privacy policy

Cait, Inc., a California corporation doing business as Packsia (“Packsia,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you use www.packsia.com, our applications (including any mobile application), and related services (the “Platform”), and the rights and choices you have. By using the Platform, you agree to this Privacy Policy.

This Policy applies to members, creators, and visitors. It covers information about you that we process when you use the Platform. It does not cover third-party services that have their own privacy policies. Region-specific rights for California, the EU/EEA, the UK, and other jurisdictions are described in Sections 9 and 10.

Information you provide

• Account and identity: first name (and last name if provided), email address, password (handled by our authentication provider), and email-verification status.
• Billing: a payment-processor (Stripe) customer reference and your subscription or membership status. Payment card details are collected and stored by Stripe, not by Packsia.
• Profile and brand inputs: information you enter, including any social media or website URLs you submit to the Brand Scanner (see Section 4) and material you upload as inputs to AI features.
• Creator information: if you are a creator, your name, bio, location, email, social and website links, profile picture, submitted content and metadata, agreement status, and payout account details established through Stripe Connect (tax and banking details are handled by Stripe Connect, not stored directly by us).
• Communications: messages, feedback, survey responses, and support requests.

Information collected automatically

• Usage and device data: IP address, device and browser type, identifiers, and activity on the Platform (such as pages viewed and actions taken), collected via cookies and similar technologies (see Section 8).
• Activity data: downloads (including first-download events with contextual attributes such as plan type at the time), saved items, moodboards, follows, AI generations (including prompts, source/lineage references, mode, status, token cost, and resulting output), content ideas generated and saved, and search queries (which may be processed to compute semantic matches and cached).

Information from other sources

• Brand Scanner sources: when you use the Brand Scanner, we obtain public data from the social profiles and websites you submit (see Section 4), which may include information about third parties (for example, public commenters).
• Referrals: affiliate/referral data through our referral program provider.

We use personal information to:

• provide, operate, and maintain the Platform, including the library, downloads, AI features, search, moodboards, and follows;
• create and manage your account, process payments and subscriptions, and meter and account for AI tokens;
• calculate and pay creator royalties and provide royalty statements;
• personalize content, recommendations, and content ideas, including using your brand profile;
• communicate with you about your account, transactions, support, and service updates;
• market our products and services, including by email and through advertising and the creation of advertising audiences as described in Section 5;
• ensure security, prevent fraud and abuse, enforce our Terms, and comply with law; and
• analyze and improve the Platform.

4.1 Brand Scanner. If you use the Brand Scanner, you provide one or more public URLs (Instagram, TikTok, and/or your website). We use a third-party scraping service to retrieve public data from those sources — which may include a profile bio and name, recent post captions, post thumbnails and links, audience comments, website content, and a website screenshot — and we send that data to AI providers to derive a structured “brand profile” (such as brand description, tone, audience, content themes, aesthetic tags, suggested topics, and brand colors). Because public posts and comments may contain information about other people, you should run the Brand Scanner only on accounts and sites you own or are authorized to analyze. We store your derived brand profile with your account and cache the raw scraped data separately; re-scanning fetches fresh data and may consume tokens.

By submitting any Submitted Source to the Brand Scanner (or to any other feature that ingests third-party URLs or content), the Member represents, warrants, and covenants that: (i) the Member owns, controls, or is otherwise lawfully authorized to submit the Submitted Source for analysis by the Service, including, where applicable, by virtue of being the account holder, the rights holder, the brand owner, or an authorized agent of any of the foregoing; (ii) the Member has obtained, or has a valid legal basis under applicable law to rely on without obtaining, any consents, permissions, licenses, or other authorizations required from any individual whose personal data (including any image, likeness, voice, or biometric identifier) may be contained in the Submitted Source, including any consent required under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, the Illinois Biometric Information Privacy Act (740 ILCS 14/, “BIPA”), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001, “CUBI”), the Washington My Health My Data Act (RCW 19.373, “MHMDA”), and any other applicable privacy, publicity, or biometric-information law; (iii) the Submitted Source does not contain (A) personal data of children under the age of thirteen (13) (or under sixteen (16) where required by GDPR Article 8 as implemented by a relevant Member State), (B) special categories of personal data under GDPR Article 9 (including data revealing racial or ethnic origin, political opinions, religious beliefs, health, sex life, or sexual orientation, or biometric data processed for the purpose of uniquely identifying a natural person), or (C) any sensitive personal information under the California Consumer Privacy Act, as amended (“CCPA/CPRA”), in each case unless the Member has obtained any heightened consent or legal basis required for such processing; and (iv) the Member's submission of the Submitted Source, and Packsia's processing of it as described in this Policy, will not violate any contract, terms of service, law, regulation, or third-party right (including any platform terms of service, intellectual property right, right of publicity, or privacy right).

