1
About This Policy
This Privacy Policy applies to all services provided by Parcelace Tech Solutions Private Limited ("ParcelAce", "we", "us", or "our") including the ParcelAce website at parcelace.in, the ParcelAce logistics dashboard, the ParcelAce iOS and Android mobile applications, the Hublle WhatsApp commerce integration platform, and all associated APIs and services.
By accessing or using ParcelAce's services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of our services.
Who this applies to: This policy applies to senders (merchants and businesses using ParcelAce), recipients (end customers receiving shipments), and visitors to our website and applications.
This policy should be read alongside our Terms of Use. In the event of any conflict between this Privacy Policy and our Terms of Use, this Privacy Policy governs with respect to privacy matters.
2
Who We Are
ParcelAce is a custom logistics solutions company operated by Parcelace Tech Solutions Private Limited, a company incorporated under the Companies Act, 2013 in India.
3
Data We Collect
We collect personal data that is necessary to provide our logistics and technology services. The categories of data we collect depend on your relationship with us — whether you are a merchant client, a shipment recipient, or a website visitor.
3.1 Merchant / Business Client Data
| Data Category | Examples | Collected |
|---|
| Account & Identity | Name, company name, GSTIN, PAN, email address | Yes |
| Contact Information | Phone number, WhatsApp number, business address | Yes |
| Shipment Data | AWB numbers, pickup/delivery addresses, consignment values, product descriptions | Yes |
| Financial Data | Bank account details for COD remittance, billing information | Yes |
| Usage Data | Dashboard activity, feature usage, login timestamps, API usage | Yes |
| Communication Records | Support queries, WhatsApp messages with our team | Yes |
| Payment Card Data | Full card numbers or CVV | No — handled by payment gateway |
3.2 Shipment Recipient Data
| Data Category | Examples | Collected |
|---|
| Identity | Recipient name | Yes |
| Contact | Phone number, WhatsApp number | Yes |
| Address | Delivery address, pincode | Yes |
| Order Information | Order ID, AWB, product description, COD amount | Yes |
| Delivery Feedback | NPS ratings, delivery confirmation responses, NDR responses | Yes |
| WhatsApp Interaction | Messages exchanged with AI agent for delivery/pickup queries | Yes |
| Biometric / Sensitive Data | — | Not collected |
3.3 Website & Application Visitor Data
- IP address and approximate geographic location (country/city level)
- Browser type, device type, operating system
- Pages visited, time spent, referral source
- Cookies and tracking pixel data (see Section 10)
- Form submissions (contact forms, demo request forms)
4
How We Collect Data
Directly from you
- When you create a ParcelAce account or register as a client
- When you book shipments or create AWBs through our platform
- When you submit a contact or demo request form on our website
- When you interact with our WhatsApp support or AI agent
- When you respond to NPS or delivery feedback prompts
- When you communicate with our team by email, phone, or WhatsApp
From our merchant clients (on behalf of recipients)
Merchants using ParcelAce provide recipient data (name, address, phone) when creating shipments. Merchants are responsible for ensuring they have the appropriate legal basis and consent to share recipient data with us for the purpose of shipment processing and last-mile communication.
Automatically
- Usage and log data collected automatically when you use our dashboard or applications
- Cookies and analytics tools when you visit our website (see Section 10)
- Device and technical information collected by our mobile applications
From third parties
- Courier partner scan and tracking data linked to your AWBs
- Shopify, WooCommerce, and other e-commerce platform integrations (when connected by the merchant)
- WhatsApp Business API (Meta) for message delivery and status data
5
How We Use Your Data
We use personal data only for purposes that are necessary, proportionate, and clearly described below.
