Privacy Policy

Parcely (“we”, “the app”) provides branded order tracking and post-purchase notifications for Shopify merchants. This policy explains what data we process and why.

Data we process

• Order & fulfillment data — order name, tracking number, carrier, fulfillment status.
• Customer contact data — name, email, phone, and shipping destination — used solely to display the tracking page and send shipment notifications. This is “protected customer data” under Shopify’s requirements.
• Shop settings — your branding, notification rules, and preferences.

Why we process it

To show your customers a branded tracking page and send them email/SMS updates about their shipment. We do not sell personal data or use it for advertising.

Sub-processors

• Shopify — source of order/fulfillment/customer data.
• Resend — transactional email delivery.
• Tracking aggregator (e.g. Ship24) — carrier tracking lookups (tracking number only).
• SMS/WhatsApp provider (e.g. Twilio) — when SMS notifications are enabled.
• AI providers (BYOK) — only when you enable AI features with your own API key; we minimize and never send full customer records.

Security & retention

Data is encrypted in transit (TLS) and sensitive secrets (access tokens, API keys) are encrypted at rest (AES-256-GCM). We retain shipment data only as long as needed to provide tracking, and remove all shop data after uninstall.

Your rights (GDPR/CCPA)

We honor Shopify’s privacy webhooks: customers/data_request ((export)), customers/redact (erase a customer), and shop/redact (erase all shop data 48h after uninstall). To request access or deletion, see Data deletion or email parcely@webb9.com.