Packful Privacy Policy

Last updated: 28 September 2026

Packful is an equipment-management service based in New Zealand. This policy covers the Packful app and websites at packful.app and its subdomains.

Privacy contact: [email protected].

Information we collect and why

Your organisation supplies your name, work email address and membership role when it invites you. We use these details to provide access, send sign-in codes and invitations, and identify you to authorised people in your organisation. We store authentication and session records to keep accounts secure.

We store the equipment, loadouts, QR identifiers, scan results, return outcomes, timestamps and notes entered through Packful. This information lets your organisation manage equipment availability, custody and returns. Other authorised members can see operational information, including who currently holds equipment; administrators can also manage member details. Access is restricted by organisation and role.

If you contact us, we use your message and contact details to respond. Our hosting and email providers also process technical information, such as IP addresses, request and error logs, and email-delivery records, to operate and secure the service.

Camera and device storage

Packful requests camera access to scan QR labels. Camera images are processed on your device; Packful does not record or upload the camera feed. Decoded QR values are sent to our backend to identify equipment or return locations and process your actions. You can withdraw camera permission in your device settings; scanning will then be unavailable.

The app uses secure device storage, and the web app uses browser storage, to maintain sign-in and recover an interrupted account-deletion request. These are functional uses, not advertising tracking.

Who processes your information

We use Convex for the database, authentication and backend, Resend to send transactional emails, and Cloudflare to host the websites and public assets. They receive the information needed to provide those services. Processing may take place outside New Zealand, including in the United States.

We require providers handling personal information for us to protect it under appropriate contractual obligations. We may also disclose information where required by law. Packful does not sell personal information, run advertising, or use advertising tracking SDKs.

Keeping and deleting information

We keep account information while your account exists. You can request permanent deletion through Account → Delete account, or the deletion option on the Access denied screen if you are signed in without an active membership. Deleting the app alone does not delete your account.

You must first reconcile outstanding loadouts and equipment custody. An active administrator or pending first administrator must leave another active administrator in place. The separate Packful operator identity is not eligible for self-service deletion. Contact us if you need help resolving access or custody before deletion.

When deletion is accepted, we remove your member profile and sign-in account, revoke access, and automatically clean up remaining authentication records. The app confirms completion. Deletion cannot be undone; returning requires a new invitation. Deactivating membership is different: it removes access but keeps the member record so an administrator can restore it.

Organisation equipment and operational records remain to support equipment management and completed-return records. References to your removed member profile display Deleted user. Deletion does not automatically search or rewrite free-text notes, which may contain personal information. Please avoid putting unnecessary personal information in notes, and contact us about personal information that needs correction or removal. We retain personal information only for as long as needed for its lawful purpose.

Packful's stored outgoing-email copies are eligible for automatic cleanup after seven days. Completed deletion receipts, which no longer contain your name or email, expire after seven days. Provider delivery logs and backup copies have separate retention periods and may remain temporarily after account deletion. Deleting your account does not remove emails already delivered to recipients.

Your choices and questions

Contact us to request access to or correction of your personal information, ask about deletion, or raise a privacy concern. We may need to verify your identity before acting. Your organisation's administrator can help with membership and equipment records. You can also contact the New Zealand Privacy Commissioner about a privacy complaint.

Changes

We will update this page when our practices change and revise the date above. We will bring material changes affecting your personal information to your attention through the app or email where appropriate.