Imprint

Last updated: August 9, 2026

Information under § 5 DDG

Contact

Responsible for Content

Responsible under § 18(2) MStV:

Dispute Resolution

Packbirdie is directed exclusively at businesses (B2B). We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Privacy Notice

Last updated: August 9, 2026

In short. Search and price comparison still work without an account. A recent conversation can be reopened on the same device for seven days. An optional account lets you keep conversations, products and supplier shops for repeat purchases and future price comparisons across devices. Packbirdie uses no advertising cookies or third-party analytics. Packbirdie assigns a random identifier to each search and records limited first-party journey events, but does not put your raw search text in those records. Product matching, supplier facts and commercial ranking remain rule-based. For incomplete or conversational searches, Packbirdie may send a shortened and redacted packaging brief to the hosted text provider described in section 3; account details, full conversation histories and uploaded image bytes are not sent. What you actively submit for an audit, price alert, sample kit or order request is handled only for that function and under the retention periods in section 8.

1. Controller

The controller for this website is:

2. What This Website Processes

Website Visit

When you visit the website, technically necessary access data may be processed so the site can be delivered securely. This may include IP address, date and time, requested URL, HTTP status, browser and device information, and referrer information. The legal basis is Art. 6(1)(f) GDPR.

The website does not use third-party analytics, advertising cookies, pixels or cross-site tracking tools. Packbirdie does record the limited first-party search journey described below. Events in one journey are linked only through a random search ID, not an account, cookie ID or cross-site identifier. Fonts are served locally from this website and are not dynamically loaded from Google Fonts.

Packaging Search and Price Comparison

When you enter a product description or search query, it is processed with deterministic rules to recommend packaging types and to rank visible supplier offers. The server assigns that search a random search ID and records its normalised packaging demand: product or pack type, volume, material, closure, quantity, delivery country and timing where available. Packbirdie also records the campaign channel and post identifier supplied in bounded landing-page parameters. If no channel parameter is present, only a coarse recognised referrer category such as Google, Bing, LinkedIn, Meta or “referral” may be used. Packbirdie also records limited first-party journey events such as a product-group view, supplier exit or price check. Raw free-text search queries, full referrer URLs or hostnames, account IDs and cross-site advertising identifiers are not written to these records.

Supplier product actions pass through a first-party redirect which validates the selected catalogue product, records the exit against the search ID and then opens the supplier's HTTPS product page. The redirect does not accept an arbitrary destination. If you later report that you contacted the supplier, received a quote, ordered, or found a mismatch, that status is stored against the same search ID. Development, test, QA, internal and staging journeys are classified and excluded from production product-market-fit reporting under server-controlled rules; the browser cannot promote a journey into the production report. The legal basis is Art. 6(1)(b) GDPR where processing is necessary to provide the requested function, and Art. 6(1)(f) GDPR for secure operation and proportionate service improvement.

Deterministic rules remain authoritative for all matching, compatibility, supplier, availability, minimum-order and price logic. When enabled, hosted AI may interpret a free-text brief or help explain a packaging trade-off using a bounded packet of those deterministic facts, as described in section 3. It cannot add a supplier or commercial fact to the comparison.

If you deliberately attach a packaging photo or brief, Packbirdie validates the file type and size and reads it only for the current chat turn. Raw attachment bytes are not written to the catalogue or chat-session database. Text extracted from a TXT, CSV, Markdown or PDF brief is shortened, redacted and handled like typed brief text. Password-protected PDFs are rejected.

Optional Accounts, Conversation History and Saved Portfolios

If you create an account, Packbirdie stores your email address, a salted one-way password hash, account timestamps, the conversations you keep and the products or supplier shops you choose to save. A conversation contains the redacted message text, Packbirdie's answer, the structured packaging request and the buyer-visible supplier-route snapshot needed to reopen that brief. A transcript stores only an attachment's file name and media type, never its raw bytes. The portfolio may include a packaging title, product or comparison key, supplier name, visible price and minimum order, product image reference and the validated Packbirdie supplier route. These records are used to resume sourcing and compare saved packaging against newer or cheaper supplier routes. Creating an account is optional and ordinary search remains available without one. Passwords are never stored in plain text. The legal basis is Art. 6(1)(b) GDPR.

Signing in creates a technically necessary, HTTP-only session cookie. The cookie identifies the account session but is not used for advertising or cross-site tracking. You can sign out at any time. Until self-service deletion is available, you may request deletion of the account and saved portfolio through the contact form.

Price Checks and Portfolio Audits

If you submit packaging positions and current purchase prices for a price check, the submitted lines, any contact details you provide, and the comparison result are stored as an audit record. This serves to provide the requested comparison and to maintain the anonymous market benchmark on which the service is built. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Please do not submit personal data of third parties or special categories of personal data — packaging specifications and prices are sufficient.

Price Alerts

If you set a price alert, your email address and the watched packaging specification are stored solely to inform you when the best visible price for that specification changes. The legal basis is Art. 6(1)(b) GDPR. You can have an alert deleted at any time by emailing the address above.

