Privacy Policy

This policy explains what personal information Unstacked Apps, LLC (“we”) collects through Carton Pack Pro — the website, the web app, the REST API, the MCP server and the NetSuite integration — and what we do with it.

Carton Pack Pro is used by organizations. For the cartons, items and orders an organization puts in, the organization decides what is collected, and we process it on the organization’s behalf.

1. What we collect

• Account details: name, email address, organization name and role. Passwords are stored only as a salted hash.
• Data you put in: cartons, items, SKUs, dimensions, weights, packing constraints, and orders sent for packing from the app, a CSV file, the API or NetSuite. An order can include its order number, item names or descriptions and, if your integration sends them, the ship-to country and postal code.
• Pack jobs: each packing request and the pack plan produced for it.
• API keys: stored only as a hash. A key is shown once, when it is created.
• Billing records: plan, subscription status, renewal date, and the Stripe customer and subscription IDs. We never receive card numbers; Link handles payment details.
• Usage and activity: monthly counts of pack jobs and API calls, and a log of account actions, such as plan changes and key creation, with who made them.
• Sign-in sessions: the IP address and browser of each session.
• Webhook deliveries: if you add a webhook endpoint, each payload sent to it and the response status.

2. Cookies and browser storage

Carton Pack Pro sets one cookie, cpp_session, which keeps you signed in. It stores your theme and navigation choices in your browser’s local storage, under cpp.theme and cpp.nav; those never leave your device. There are no analytics, advertising or tracking cookies.

3. How we use it

• to provide Carton Pack Pro and produce pack plans
• to enforce plan limits and bill for paid plans
• to secure the service and prevent abuse
• to answer support requests
• to meet legal obligations

We do not sell personal information or share it for advertising.

4. Service providers

• Stripe, Inc., including its Link service: payments, merchant of record for subscriptions, sales tax, receipts and invoices. Stripe’s privacy policy covers the payment details you give at checkout.
• Cloudflare, Inc.: DNS, network proxy and email routing. Every request to cartonpackpro.com passes through Cloudflare.

Carton Pack Pro runs on servers we operate in the United States. If you use the NetSuite integration, data is sent from your NetSuite account to us; Oracle NetSuite is your provider, not ours.

5. How long we keep it

• Pack jobs: Free keeps them for 30 days, Pro keeps them for 90 days and Ultimate keeps them until you delete them or your account closes.
• Sign-in sessions: a session expires 30 days after sign-in, and expired records are removed at your next sign-in.
• Webhook deliveries: until you delete the endpoint.
• Account, catalog, activity log and usage counts: while your account exists, and deleted within 30 days of a request to close it.
• Billing records: as long as tax and accounting law requires.
• Server logs: overwritten automatically as new entries are written.

6. Security

Traffic is encrypted in transit with HTTPS. Passwords, API keys and session tokens are stored only as hashes. Access to production systems is limited to us.

7. Where data is stored

Data is stored in the United States. If you use Carton Pack Pro from another country, your information is transferred to the United States.

8. Your rights

You can see and correct most of your information in the app. To get a copy of your information, correct anything else, or have it deleted, email [email protected]. We reply within 30 days.

If you are in the European Economic Area or the United Kingdom, we process your information to perform our contract with your organization, for our legitimate interest in securing and operating the service, and to meet legal obligations. You can object to processing, and you can complain to your local data protection authority.

If you are a California resident, you have the right to know, correct and delete the personal information we hold about you, and we will not discriminate against you for using those rights. We do not sell or share personal information as the California Consumer Privacy Act defines those terms.

9. Children

Carton Pack Pro is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes

We post updates here with a new effective date, and email account owners before a material change takes effect.

11. Contact

Unstacked Apps, LLC · [email protected]