Privacy Policy

PackStack is scheduling software for small service businesses, run by Ryan Royalty, an individual based in New Hampshire, USA ("we", "us"). This policy says what PackStack stores, who else sees it, how long it's kept, and how to have it removed. We don't sell personal information, show ads, or use any analytics or tracking service.

Whose information this covers

A business on PackStack (its owner and admins) decides what goes into it, including information about its clients and their pets. We store and process that information on the business's behalf. If you're a client of a business that uses PackStack, the business is your first point of contact about your information, and we'll help it answer your request.

What PackStack stores

• Your account: your name, email address and, if you add it, your phone number, and your role in each business. If you sign in with Google, we also receive and keep your Google profile name, email address and profile picture link.
• Signing up: the business name and web address you choose, and your name and email address. A sign-up that isn't confirmed expires after 24 hours and is deleted within the next day. When you sign up, we record which version of the Terms and this policy you agreed to (the date at the top) and when you submitted the form; the record stays with the business once it's created.
• What a business enters: client names, email addresses and phone numbers; pet names and details; home addresses, neighborhoods and care or access instructions; the schedule; status updates; notes and comments; and alerts.
• Activity history: a log of who changed what in a business and when, including the before-and-after values of edited fields. Its entries are kept for 3 years.
• Billing: your Stripe customer and subscription identifiers and your subscription status. We never see or store your card number. To limit free trials to one per owner and per card, we keep a record of each trial that holds one-way scrambled forms of the owner's email address and of the card identifier Stripe gives us, the business's identifier and web address, its Stripe subscription identifier, and when the trial started and whether it ended early; these records are kept after a business is deleted.
• Notifications: if you turn on notifications, the address your browser's push service gives us for this device.

Who else sees it

We share information only with the services PackStack needs to run:

• Amazon Web Services (United States) hosts PackStack, its database and backups, and sends its email. AWS also keeps our server logs and access logs, which record IP addresses, the pages requested, and in some cases email addresses.
• Stripe takes payments. At checkout it receives the owner's email address and your business's identifier, and collects card details directly; Stripe handles them under its own privacy policy.
• Google, if you choose to sign in with Google. We ask only for your basic profile and email address, keep the sign-in tokens Google issues, and use what Google shares only to sign you in.
• The US National Weather Service. If you allow it, your browser sends your device's location straight to the National Weather Service to show the local forecast. PackStack's servers never receive or store that location.
• Your browser's push service (Apple, Google, Microsoft or Mozilla) delivers notifications. A notification can include a pet's or a team member's name, the time of a walk, or the text of an alert the business writes. PackStack never adds an address or a client's contact details to one.

Within a business, team members can see what they need for their work: everyone in the business can see clients, pets, addresses and the schedule, while team members' phone numbers and the activity history are for owners and admins. We may also access a business's information to support it, fix problems, or comply with the law. We'll disclose information if the law requires it.

PackStack's servers and database are in the United States. We email you only about your account (sign-in links, invitations and sign-up confirmation), and Stripe emails failed-payment and expiring-card notices; invoices are in the billing portal. We send no marketing email.

Cookies and storage on your device

• A sign-in cookie that keeps you signed in for up to 30 days after your last visit.
• Short-lived cookies used only while you sign in.
• On the demo site, a cookie that identifies your temporary demo business for 24 hours.
• Your display preferences, such as the schedule view, a few dismissed-banner and weather settings, and the last forecast, kept in your browser (the preference cookie lasts up to a year).
• A copy of what you've recently viewed, so the app works without a connection (copies older than 7 days are removed the next time the app opens), and any changes waiting to be sent. Signing out in the app signs you out of every business in that browser or installed app. For the business you signed out of, it also deletes that copy and any waiting changes and turns off its notifications there. To clear another business you use there, sign in to it and sign out again. Switching accounts from a sign-in, sign-up or invite page clears nothing. When a different person next opens a business there, the device stops getting the previous person's notifications from it.

We use no advertising, analytics or third-party tracking cookies.

How long information is kept

• A business's information is kept while the business exists, including after its subscription ends, so it can be picked up again.
• A business that never finishes subscribing is deleted about a week after sign-up.
• Demo businesses are deleted within two days of being created.
• Records of automatic status changes made by a business's triggers are deleted 90 days after the day they apply to; cleared alerts and activity history after 3 years.
• Server logs are kept for about 30 days. Automatic database backups are kept for 7 days, and a backup taken by hand before a major update is deleted within 30 days.
• Records used to limit repeated requests, which hold IP and email addresses, are deleted automatically, usually within a few days.
• Trial records are kept indefinitely, including after the business is deleted.

Your choices and requests

To get a copy of your information, correct it, or have it deleted, email rroyaltywebdev@gmail.com. A business owner can ask for the whole business to be exported or deleted; a team member or client can ask about their own information. We'll answer within 30 days. Deleted information leaves our database backups within 30 days, and we keep only what we must for billing, tax or legal reasons, and the trial record described above.

Security

Connections to PackStack are encrypted, the database is encrypted at rest, and sign-in links and invitations are single-use and stored only in scrambled form. No system is perfectly secure; if a breach affects your information, we'll tell the affected businesses promptly.

Children

PackStack is for businesses. Owners must be at least 18, and we don't knowingly collect information from children under 13.

Changes

If we change this policy in a way that matters, we'll email business owners before it takes effect. The date at the top shows the latest version.

Contact

Questions or requests: rroyaltywebdev@gmail.com.