1.Who we are
Palletable Ltd (“Palletable”, “we”, “us”) provides cloud software for production, stock, procurement, order management and shipping. We are registered in England and Wales under company number 17169066, with our registered office at 3 Tiffield Close, Portsmouth.
We are the controller of the personal data described in this policy, except where we process customer data on a customer’s behalf (see section 3). Questions can be sent to gainautomation@outlook.com.
2.What we collect
We collect only what we need to run the service:
- Account data – name, work email, phone number, company name and address, job role and login credentials (passwords are stored hashed).
- Billing data – the modules you subscribe to and your Direct Debit mandate details, handled by our payment provider GoCardless. We do not see or store your full bank details.
- Usage data – log-ins, features used, IP address, browser and device information, and error logs.
- Enquiries – anything you send through our contact form or by email.
- Cookies and similar technologies – see section 8.
3.Customer data we process for you
When you use Palletable, you and your staff enter data about your own stock, orders, suppliers, couriers and employees. For that content, you are the controller and we are your processor. We process it only on your documented instructions, to provide the service, and under the data processing terms in your agreement with us.
You are responsible for having a lawful basis to put personal data (for example your customers’ delivery details or your staff’s names) into the platform.
4.How and why we use your data
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and managing your account and providing the service | Contract |
| Taking payment and managing subscriptions | Contract; legal obligation |
| Security, fraud prevention and service improvement | Legitimate interests |
| Responding to enquiries | Legitimate interests; steps before a contract |
| Service and product update emails | Contract / legitimate interests (you can opt out at any time) |
| Marketing to people who have opted in | Consent |
We do not sell personal data, and we do not use customer data to train AI models for other customers.
5.Who we share data with
We share data only with trusted providers who help us deliver the service, under written contracts:
- Payment processing – GoCardless
- Cloud hosting and infrastructure providers
- Email and customer-support tooling
- AI assistant provider – Anthropic (see “Otto, our AI assistant” below)
- Couriers and carriers you choose to connect (data is sent only when you book a shipment)
- Professional advisers, and authorities where the law requires it
Otto, our AI assistant. Otto, the chat assistant on our website and demo, is powered by an AI model from Anthropic, a US-based AI provider. When you send Otto a message, the recent messages in that conversation are sent to Anthropic’s servers, which are outside the UK and EEA, so that it can write a reply. Anthropic acts as our processor under its commercial terms: it does not use these messages to train its models by default, and it normally deletes them within 30 days. We do not store your conversation with Otto on our servers; it is kept only in your browser tab and is cleared when you log out or close the tab. Please do not share passwords, payment details or other sensitive personal information with Otto.
If our business is sold or reorganised, data may transfer to the new owner under the same protections.
6.International transfers
We aim to keep data in the UK or European Economic Area. Messages you send to Otto are processed by Anthropic, which currently processes data in the United States. Where a provider processes data elsewhere, we rely on an adequacy decision, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard.
7.How long we keep it
We keep account and billing records for as long as you are a customer and for six years afterwards to meet tax and accounting rules. Customer content is deleted or returned within 30 days of your account closing, unless the law requires otherwise. Enquiries are kept for up to 24 months. Backups roll off on a fixed cycle.
8.Cookies
We use essential cookies and browser storage to keep you signed in, to complete sign-up and to hold your Otto chat for as long as the tab is open. We do not use advertising cookies. If we add analytics that are not strictly necessary, we will ask for your consent first. You can block cookies in your browser, though parts of the site may then stop working.
9.Security
We use encryption in transit, access controls, hashed credentials, logging and regular backups. No system is perfectly secure; if a breach affects your data we will notify you and the ICO where the law requires.
10.Your rights
Under UK data protection law you can ask us to access, correct, delete or restrict your data, object to processing, and request a portable copy. Where we rely on consent you can withdraw it at any time. Email gainautomation@outlook.com and we will respond within one month.
If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
11.Changes to this policy
We may update this policy as the service evolves. The date at the top shows the latest version, and we will notify account holders of material changes.