Packsia's Role and Legal Basis. With respect to personal data of third parties contained in a Submitted Source, the Member is the controller (under GDPR / UK GDPR) or business (under CCPA/CPRA) of that personal data, and Packsia processes such personal data as a processor or service provider acting on the Member's documented instructions, solely to provide the Brand Scanner and related features to the Member, except where Packsia is required by law to process such data otherwise. Packsia's own processing of third-party personal data contained in Submitted Sources is conducted in reliance on the Member's representations above and, where Packsia is acting as a controller for a discrete purpose (such as security, fraud prevention, or compliance with law), on the legitimate-interest basis under GDPR Article 6(1)(f) or such other lawful basis as may apply. Because Packsia obtains third-party personal data indirectly from the Member rather than directly from the data subject, Packsia relies on the exceptions in GDPR Article 14(5) (in particular, disproportionate effort and confidentiality obligations) with respect to direct notice to such data subjects; the disclosures in this Policy, together with the Member's own notices to data subjects, are intended to satisfy applicable transparency obligations.

Member Indemnification. The Member agrees to defend, indemnify, and hold harmless Packsia, its affiliates, and their respective officers, directors, employees, contractors, and agents (collectively, the “Packsia Parties”) from and against any and all claims, demands, investigations, regulatory actions, fines, penalties, damages, losses, costs, and expenses (including reasonable attorneys' fees and costs of defense) arising out of or related to: (i) any Submitted Source provided by the Member; (ii) any breach or alleged breach by the Member of the representations, warranties, or covenants above; (iii) any allegation that a Submitted Source, or Packsia's processing of it on the Member's instructions, violated the rights of any third party (including any privacy, publicity, biometric, intellectual property, or contractual right) or any applicable law; or (iv) any failure by the Member to provide notice to, or obtain consent from, any individual whose personal data is contained in a Submitted Source. This obligation survives termination of the Member's account and use of the Service. These obligations are in addition to, and not in limitation of, any other indemnity obligations of the Member set forth in the Terms of Use or any other agreement between the Member and Packsia.

4.2 AI inputs and outputs. To provide AI features, we transmit your prompts, selected clips, uploaded material, brand profile fields, and related inputs to third-party AI providers, which generate outputs and may process, store, and use those inputs under their own terms (including to operate and improve their services and, in some cases, to train their models). We re-host resulting outputs on our content-delivery network. Do not submit information to AI features that you do not want processed in this way.

We engage in marketing and advertising, including by uploading certain personal information (such as hashed email addresses or other identifiers) to advertising platforms such as Meta, Google, and TikTok to create custom audiences and “lookalike” audiences and to deliver and measure advertising for Packsia, and we may use cookies and pixels for retargeting. Under California law, this constitutes “selling” and/or “sharing” of personal information for cross-context behavioral advertising, and under EU/UK law it requires your consent. You can exercise choices about this as described in Sections 8, 9, and 10, including our “Do Not Sell or Share My Personal Information” control and, where applicable, our cookie consent tools. We honor recognized opt-out preference signals, including the Global Privacy Control (GPC).

