Aigen PackTrack
Suomi Svenska Create account

Privacy Notice

Updated 19 October 2026 · version 1.2

This notice explains how AI Generation Oy processes personal data in the Aigen PackTrack service (EU General Data Protection Regulation, Articles 13 and 14).

1. Controller

AI Generation Oy (Business ID 3365357-7, VAT ID FI33653577)

Selkämerenkatu 12 B 34, 00180 Helsinki

Email: contact@aigen.fi

2. Roles

  • The customer company is the controller of personal data it brings into the service (for example supplier contacts on invoices). We process this data on its behalf under the data processing agreement.
  • AI Generation Oy is the controller of account, billing, terms-acceptance and security data, of questions sent to the AI help chat, and of visitor statistics on public pages.

3. Data we process

  • User account: user ID, name, email and whether it is verified, a password hash (the password itself is not stored), sessions (IP address, browser user agent, expiry) and company memberships.
  • Company details: company name, business ID, reporting year and settings.
  • Packaging data: uploaded files and packaging rows (product code, description, quantities, weights, material, supplier and notes).
  • Billing: the company's legal name, billing address, billing email, VAT ID and its verification status, and Stripe customer and subscription IDs. Card details are handled only by Stripe.
  • Terms acceptance: user ID, company, accepted versions, time, IP address and browser user agent.
  • Notices of changes to the terms: user ID, the announced version and when the notice was sent.
  • Activity: the last sign-in or signed-in use and any unused-account warning.
  • Audit log: imports, classifications, row changes, exports and privacy actions.
  • AI help chat (only if you use it): the questions you type and the earlier questions and answers of the same conversation.
  • Bot check (sign-up and password reset): Cloudflare Turnstile processes the IP address, TLS fingerprint and browser user agent.
  • Visitor statistics (with consent only, public pages only): the Google Analytics random browser identifier in a cookie, pages viewed, browser and device information and approximate location.

4. Purposes and legal bases

  • Providing the service to the customer (contract, Art. 6(1)(b); for data processed on the customer's behalf, the customer's legal basis).
  • Invoicing and bookkeeping (legal obligation, Art. 6(1)(c)).
  • Demonstrating terms acceptance, security and abuse prevention (legitimate interest, Art. 6(1)(f)).
  • Proving contract acceptance after an account is deleted (legitimate interest, Art. 6(1)(f): establishing, exercising or defending legal claims).
  • Warning about and deleting unused accounts (legitimate interest, Art. 6(1)(f), and the storage-limitation principle, Art. 5(1)(e)).
  • Visitor statistics on public pages (consent, Art. 6(1)(a)). You can withdraw consent at any time via the Cookie settings link at the bottom of the page.

We do not use data for advertising and do not sell it. Signed-in pages are not measured. When automatic classification is enabled, the product code, description, notes, supplier, quantity and weight of uploaded rows are sent to Anthropic for material suggestions (Anthropic may not train models on customer content); avoid unnecessary personal data in uploads. When you use the AI help chat, your question, the earlier messages of the same conversation and the service's own help texts are sent to Anthropic to produce the answer. No company, register, account or billing data is sent, and Anthropic may not train models on it; do not write personal data in your question.

  • AI help chat: answering your question about using the service from the service's help material (legitimate interest, Art. 6(1)(f): user support for the service's users). Using the chat is optional; its answers are general guidance, not legal advice.
  • The bot check on sign-up and password reset (legitimate interest, Art. 6(1)(f): protecting the service against automated abuse).

5. Recipients and transfers

The service's application and database: Replit, Inc. Location: EU. PackTrack is hosted and its data stored on EU servers. Transfer basis: No transfer outside the EU for hosting and storage. Transfers by the other providers listed below are described under each of them.

We use the service providers listed on the subprocessors page (/subprocessors). The page gives each provider's company, location and transfer basis. Transfers outside the EU rely on the European Commission's standard contractual clauses or the adequacy decision based on the EU–US Data Privacy Framework. Stripe also checks VAT IDs against the EU VIES service.

6. Retention

  • Company data is kept until the owner deletes it on the Account page. Deletion covers packaging rows, uploads, memberships, checklists, local billing identifiers and the company audit log. An anonymous deletion record remains.
  • Terms-acceptance records are kept while the user account exists. When the account is deleted, only a minimal proof of contract acceptance remains: hashes (SHA-256) of the user ID and the email address, the companies' business IDs, and the accepted versions and times. It is kept for 3 years from the deletion, the general limitation period under the Finnish Act on the Limitation of Debts (728/2003, section 4), and then deleted automatically.
  • Unused accounts: if nobody has signed in to or used the account for 24 months, we send a warning by email and delete the account 30 days later unless someone signs in before then. The deletion works like a user's own account deletion; the account of a company's only owner is not deleted while the company has a running subscription.
  • Sign-in sessions expire 30 days after last use; deleting the account removes the user account, password hash, sessions, activity, terms-acceptance records (except the minimal proof described above) and notice records.
  • Deleted data also disappears from the hosting provider's backups when their retention period ends.
  • Bookkeeping records are kept for the period required by the Accounting Act. Payment-provider records, invoices and subscriptions are not deleted by the service's deletion function.
  • Google Analytics data is kept for at most 14 months.
  • AI help chat questions and answers are not stored in the service. To enforce usage limits, the service stores in its database hourly and daily counts of questions and AI classifications per user and per company (the user and company identifiers, the period and the count; no question content). The counters are deleted automatically at the latest three days after their period ends; a user's counters also at once when the user account is deleted, and a company's when the company's data is deleted. Anthropic processes the messages to produce the answer and deletes the inputs and outputs within 30 days of receipt or generation, except where longer retention is required by law or to enforce Anthropic's Usage Policy (content flagged as violating it up to 2 years). Anthropic does not use API data to train models. Source: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data

7. Your rights

You have the right to access, rectify and erase your data, restrict or object to processing, and to data portability. For data processed on behalf of a customer company, contact that company first. For anything else, write to contact@aigen.fi. You can complain to the Finnish Data Protection Ombudsman: https://tietosuoja.fi.

8. Automated decision-making

The service has no automated decisions affecting a person's legal position and no profiling. Users review material suggestions, and AI help chat answers are general guidance, not decisions.

9. Changes

We update this notice when processing changes and tell you about material changes in the service and by email as set out in section 15 of the terms; versions are listed in the terms' change log.

Analytics is not in use on this site. We only use essential cookies.