Privacy Policy

This policy describes how Outerpack (a service of Wolff Creative) collects, uses, and protects personal information when you visit outerpack.com or use the Outerpack platform as a brand customer. It is separate from each brand's own privacy policy that governs the relationship between that brand and its shoppers.

• You as a brand customer of Outerpack. We act as the data controller for the data you give us directly (account info, billing).
• Your shoppers using your Outerpack-hosted storefront. You are the data controller; we are a data processor acting on your behalf. Your privacy policy governs your shoppers, not ours.

• Account info — name, email, password (hashed), brand info, role.
• Billing info — handled by Stripe; we store only the last 4 digits of the card and Stripe customer/subscription IDs.
• Usage data — pages visited in the admin, feature usage, error logs — used to operate and improve the service.
• Support communications — what you tell us via email or contact form.

• Standard server logs (IP, user agent, request path) for security and abuse prevention. Retained 30 days.
• Privacy-respecting analytics (no third-party trackers required to operate the site). We don't set advertising cookies on outerpack.com.
• Anything you submit through the contact form.

When a shopper places an order on a brand's storefront, we process their email, name, addresses, phone, and order content as a processor on the brand's behalf. We never sell this data, never use it to train models, and never use it to market across brands. Stripe processes payment information directly — we never see full card numbers.

• To operate the service you signed up for.
• To bill you and pay applicable taxes.
• To respond to your messages and provide support.
• To send service emails (security alerts, billing, important changes).
• To investigate abuse and protect the platform's security.
• To improve the product (always against aggregated data, never tied to identifiable individuals).

• Stripe — for payments and Stripe Tax. Their privacy policy: stripe.com/privacy
• Supabase — our database and authentication provider. supabase.com/privacy
• Vercel — our hosting provider. vercel.com/legal/privacy-policy
• Resend — transactional email delivery. resend.com/legal/privacy-policy
• Cloudflare — DNS and CDN. cloudflare.com/privacypolicy
• Law enforcement — only when legally required and only the minimum necessary, with advance notice to you where lawful.

We don't sell personal information. We don't use your or your shoppers' data to train AI models.

Primary data is hosted in the United States (US-West) on Supabase / Vercel infrastructure. Backups are encrypted and stored in the same region. Enterprise customers can request a region-specific dedicated tier.

• Account data — for the life of your account, plus a reasonable wind-down period after cancellation.
• Order and transaction data — at least 7 years for tax and audit reasons.
• Server logs — 30 days.
• Support emails — 24 months.

Depending on where you live, you may have the right to access, correct, port, or delete your personal information; to object to or restrict certain processing; and to lodge a complaint with a supervisory authority. Email privacy@outerpack.com and we'll respond within 30 days.

California, Colorado, Connecticut, Utah, Virginia, and similar US state laws apply. EU/UK GDPR applies for EU/UK residents. We don't engage in "sale" or "sharing" of personal information as those are defined under California law.

Outerpack.com uses only strictly-necessary cookies (session, CSRF). Brand storefronts are configured by the brand and may set additional cookies (analytics pixels, marketing trackers). The brand's privacy policy governs that.

Outerpack is not directed to children under 13, and we don't knowingly collect their information.

We'll post updates to this policy here and email account owners for any material change. The "last updated" date at the top reflects the latest version.

Privacy questions or requests: privacy@outerpack.com. General contact: outerpack.com/contact.