Privacy Policy.

Ultimate Packing is operated by Arrow Web Solutions Ltd (“we”, “us”, “our”), a company registered in England & Wales under company number 07678606, with its registered office at 2 Apple Tree Close, Dalston, Carlisle, Cumbria, CA5 7LQ. We are the data controller for the personal data processed through the Ultimate Packing service.

We are a one-person business. We are not legally required to appoint a Data Protection Officer at our size, and we have not done so. For any privacy question, or to exercise your rights, the contact route is help@ultimatepack.app.

We collect the following personal data:

• Account & identity: your name, email address, password and (optionally) a profile photo. Your password is managed and hashed by our authentication provider, Clerk; we never see it.
• Sign-in with Google or Apple: if you choose to sign in this way, we receive your name and email address from that provider.
• Organisation & team data: your team name, who its members are, and their roles.
• Content you create: your packing items, events (trips) and profiles. Profiles may include the names of other people you pack for, such as family members, including children, and optionally a rough age band (for example “toddler” or “adult”, never a date of birth) or, for pets, a species. You are responsible for the information you enter about other people. Please keep it to a minimum, such as a first name or a label.
• Billing data: your name and billing details, handled through Stripe. Card numbers are handled by Stripe and are never stored by us.
• Technical & usage data: your IP address, device and browser information, and the actions you take in the app. We use this to keep the service secure, diagnose errors and understand usage in aggregate.
• What you type into the AI kit builder: if you choose to use it, the activity you describe (plus your item and tag names, to avoid duplicates) is sent to an AI model to suggest a packing list. This is optional, and how that text is handled is set out in section 5.

Under UK GDPR we must have a lawful basis for everything we do with your data. In plain English:

• Creating and running your account and providing the app: this is us performing our contract with you.
• Taking payment and keeping financial records: performing our contract, and a legal obligation under UK tax law.
• Keeping the service secure, preventing abuse, fixing bugs and understanding usage to improve the product: our legitimate interests, balanced against your rights.

We do not use your data for advertising, and we do not sell it.

To run Ultimate Packing we rely on a small number of trusted providers who process personal data on our behalf. Each is bound by a data processing agreement and may only use the data to provide its service to us.

Sentry and PostHog data stay in the EU. The AI providers are only sent data when you use the kit builder, and under a strict no-retention arrangement (see section 5). We will keep this list current; if it changes, this page is updated.

Ultimate Packinghas an optional feature that suggests a packing list from a short description of your trip or activity. If you use it, the text you type (along with the names of your existing items and tags, so it does not suggest duplicates) is sent to an AI model to generate the suggestions. If you pick who is going on the trip, the party is described to the model anonymously: at most an age band (“toddler”, “adult”) or a pet’s species. We do not send your account details, your team members, or anyone’s name.

These requests go through Vercel AI Gateway to Anthropic or Google under zero data retention. In plain terms: your prompt and the suggestions are used only to answer that one request, then deleted immediately. They are not stored by the gateway or the AI provider, and they are never used to train any AI model.

The feature is entirely optional. Nothing is sent to an AI provider unless you choose to build a list, and the suggestions are only saved to your library if you decide to add them. Please avoid typing sensitive personal information into the activity description.

Some of our providers are based in the United States, which means your data may be processed there. Where it is, the transfer is covered by approved UK safeguards: the UK Extension to the EU/US Data Privacy Framework, and/or the UK International Data Transfer Agreement (IDTA) or standard contractual clauses. In plain terms: these arrangements require those providers to protect your data to UK standards.

• Your account and content: kept while your account is open. If you close your account or ask us to erase your data, we delete or anonymise it within 90 days, unless we must keep some of it by law.
• Billing and tax records: kept for 6 years to meet HMRC requirements.
• Error logs: kept for a short period, up to 90 days.
• Analytics: held only in aggregate, not tied to you as an individual.

We do not use any tracking, analytics or advertising cookies. The only cookies we set are the strictly-necessary ones our authentication provider uses to keep you securely signed in. Our analytics are cookieless, and our error monitoring sets no cookies.

Because strictly-necessary cookies are exempt from consent under PECR, there is no cookie consent banner to click through, but we still set them out in full on our cookie notice.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased (the “right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable format;
• object to processing based on our legitimate interests.

To exercise any of these, email help@ultimatepack.app. We will respond within one month, as the law requires. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk; this does not cost you anything.

We take reasonable measures to protect your data, and we rely on established providers who do the same. No service can promise absolute security, but we use sensible safeguards appropriate to a service of this kind and keep them under review.

For most data we are the data controller. Where a business customer stores personal data about other people in the service, we act as a processor for that data. If you are a business customer and need a Data Processing Agreement, we can provide one on request; email help@ultimatepack.app.

We may update this policy from time to time. If we make a material change we will give reasonable notice, for example by email or an in-app notice. The “last updated” date at the top always reflects the current version.

Questions about this policy or your data? Email help@ultimatepack.app or write to us at Arrow Web Solutions Ltd, 2 Apple Tree Close, Dalston, Carlisle, Cumbria, CA5 7LQ.