Privacy Policy

1. Who we are

PalletBrain is operated by Vipertech IT Solutions Ltd, registered in the United Kingdom ("we", "us"). We are the data controller for personal data processed through the PalletBrain website and application (the "Service"). Contact: hello@palletbrain.com.

2. What we collect

Account data: your name, email address, company name (optional), and a securely hashed password when you create an account.

Content you create: box types, pallet configurations, team names, and team membership — including content you choose to share with your team.

Billing data: when paid plans launch, payments are processed by Stripe; we receive your plan, billing status, and partial card details (never full card numbers).

Usage and technical data: preferences (theme, units, last-used settings), and standard technical logs (IP address, browser type) generated by our hosting providers for security and operations.

3. Why we process it

To provide the Service (contract): operating your account, saving your content, sharing team libraries with your team, and processing payments.

To communicate with you (contract / legitimate interests): account activation, password resets, team invitations, and important service notices.

To keep the Service secure and improve it (legitimate interests): monitoring for abuse, fixing errors, and understanding aggregate usage.

Where we rely on consent (for example, optional marketing emails, if introduced), you can withdraw it at any time.

4. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract: Supabase (database, authentication, and hosting of your account and content), Resend (transactional email delivery), and Stripe (payment processing). We also use Umami for cookie-free website analytics, which only involves aggregated, non-identifying usage data (see below).

Content you save to a team is visible to that team's members. We may disclose data where required by law.

5. International transfers

Some providers may process data outside the UK/EEA. Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

6. How long we keep it

We keep your account data and content while your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain records (for example, billing records for tax purposes, typically 6 years). Content shared to a team may persist for the team after you leave, attributed to your former account.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. To exercise any right, email hello@palletbrain.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

8. Security

Data is encrypted in transit, passwords are hashed, and access to production data is restricted. Row-level security controls ensure users and teams can only access their own data. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant authority as required by law.

9. Cookies and local storage

We use essential browser storage only — to keep you signed in and remember preferences such as theme and units (for example, a "palletbrain-auth" entry in your browser's local storage). This is necessary for the Service to function and does not require consent under UK/EU cookie rules.

For website analytics we use Umami, a privacy-focused, cookieless analytics tool. It does not set cookies or use any persistent identifier to track you across visits or websites, and it does not collect personal data — only aggregate, anonymised statistics such as page views, referrers and counts of key actions (for example how many people sign up or start a calculation). Because it is cookieless and non-tracking, no cookie consent banner is required.

We do not use advertising cookies or third-party tracking pixels. If this changes in the future, we will update this policy and request your consent where required.

10. Changes

We may update this policy from time to time. Material changes will be notified via the Service or email. The "last updated" date above reflects the current version.