Parcel — Privacy Policy

Parcel ("Parcel", "we", "us") provides an AI shopping-assistant app for Shopify stores. This policy explains what data we process when a merchant installs Parcel and when a shopper interacts with the Parcel widget. g. https://parcel-ia.com/privacy) and link it in your App Store listing.

1. Who is responsible

For personal data processed through the app, the merchant is the data controller and Parcel acts as a data processor on the merchant's behalf.

2. Data we access from the store

With the merchant's authorization (Shopify OAuth scopes), Parcel reads:

• Products & content (readproducts, readcontent, read_metaobjects):

• Orders (readorders) and customers (readcustomers): used only to

Parcel requests read-only scopes for these and does not modify your products, orders or customers.

3. Data from storefront shoppers

When a shopper uses the Parcel widget we process:

• The messages they type (their request, budget, constraints) and the

• Interaction events (e.g. which recommended product was clicked) for

The widget uses an anonymous session identifier. Parcel does not ask shoppers for card details and does not run advertising trackers.

4. Why we process it

To understand shopper intent, recommend relevant products, answer product and after-sales questions, and give the merchant aggregate performance analytics.

5. Subprocessors we share data with

• Cloud hosting / database (application backend and storage).
• AI/LLM provider (e.g. OpenAI) to generate recommendations and answers.
Prompts contain the shopper's request and relevant catalog/context; they are not used to train third-party models where an opt-out is available.

We share only what is necessary to deliver the service, under data-processing terms. We do not sell personal data.

6. Data retention & deletion

• Conversation and analytics data are retained only as long as needed to provide
the service, then deleted or anonymized.
• On uninstall / shop closure we delete the store's data.
• Parcel implements Shopify's mandatory GDPR compliance webhooks:
- customers/data_request — we compile any stored data for a shopper on request. - customers/redact — we erase a shopper's personal data. - shop/redact — we erase all data for the store (sent ~48h after uninstall).

7. Data subject rights

Shoppers and merchants may request access, correction, or deletion of personal data. Merchants can trigger these through Shopify; requests are fulfilled within the legally required window (typically 30 days).

8. Security

Data is transmitted over TLS. Internal service calls are authenticated. Access to production data is restricted to authorized personnel.

9. International transfers

Data may be processed in regions where our subprocessors operate, under appropriate safeguards (e.g. standard contractual clauses where applicable).

10. Changes

We will update this policy as the service evolves and revise the date above.

11. Contact

Questions or data requests: privacy@parcel-ia.com (replace with your monitored address).