Saved Comparisons and Optional Notifications

Separately from search and outcome measurement, you may actively opt in to save a comparison and receive notifications about better supplier routes or a possible future pooled run. Packbirdie then stores the email address, search ID, selected notification preferences, notice version and consent time. The email address is not required for ordinary comparison or supplier access, is not added from another form, is not written to browser storage, and is not disclosed to suppliers. Notification choices and the consent checkbox are off until you select them. The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw at any time by emailing the address above, without affecting processing before withdrawal.

Sample Kits, Audits and Order Requests

If you request a paid sample kit, a packaging audit, or place an order request, the business name, contact person, email address and order data you provide are processed to handle that request, including invoicing. The legal basis is Art. 6(1)(b) GDPR and, for statutory retention duties, Art. 6(1)(c) GDPR.

Contact Form

If you use the contact form, Packbirdie stores the name, work email, optional company, selected topic and message you submit in a private operator queue so the request can be answered. Full IP addresses, user agents and referrers are not persisted with contact-request records, nor is a separate copy of the request payload. To protect the form from abuse, the application uses a short-lived in-memory rate-limit key derived from the requesting IP address. That key is not attached to the contact record and expires automatically with the protection window. Contact-form contents are not sent to an AI provider or a supplier. The legal basis is Art. 6(1)(b) GDPR for pre-contractual communication and otherwise Art. 6(1)(f) GDPR. The required checkbox confirms that you have read this notice; it is not consent to advertising.

3. Automated Interpretation and Hosted AI

Packbirdie uses Groq, Inc. as a hosted AI processor for three bounded tasks: interpreting an incomplete or conversational packaging brief, explaining verified comparison results in natural language, and assessing explicit style preferences against a supplied shortlist. The production text model is llama-3.3-70b-versatile. The matching engine remains authoritative for supplier identity, product grouping, material and dimensional constraints, availability, minimum-order, price evidence and final ranking.

For those text tasks, Packbirdie sends only the current shortened, redacted packaging message and a small packet of buyer-visible brief or shortlist facts. Account email addresses, full conversation histories, contact-form contents, audit records, price-alert contact details and supplier-account data are not included. Common email, telephone, address, URL, IP and customer/order identifier patterns are removed before transmission. A response is rejected if it adds an unsupported number or catalogue candidate.

Hosted image interpretation is disabled in the current production configuration. If you deliberately upload a packaging image, its bytes are validated and handled transiently inside Packbirdie's application and are not sent to Groq or stored in the conversation or database. Text and PDF attachments are also processed inside Packbirdie's application; extracted text is subject to the same redaction before any model-assisted interpretation.

Groq processes this data in the United States. Packbirdie relies on Groq's Data Processing Addendum and incorporated EU Standard Contractual Clauses for the transfer. Global Zero Data Retention is enabled for Packbirdie's Groq account, so Groq does not retain inference inputs or outputs. Groq still records service-usage metadata, which its documentation states does not contain model inputs or outputs. See Groq's data-control documentation. The legal basis for model processing requested in chat is Art. 6(1)(b) GDPR; security and bounded service-operation metadata rely on Art. 6(1)(f) GDPR.

4. Hosting, Logs and Abuse Protection

Packbirdie's production service uses Google Firebase Hosting, Google Cloud Run, Neon and STRATO. The configured service locations are Firebase Hosting global edge; Google Cloud Run europe-west3 (Frankfurt, Germany); Neon database AWS eu-central-1 (Frankfurt, Germany); STRATO email infrastructure in Germany.

Firebase Hosting is a global content-delivery service. It can process request and delivery metadata through Google's global infrastructure. Dynamic application requests are forwarded to Cloud Run in Frankfurt. Durable account, conversation, contact and journey records are stored in the Frankfurt Neon database. Neon, Inc. may provide support or otherwise process service data from outside the EEA, including the United States, under the transfer safeguards in its data processing agreement. Google and Neon are used under their applicable data processing terms; STRATO provides the domain email infrastructure under its applicable processing terms. Packbirdie maintains an internal processor record for these services.

To keep the service stable and protect it from abuse, the application uses short-term in-memory rate limiting based on IP address; inactive buckets expire automatically. Server and proxy logs may also be created for operations, troubleshooting, security and technical evidence. The production operator must configure a normal access-log retention period of no more than 14 days. Data relating to a documented security incident may be isolated and retained longer where necessary to investigate or establish legal claims. The legal basis is Art. 6(1)(f) GDPR.

5. Email and External Links

If you contact me by email, the contact details and contents you provide are processed to respond to your message. Email communication is handled through external email infrastructure provided by STRATO GmbH for the listed info@packbirdie.com address. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual communication and otherwise Art. 6(1)(f) GDPR.

Packbirdie is a comparison service: supplier offers link to the external shops of the respective suppliers. A first-party redirect records the selected product and search ID before sending your browser to the validated supplier product page. If you open a supplier route, you leave this website; the supplier is responsible for the subsequent processing of your data. Packbirdie does not add your email address, outcome response or raw search text to that redirect — you decide yourself what you enter on the supplier's pages.