We share personal information with:

• Service providers / processors that operate the Platform on our behalf, listed in Section 7;
• Advertising platforms as described in Section 5;
• Payment and payout providers to process transactions and creator payouts;
• Other members, where you choose to make content public (for example, a public moodboard shows your first name; a creator profile displays your creator information);
• Legal and safety recipients, to comply with law, respond to lawful requests, or protect rights, property, and safety; and
• Successors, in connection with a merger, acquisition, financing, or sale of assets, with notice where required.

We rely on the following categories of providers. Each receives only the data needed for its role:

If we add or change providers (for example, an analytics tool), we will update this Policy.

We and our providers use cookies, pixels, local storage, and similar technologies to operate the Platform, remember your preferences, measure performance, and — as described in Section 5 — support advertising and audiences. You can manage cookies through your browser and, where offered, through our cookie controls. For users in regions that require it, we present a consent banner and obtain consent before setting non-essential cookies or sharing data for advertising. We honor the Global Privacy Control (GPC) as an opt-out of sale/sharing.

This section supplements the Policy for California residents under the CCPA, as amended by the CPRA. In the past 12 months we have collected the categories of personal information described in Section 2, including identifiers, customer-records data, commercial information, internet/network activity, geolocation (approximate, from IP), and inferences. We collect this information from you, automatically, and from the Brand Scanner sources you submit, and use and disclose it for the purposes in Sections 3–6.

Sale and sharing. We sell and/or share personal information for cross-context behavioral advertising as described in Section 5 (creating custom and lookalike audiences and retargeting). The categories involved are identifiers (such as hashed email) and internet/network activity. We do not knowingly sell or share the personal information of individuals under 16. You have the right to opt out using our “Do Not Sell or Share My Personal Information” control or by enabling GPC.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes that require us to offer a “Limit the Use of My Sensitive Personal Information” right. If this changes, we will provide that control.

Your rights. Subject to legal limits, California residents may: know/access the personal information we collected; request deletion; request correction; opt out of sale/sharing; and not be discriminated against for exercising these rights.

How to exercise / confirmation. Submit a request at support@packsia.com or through the controls on the Platform. We will verify your request and respond within the time the law allows (generally 45 days, extendable). Where you opt out of sale/sharing or limit sensitive information, we will provide confirmation that your request has been processed. You may use an authorized agent. We will not discriminate against you for exercising your rights.

If you are in the EU/EEA, the UK, or another region with data-protection laws, the following applies. Packsia is the controller of your personal information for the purposes described here.

Legal bases

• Contract: to provide the Platform, your account, downloads, AI features, and payments.
• Legitimate interests: to secure, analyze, and improve the Platform and for direct first-party marketing, balanced against your rights.
• Consent: for non-essential cookies and for sharing data with advertising platforms to build audiences and retarget; you may withdraw consent at any time.
• Legal obligation: to comply with applicable law.

Your rights. You may request access, correction, deletion, restriction, or portability of your personal information, object to certain processing (including direct marketing), and withdraw consent. You may also lodge a complaint with your local supervisory authority.

International transfers. We operate from the United States and use providers (Section 7) that may process your information in the U.S. and other countries whose laws may differ from yours. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and the UK Addendum. By using the Platform, you understand your information may be transferred and processed in the U.S. and elsewhere.

We keep personal information for as long as needed to provide the Platform and for legitimate business and legal purposes (for example, we may retain transaction records for up to seven years for tax purposes). Retention periods vary by data type and context, considering the amount and sensitivity of the data, the purposes, and legal requirements. We may retain your AI generations, brand profile, and a creator's content and earnings history as needed to operate the Platform and meet our obligations; on account closure, we delete or de-identify personal information except where retention is required or permitted by law.

We use technical and organizational measures to protect personal information, including authentication and access controls, encryption in transit, and short-lived signed URLs for media. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your password and log out when using shared devices.

The Platform is intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.

We may update this Policy from time to time. We will revise the “Last updated” date and, for material changes, provide additional notice (for example, by email or a notice on the Platform). Your continued use after changes are posted constitutes acceptance.

Cait, Inc. DBA Packsia

17216 Saticoy St, Suite #224, Lake Balboa, CA 91406, United States

Email: support@packsia.com