Version: 2026-10-13.1. Effective: 13 October 2026.
1. Controller
BATA BALÁZS E.V., Hungarian sole trader; tax number 59656029-1-27; sole trader registration number 57704638. Registered and postal address: 2490 Pusztaszabolcs, Gépállomás utca 22/1., Hungary. Privacy contact: hello@mitvigyek.hu, the shared support address for Packing What. Website: https://packingwhat.com. Application: https://app.packingwhat.com.
2. Data, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Sign-in and account | Email, display name, optional phone, language, timezone; sign-in time, code hash, attempts, IP hash, session and mobile tokens | Contract performance; legitimate interest in preventing abuse |
| Packing and AI requests | Traveller name/nickname, relationship, type, optional gender, date of birth, sizes, avatar and notes; destination, accommodation, dates, activities, weather, rules and lists | Contract performance for the account holder. Identifiable data about others requires their prior consent; for children, appropriate guardian authority |
| Requested sharing | List, traveller/trip information visible on the shared page, access link | Requested service; a separate legal basis is needed for other individuals' data |
| Purchases and entitlement | Internal user ID, email, provider customer/transaction IDs, package, amount, currency, billing information, subscription/refund status, balance and usage; accepted document version, hash and timestamp | Contract performance; legal obligations for required records |
| Support, withdrawal and complaints | Contact details, notice/name, messages, purchase information, reference, dates and responses | Contract or legitimate interest; legal obligation for consumer complaints |
| Security and operation | Server logs, IP and request information, errors; AI request ID, model, token usage, result/error, user/trip identifiers | Legitimate interest in operating a secure service and investigating errors |
Required information is necessary for the related function; optional fields may be left blank. Tell another person how their data will be used before entering it. The account holder's contract does not replace that person's consent. For children, hold appropriate representative authority. Consent may be withdrawn and deletion requested. We recommend nicknames and general preferences instead of identifying details.
We do not request health data or other special-category information. Free text or an item referring to medication can still contain it: do not enter it. Permitting such information would require a separate legal basis and protection; it is outside the intended use.
3. AI and service providers
For an AI request, we send the OpenAI API the trip dates, destination and country, accommodation type/name, transport, activities, weather and travel notes; traveller internal IDs, type, gender, calculated age and notes; existing item names and their assignment to travellers.
The constructed AI data package has no separate email, traveller-name, photograph or date-of-birth field. Free text can still contain personal information, so the package is not automatically anonymous. Manual features work without AI. The suggestion is not an automated decision producing legal effects.
We do not request persistent storage of AI responses in our application; that does not mean all provider retention is disabled. Under OpenAI's standard API handling, data is not used for model training by default; security logs may generally be kept for up to 30 days, with exceptions. See OpenAI API data handling and its data-processing agreement.
| Provider | Role and data |
|---|---|
| Rackhost Zrt. | Hosting: technical handling of the database, uploads and server logs. Data-processing information. |
| Zoho services in Europe (Mail / ZeptoMail) | Transactional sign-in and purchase/withdrawal emails: recipient, message and delivery/technical data. The shared support mailbox stores incoming enquiries, attachments and replies. Zoho privacy and processing information. |
| OpenAI API | Processes the AI request described above under its applicable processing terms. |
| Billingo | Manually issued invoices: customer name, billing address, email, supplied business tax ID, items and consideration; required invoicing and retention. Billingo privacy. |
| Stripe | Web payment: email, internal user ID, package, billing/payment information and entitlement state. Our backend does not receive the full card number or security code. Stripe is also a separate controller for some purposes. Stripe privacy. |
| Google Places | If location autocomplete is used: typed search, search session and connection information, directly from the device. You may enter a location manually. Google privacy. |
| Apple / Google Play / RevenueCat | These purchase channels are not active yet. Before launch, the notice will explain store purchase IDs, products, transactions and entitlement processing. Lists are not sent for entitlement management. RevenueCat privacy. |
A sharing-link recipient also receives information and may pass the link on. Revocation does not remove copies already made. We may provide information to an authority when lawfully required.
Access from outside the EEA may occur. Applicable safeguards can include adequacy decisions, European Commission standard contractual clauses and supplementary protection, according to the service and transfer. See the above OpenAI agreement, Stripe transfer terms and Zoho privacy FAQ. Ask the controller about safeguards for a particular transfer. We do not claim all data always remains in Hungary or the EU.
4. Retention and deletion
| Data | Period or condition |
|---|---|
| Account, travellers, trips and lists | While the function is used, or until deletion. Some removed list items remain after logical deletion; not all records currently have automatic permanent-deletion deadlines. Deletion of remaining information can be requested. |
| Avatar files | While the related profile is used. Removing a profile does not always immediately delete its image file; deletion of a remaining copy can be requested. |
| OTP/sign-in records and revoked mobile tokens | As needed to verify sign-in and investigate abuse. Code expiry is different from record deletion; automatic removal is not configured for every record. |
| Technical, AI and webhook logs | While needed for operation, payment reconciliation or security. Necessity is reviewed; permanent-deletion schedules are not automated for all log types. |
| Consumer complaints and responses | 3 years under the applicable Hungarian complaint rules. |
| Invoices and tax records | Until the applicable tax-record retention and assessment limitation periods end; proceedings may extend these. Invoices also enter Billingo. |
| Backups | Until the copy is overwritten or deleted. Removal from backups is not immediate; remaining copies are addressed separately when handling a deletion request. |
| Records isolated for a legal dispute | For the necessary claim period and resolution, with restricted access. |
Account deletion can be initiated in profile settings. It does not itself cancel an external subscription or remove records a provider must lawfully retain. Web order/withdrawal records are separate from deletable account data, and some purchase documents remain after account deletion for required retention and dispute handling.
5. Security, storage and your rights
Access is tied to an account and permissions, and transmissions use HTTPS. Sign-in secrets and payment server keys are not published. See our cookies and device-storage notice.
You may request access, correction, deletion, restriction and, where applicable, portability; object to legitimate-interest processing and withdraw consent. We handle requests within one month and notify you of any justified extension. We only request identification to the extent necessary. Contact hello@mitvigyek.hu. GDPR.
You may complain to a competent supervisory authority, including the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; postal address 1363 Budapest, Pf. 9., Hungary; see official procedures. Court remedies remain available.