Privacy policy

Who processes what

Parcelgrove is a Shopify parcel-tracking app. A merchant installs it on their store, and it shows that merchant's customers where their order is.

That distinction governs everything else: for end-customer data (orders, shipping addresses, emails), the merchant is the data controller and we are their processor. We process that data only to provide the service, on their instructions. For the merchant's own data (account, settings, subscription), we are the controller.

The data we process

About the merchant:

• their Shopify store domain and name, language and time zone
• their contact and support email address
• their settings: tracking page appearance, email content, delivery times, integration keys
• their plan, quota and parcel volume

About end customers, only what Shopify sends us for fulfilled orders:

• the order name and its Shopify identifier
• the recipient's email address and name
• the delivery city, postal code and country
• tracking numbers and the tracking events returned by carriers

We do not request the Shopify customer-record scope (read_customers). We see no purchase history, no phone number and no payment method.

On the public tracking page, we count visits and searches to feed the merchant's statistics. The technical fingerprint that tells two visitors apart is kept for 90 days, then deleted; only aggregate counters remain.

Why we process it

• to show the end customer the status of their order on the merchant's tracking page
• to send, when the merchant enables them, notification emails at each parcel step
• to estimate a delivery date and flag stalled parcels to the merchant
• to produce the store's shipping statistics
• to run the subscription and count the quota
• to provide support and keep the service secure

The legal basis for processing end-customer data is the performance of the contract between the merchant and their customer, together with the merchant's legitimate interest in keeping that customer informed about delivery. For merchant data, it is the performance of our contract with them.

What we never do

• we do not sell or rent any data
• we do not use one merchant's data for advertising or for another merchant
• we do no profiling and take no automated decisions with legal effects
• we set no advertising cookies and no third-party trackers on the tracking page

Who we share it with

We rely on the providers below, each bound by a data-processing agreement and each receiving only what it needs. The last two receive anything at all only if the merchant has connected their own account.

Transfers outside the European Union

The application database is hosted in the European Union, in Ireland. Some providers are established outside the Union: those transfers rely on the European Commission's standard contractual clauses.

Carriers and the tracking aggregator, established in China and Hong Kong, receive a tracking number and nothing else: no name, no address, no email.

How long we keep it

• a store's data is erased 48 hours after the app is uninstalled, with no action needed from anyone
• an end customer's data is anonymised as soon as Shopify forwards their erasure request
• tracking-page visitor fingerprints are deleted after 90 days
• technical logs are kept as long as diagnosis requires, then deleted

Your rights

If you are a customer of a store that uses Parcelgrove, your contact is that store: it decides what happens to your data. Send it your access, rectification or erasure request; it forwards the request to us through the channel Shopify provides, and we carry it out.

If you are a merchant, write to parcelgrove@gmail.com to access, correct or erase your data, request a copy of it, or object to a processing activity. You may also lodge a complaint with the data protection authority of your country.

Security

Traffic is encrypted in transit. Merchant API keys are stored encrypted and never displayed again in clear text. Shopify webhooks are authenticated by signature. Access to production data is limited to the company's two members.

In dropshipping mode, the tracking page never shows the tracking number, the origin carrier or the departure country: that rule is enforced server-side, not by hiding things on screen.

Minors

The service is aimed at businesses. We do not knowingly collect data about minors.

Changes

This policy changes as the application changes. The last-updated date appears at the top of the page, and any significant change is announced to merchants by email.

Contact us

Any question about this policy: parcelgrove@gmail.com.