Last updated July 2026
Privacy Policy
Overview
Packledger provides Extended Producer Responsibility (EPR) packaging-compliance software for Shopify merchants. This Privacy Policy describes what information we collect through our website and our Shopify app, how we use it, and the choices you have. Our guiding principle is data minimization: we collect the least data needed to compute and file your packaging reports, and we deliberately avoid collecting your customers' personal information at all.
Information you provide to us
When you contact us or request an EPR assessment through our website, we collect the details you submit: your name, work email, company name, and the contents of your message. When you install our Shopify app, we collect your company profile (legal name, brand details) and, for access control inside the app, the name and email of the staff members who use it, as shared by Shopify's sign-in.
Information from your Shopify store
With your authorization during install, we read two things from your store via Shopify's API: your product catalog (titles, SKUs, and related attributes, used to identify packaging) and order sales data (quantities, totals, and the destination state or province of each order, used to attribute sales to the jurisdictions EPR laws report on). We derive the destination state at ingestion and keep only state-level information keyed to an order identifier.
What we deliberately do not collect
We never read or store your customers' names, email addresses, phone numbers, street addresses, or ZIP/postal codes — our sync requests exclude these fields entirely, and automated tests enforce that exclusion. We do not process or store payment card data; all billing is handled by Shopify. Our website runs no third-party analytics or advertising trackers and sets no marketing cookies.
How we use information
We use the information above to operate the service: identifying the packaging you place into commerce, computing reportable weights and estimated fees per state, preparing and (where you authorize it) submitting EPR filings on your behalf, providing support, sending service and account communications, and improving the product. We act as a service provider processing store data on your behalf; you remain the producer of record for your filings.
Artificial intelligence
Some product-to-packaging matching and regulatory research uses large-language-model services (Anthropic). Only product and packaging information is sent for this purpose — never your customers' personal information — and our AI providers do not use data submitted through their APIs to train their models.
Service providers
We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We share data only with the vendors that run our infrastructure — Shopify (commerce platform), Supabase (database hosting, United States), Vercel (application hosting), Resend (transactional email), Sanity (website content management), and Anthropic (AI processing as described above) — each bound by data-protection terms, and with state agencies or their stewardship organizations when submitting filings you have authorized.
Data retention and deletion
We retain store data while your account is active. If you uninstall the app, we honor Shopify's data-erasure process: your store's data is deleted in response to Shopify's redaction webhooks, generally within 48 hours of Shopify issuing them, except records we are legally required to keep to support filings already made on your behalf. Website inquiry details are kept only as long as needed to respond and for basic business records. You may request earlier deletion at any time.
Security
Data is encrypted in transit and at rest. Each store's data is isolated with database-level access controls (row-level security), production access is restricted to authorized personnel on a least-privilege basis, and app sessions use Shopify's token-based authentication. No method of storage or transmission is perfectly secure, but we design for defense in depth and monitor for issues.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can exercise these by emailing us; merchants can also export their data directly from the app's settings. We honor data-subject requests forwarded through Shopify's privacy webhooks, and we do not discriminate against you for exercising your rights.
Children
Our website and services are business tools, are not directed at children, and we do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this policy as our services or the law evolve. We will post the updated version here with a revised date, and for material changes we will notify merchants through the app or by email.
Contact
Questions about this policy or your data can be sent to hello@packledger.co.