6. Cookies and Local Storage

This website does not use analytics cookies, marketing cookies or cross-site tracking cookies. If you sign in, Packbirdie sets one technically necessary, HTTP-only account-session cookie for up to 30 days. It uses SameSite protection and the Secure attribute on production HTTPS. Signing out removes the active session. If this cookie policy changes, this privacy notice will be updated and, where required, consent will be requested.

Packbirdie uses browser session storage to carry a pending search from the homepage to the result page and to remember a one-way request digest while preventing accidental duplicate submissions. The pending search is removed when the result page consumes it and is ignored when more than 15 minutes old. Bounded channel and post attribution may travel inside that functional handoff; outside it, attribution and the random search ID remain in the open page's memory until the search or page session ends. Request state is removed after completion, and session storage is otherwise cleared when the browser session ends. Full contact or order-form contents are not stored there as the duplicate-submission fingerprint.

If you use Packbirdie without an account, the products or shops you actively save are kept in your browser's local storage so they remain available on that device. When you sign in or create an account, Packbirdie offers this local portfolio to the signed-in account and then removes the local copy after synchronisation. Session storage also remembers, for the current tab, whether you have answered the optional account question.

If you use Packbirdie without an account, the browser also keeps a bounded copy of recent buyer-visible conversations in local storage for up to seven days so you can reopen them on the same device. The server keeps the corresponding redacted anonymous chat session for the same period. When you sign in, recent conversations still held by that browser can be transferred to your account and the local history is then removed. Conversation history is functional storage and is not used for advertising or cross-site tracking.

The supplier-route outcome prompt does not use cookies, local storage or session storage. A pending prompt is kept only in the open result page's memory for no more than 30 minutes after a tracked supplier exit and can appear when that original tab regains focus or becomes visible. Closing or reloading the tab ends the prompt; there is no cross-session outcome reminder. Session and local storage are not used for advertising or cross-site tracking.

7. Recipients and Disclosure

Personal data may be disclosed to technical service providers where this is necessary for hosting, security or payment processing. If you use an optional payment link for a sample kit or audit, payment is processed by the payment provider named at that point (for example Stripe); your payment data is entered directly with that provider and is subject to its privacy terms. Further disclosure occurs only if legally required, necessary for legal defence, or based on your consent.

8. Retention

• Search journeys, outcomes and usage events: raw search text is not written to these records. Normalised first-party search journeys, supplier exits, outcome responses and related route events are deleted after 90 days.
• Portfolio audits: contact details and raw pasted text are removed or irreversibly anonymised no later than 90 days after submission. Normalised packaging lines and aggregate comparison values may remain while needed for the non-personal market benchmark; if they cannot be made non-attributable, they are deleted instead.
• Price alerts: an active alert expires after at most 365 days. Its email address is erased no later than 90 days after the alert is triggered or expires, unless you request earlier deletion.
• Saved-comparison notification opt-ins: an active opt-in and its email address and selected preferences expire after at most 365 days unless renewed, and are erased earlier if you withdraw.
• Accounts and saved portfolios: account data and the saved portfolio, including account conversation history, remain while the account is active so repeat sourcing works across visits and devices. An individual conversation is deleted when you delete it. The remaining account data is deleted when you request account deletion, except where a separate statutory duty requires a specific transaction record to be retained. Expired technical login sessions are removed independently.
• Anonymous conversation history: server-side redacted chat sessions and the corresponding buyer-visible same-device browser copy expire after no more than seven days. Raw attachment bytes are not included in either transcript.
• Unfulfilled managed requests: an unfulfilled sample-kit, audit or managed-stock request is deleted after 180 days. If a request becomes a contract, the necessary contractual and accounting record follows the statutory retention period instead.
• Contact-form messages: contact details and message text are erased no later than 90 days after the request is marked handled, and in every case no later than 180 days after submission. If the inquiry becomes a contract, only the necessary contractual or accounting information is moved into the corresponding business record; the general contact message does not become an indefinite archive.
• Orders and invoices: records required by German commercial or tax law are kept for the applicable statutory period and are not erased by the shorter product-analytics schedule.
• Technical data: the AI interpretation cache expires within one hour, in-memory rate-limit data expires with its short protection window, and normal server/proxy access logs must be configured for no more than 14 days. A documented incident record may be kept longer only where necessary for security investigation or legal claims.
• Backups: access-restricted operational database backups are rotated after 14 days. Data deleted from the live database may therefore remain in a backup until that backup expires. Backups are used only for disaster recovery; the retention maintenance is reapplied after a restore.

9. Your Rights

Subject to the GDPR, you have rights of access, rectification, deletion, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent with effect for the future. An informal email to the address above is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority. For non-public bodies in Bavaria, the competent authority is generally the Bavarian Data Protection Supervisory Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also contact another competent supervisory authority.

10. Security and Use Notice

The website is delivered via HTTPS. Even so, no internet-based processing can guarantee absolute security. Comparison results, prices, availability and material guidance are a research-informed first read and not procurement, legal or formulation advice. Information may be incomplete, inaccurate, or not applicable to your specific product, formula or order. Verify price, availability, shipping, minimum order quantities and material compatibility directly with the supplier — and by testing the filled product in the actual pack — before ordering.