Draft for lawyer review — not legal advice. Swedish counsel should review before production reliance.
Privacy Notice — Packalytics
DISCLAIMER: This is a draft for lawyer review, not legal advice. Swedish counsel should review before production reliance.
Version: privacy_v1
Last updated: 14 September 2026
Language: English
1. Controller
The controller of personal data processed in connection with Packalytics and related websites/demos is:
Global AI Logistix Trade Solutions AB
trading as GALT Solutions AB (“GALT”, “we”, “us”)
Org.nr: 559598-5895
Address: Langetoftsvägen 68, 269 73 Förslöv, Sweden
Email: info@packalytics.se
We are a small company and have not appointed a separate Data Protection Officer (DPO). For privacy requests, contact info@packalytics.se.
This notice describes how we process personal data under the EU General Data Protection Regulation (GDPR) and Swedish supplementary rules. Packalytics is a B2B product (warehouse packing decision-support). Sweden/EU are our primary markets; international users may also access the Service.
2. What data we process
Depending on how you use Packalytics (marketing site, booking, account, or guest demo), we may process:
| Category | Examples |
|---|---|
| Account & identity | Name, work email, company name, role/title, password or auth tokens |
| Booking / contact | Meeting requests, calendar details, message content you send us |
| Usage | Feature use, plan runs, timestamps, error logs, approximate interaction metrics |
| Device / technical | IP address, browser type, device type, language, referrer |
| Local / demo storage | Data stored in browser local storage or session storage for guest Preferred demos (e.g. session state, acknowledgment flags) |
| Cookies & similar | See our Cookie policy — may include necessary cookies and, with consent where required, analytics |
| Communications | Emails and support correspondence |
We do not intentionally collect special categories of personal data (e.g. health) for Packalytics. Please do not upload such data into demos.
Warehouse operational data you enter for packing plans (SKU dimensions, order lines, etc.) may include business data; if it incidentally includes personal data, it is processed only to provide the Service.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service, accounts, and demos you request | Contract (Art. 6(1)(b)) or steps prior to contract |
| Respond to inquiries and schedule video calls / videomöten | Contract or legitimate interests (Art. 6(1)(f)) — responding to B2B interest |
| Secure the Service, prevent abuse, debug | Legitimate interests — integrity and security of our systems |
| Improve product and understand demo usage (aggregated/analytics) | Legitimate interests, or consent where analytics cookies require it |
| Send service/operational messages about your account or booking | Contract / legitimate interests |
| Marketing emails (if any) to business contacts | Consent or soft opt-in where allowed; you may opt out |
| Comply with law, defend legal claims | Legal obligation (Art. 6(1)(c)) and/or legitimate interests |
| Record acceptance of Terms / Privacy (version + timestamp) | Legitimate interests / contract — evidence of agreement and compliance |
You may object to processing based on legitimate interests where applicable (see Rights below).
4. Retention
| Data | Typical retention |
|---|---|
| Account data | While the account is active, then deleted or anonymised within a reasonable period after closure (e.g. up to 12 months unless longer needed for legal claims or accounting) |
| Booking / email correspondence | As needed for the relationship, typically up to 24 months after last contact, unless longer required |
| Usage / security logs | Typically 3–12 months, unless needed longer for security investigations |
| Acceptance records (terms/privacy version + timestamp) | For the duration of the relationship and a reasonable period thereafter (evidence) |
| Cookie / local storage | Per Cookie policy and browser settings; demo local data often session-bound or until cleared |
| Invoices / accounting (if paid) | As required by Swedish bookkeeping rules (generally 7 years) |
Exact periods may be refined when paid SaaS launches; we will update this notice.
5. Processors and subprocessors
We use trusted service providers who process personal data on our instructions (processors), for example:
| Area | Typical provider (placeholder — confirm before production) |
|---|---|
| App hosting / frontend | Lovable and related hosting infrastructure |
| Hosting / cloud | Cloud hosting provider used by our stack (to be listed precisely) |
| Booking | Google Calendar (or similar) for scheduling video calls |
| Email delivery / mailbox provider | |
| Analytics (if enabled) | Analytics tool only with appropriate legal basis / consent |
Action for launch: replace placeholders with the actual vendor names and locations once counsel and engineering confirm the stack.
Processors are bound by data-processing terms. A current subprocessor list can be requested at info@packalytics.se.
6. Transfers outside the EEA
If a provider processes data outside the European Economic Area (EEA), we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and supplementary measures where required, or rely on an adequacy decision where applicable.
Demo and marketing traffic may involve US-based tooling (e.g. certain hosting or calendar features). Details available on request.
7. Your rights
Under GDPR, you may have the right to:
- Access your personal data
- Rectification of inaccurate data
- Erasure (“right to be forgotten”) in certain cases
- Restriction of processing
- Data portability where applicable
- Object to processing based on legitimate interests
- Withdraw consent where processing is consent-based (e.g. non-essential cookies), without affecting prior lawful processing
To exercise rights, email info@packalytics.se. We may need to verify your identity.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): https://www.imy.se.
8. Children
Packalytics is a B2B professional tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have done so, contact us and we will delete the data promptly.
9. Security
We apply appropriate technical and organisational measures given the nature of a soft-open / demo-first product (access controls, HTTPS, least-privilege practices). No method of transmission or storage is 100% secure; demo environments are not production WMS and should not hold sensitive production datasets beyond what is needed for evaluation.
10. Changes
We may update this Privacy notice. Material changes will use a new version id (e.g. privacy_v2). The “Last updated” date and version above identify the current draft.
11. Contact
Global AI Logistix Trade Solutions AB (GALT Solutions AB)
Langetoftsvägen 68, 269 73 Förslöv, Sweden
Org.nr 559598-5895
Privacy contact: info@packalytics.se
End of Privacy Notice (privacy_v1).