social Media Platforms: interactions with social media features are governed by those platforms' terms and privacy policies.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our data practices, the Services we offer, or applicable U.S. federal and state law. The revised policy will be posted to this page with an updated "Last Revised" date at the top of the document.

For material changes, those that significantly affect how we collect, use, or share personal information, or that affect your rights, we will provide prior notice by:

• Sending an email notice to the email address on your most recent order at least 30 days before the change takes effect;
• Displaying a prominent notice banner on our website homepage;
• For California residents, providing the disclosures required by CPRA § 1798.130(a)(7) regarding any new uses of previously collected personal information.

Your continued use of our Services after the effective date of any revised policy constitutes your acceptance of the changes, to the extent permitted by applicable law. If you disagree with a material change, you may request deletion of your personal information before the effective date by contacting support@packtist.com.

Prior versions of this Privacy Policy are archived and available upon request by emailing support@packtist.com.

Contact Us

For any questions, concerns, or formal requests regarding this Privacy Policy or our data practices, please contact our Privacy Team. We respond to general inquiries within 5 business days and to formal rights requests within the timeframes required by applicable law.