Privacy Policy

1. Data controller

Controller: STE FLEXIBLE SOFT / Flexible Soft, RNE / Identifiant Unique 1613427Q, Tunisia. Registered office: Road Tunis Km 6, Street Mongi Slim, Sekiet Ezzit Building, Sfax, Tunisia. Privacy contact: info@sofflex.com. Telephone: +216 23 845 822. Pack Tools is its digital platform and not a separate legal entity.

2. Data we collect

• Account and authentication data: name, email address, password hash, account role and status, optional Google account identifier, session identifiers, and account timestamps.
• Service content: photos, image files, templates, event/session information, print jobs, output files, share links, filenames, file metadata, and settings that users choose to submit or generate.
• Billing and transaction data: selected package, amount, currency, token balance, entitlement and purchase status, provider reference, and billing address when required for Payoneer checkout.
• Technical and security data: IP address used for request throttling, request and error details, browser/device information made available in ordinary web requests, and security events.
• Communications: the contents and metadata of support, legal, privacy, or refund requests when contact channels are used.
• Browser storage: an HTTP-only authentication cookie and limited local/session storage for interface preferences and short-lived workflow notices.

3. Why data is processed

• Create and secure accounts, authenticate users, and provide requested product functions.
• Store, process, display, print, share, or delete user-directed photo and project content.
• Create orders, redirect to checkout, confirm payment status, deliver tokens or plan entitlements, prevent duplicate credit, and keep accounting records.
• Provide support, investigate complaints and refunds, protect the platform, throttle abusive requests, diagnose faults, and enforce the Terms.
• Comply with Tunisian legal, tax, accounting, regulatory, and valid authority requirements.

4. Cookies, analytics, and advertising

The authentication cookie is strictly necessary to keep a signed-in session and is HTTP-only, secure in production, same-site, and normally expires after seven days. Interface preferences may remain in the browser until changed or cleared; temporary workflow notices end with the browser session.

The current Pack Tools web application does not include a client analytics script or an active Google AdSense display script. The site publishes an ads.txt declaration for Google AdSense readiness. If analytics or advertising is activated later—including Google AdSense—this policy and any required consent controls must be updated before non-essential cookies or advertising identifiers are used.

5. Payment information

Electronic payments are handled by the provider displayed during checkout. Pack Tools exchanges order, status, provider-reference, and, where required, billing-address data needed to complete and reconcile the transaction. Full card numbers, card security codes, and comparable sensitive payment credentials are entered into and handled by the payment provider and are not intended to be stored by Pack Tools. Flouci is not described as active unless it is actually offered at checkout.

6. Sharing and processors

Data is shared only as needed with infrastructure, hosting/storage, authentication, email, and payment service providers; professional advisers; or public authorities acting under valid law. Google receives data only when optional Google sign-in or a future disclosed Google service is used. A checkout provider receives the information required for the selected payment method.

Some providers may process data outside Tunisia. Such transfers must be assessed and handled with safeguards and any notification or authorization required under the Tunisian personal-data framework. Pack Tools does not sell personal data.

7. Security

Reasonable technical and organizational safeguards include hashed passwords, hashed server-side session tokens, HTTP-only secure cookies in production, authenticated API access, input validation, request throttling, role checks, and restricted storage access. No system is completely risk-free; users should use a unique password and promptly report suspected unauthorized access.

8. Retention

• Authentication sessions: normally seven days from issue, or earlier on sign-out, revocation, or account deletion.
• Account/profile data and user-created content: while the account or relevant project remains active, until the user deletes eligible content through available controls or a verified deletion/closure request is completed, except for data that must be retained.
• Payment, invoice-equivalent, purchase, entitlement, and accounting records: at least ten years where they form part of records that Tunisian accounting or tax rules require the company to preserve.
• Support, complaint, privacy, and refund correspondence: for the time needed to resolve the request and any applicable claim or legal-retention period.
• Browser local/session storage: until the user clears it, changes the stored preference, or the browser session ends, depending on the item.
• Backups and security records: only for the applicable operational backup/security cycle, then overwritten or deleted, unless preservation is required for an incident or legal obligation.

9. User rights

Subject to applicable Tunisian law, a person may request access to personal data, correction or completion of inaccurate data, deletion where processing is no longer permitted or necessary, and may object to processing or withdraw consent where consent is the basis. A person may also ask for information about recipients and retention and may contact the competent Tunisian personal-data authority.

Send access, correction, deletion, objection, consent-withdrawal, or other data-protection requests to info@sofflex.com with enough information to verify identity and locate the data. Pack Tools will not ask for passwords or full payment credentials.

10. Tunisian framework and updates

Processing is intended to be handled under applicable Tunisian law, including Organic Law No. 2004-63 of 27 July 2004 on personal-data protection and applicable requirements of the Instance Nationale de Protection des Données Personnelles. This policy is not a waiver of any statutory right.

The policy may be updated when services, providers, laws, or retention practices change. The revised date will be shown, and material changes will be communicated through an appropriate site or account notice.