5.1 Core Logistics Operations
- Creating, booking, and tracking shipments on your behalf
- Coordinating pickup scheduling, delivery attempts, and reverse logistics
- Communicating shipment status to recipients via WhatsApp, SMS, or tracking link
- Processing COD collections and remitting funds to merchant accounts
- Resolving delivery exceptions, NDRs, and failed pickups
- Generating shipping labels, invoices, and MIS reports
5.2 Platform & Technology Services
- Operating and maintaining the ParcelAce dashboard and mobile applications
- Providing branded tracking pages, WhatsApp notifications, and delivery feedback modules
- Operating AI WhatsApp agents and Voice AI calling agents on behalf of merchants
- Powering Hublle's WhatsApp commerce integration features
- Enabling Shopify, WooCommerce, and API integrations requested by merchants
5.3 Account Management & Support
- Verifying your identity and managing your account
- Responding to support queries, escalations, and service requests
- Sending operational communications — service updates, billing, scheduled maintenance
- Managing billing, invoicing, and payment reconciliation
5.4 Safety, Security & Compliance
- Detecting and preventing fraud, weight mismatch disputes, and fake delivery remarks
- Verifying COD delivery authenticity through AI calling agents
- Complying with applicable laws, court orders, and regulatory requirements
- Maintaining records required under GST, customs, and logistics regulations
5.5 Analytics & Service Improvement
- Analysing shipment patterns to improve routing and delivery performance
- Using aggregated, anonymised data for operational planning and courier partner management
- Understanding how our platform is used to improve features and user experience
5.6 Marketing (with consent)
- Sending promotional communications about new features, services, or offers — only where you have opted in
- Sending case studies, operational insights, or logistics resources — only to existing clients or opted-in contacts
- You may opt out of marketing communications at any time (see Section 13)
We do not sell your data. ParcelAce does not sell, rent, or trade personal data to third parties for their own marketing purposes. We are an ad-free platform.
6
Legal Bases for Processing
We process personal data under one or more of the following legal bases depending on the nature of the processing and your relationship with us.
| Legal Basis | When We Rely on It |
|---|
| Contract Performance | Processing necessary to fulfil our service agreement with merchant clients — including shipment booking, delivery coordination, COD remittance, and account management. |
| Legal Obligation | Maintaining records required under GST, the Companies Act, customs regulations, and other applicable Indian law. |
| Legitimate Interests | Fraud prevention, security monitoring, service improvement, analytics, and operational communications to existing clients — where these interests are not overridden by your rights. |
| Consent | Marketing communications, NPS surveys, and optional data collection features — where we have obtained your explicit consent. |
For shipment recipients: We process your personal data on the basis of the legitimate interests of the merchant who sent your shipment and our contractual obligation to that merchant to complete delivery. You can request deletion of your data at any time by contacting us — subject to our legal retention obligations.
7
Sharing Your Data
We share personal data only where necessary to provide our services, comply with legal obligations, or protect legitimate interests. We do not share data for third-party advertising purposes.
7.1 Courier Partners
Shipment data (including recipient name, address, phone, and consignment details) is shared with courier partners — including Delhivery, Bluedart, DTDC, and Busyebee — for the purpose of pickup, transit, and delivery. See Section 8 for details.
7.2 Technology Service Providers
We use third-party technology providers to operate our platform. These providers act as data processors on our behalf and are bound by data processing agreements:
- Cloud Infrastructure — hosting and storage providers operating secure data centres
- WhatsApp Business API — Meta Platforms Inc., for sending and receiving WhatsApp messages
- Payment Gateway — for processing payments and COD remittance reconciliation
- Analytics — for platform usage analytics (anonymised/aggregated data only)
- Communication Services — for SMS, email, and Voice AI calling services
7.3 E-Commerce Platform Integrations
If you have connected ParcelAce to Shopify, WooCommerce, or another e-commerce platform, order and customer data is exchanged between that platform and ParcelAce as instructed by you (the merchant). You are responsible for ensuring your platform's privacy policy covers this data sharing.
7.4 Legal Disclosures
We may disclose personal data where required by law, including in response to court orders, regulatory investigations, or law enforcement requests. We will notify affected parties where legally permitted to do so.
7.5 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.
No sale of data. ParcelAce does not sell personal data. We do not share data with advertisers, data brokers, or marketing platforms. We do not allow third parties to use your data for their own purposes.
8
Courier Partners & Third-Party Logistics
ParcelAce operates as a logistics aggregator, working with multiple courier partners to process and deliver shipments. When a shipment is created, the following data is transmitted to the relevant courier partner:
- Recipient name, address, and phone number
- Consignment weight, dimensions, and declared value
- Product description and shipment type (prepaid, COD, etc.)
- AWB number and merchant details for invoicing
Courier partners are independent data controllers for data they receive in connection with shipments. Their use of this data is governed by their own privacy policies. ParcelAce is not responsible for the privacy practices of courier partners.
Our current courier partners include Delhivery, Bluedart, DTDC, Busyebee, Ecom Express, XpressBees, and Shadowfax. This list may change as we add or remove partner integrations.
Tracking data: Scan and location data generated by courier partners during transit is collected by ParcelAce and displayed on your tracking page and dashboard. This data is retained in accordance with Section 11.
9
WhatsApp & Messaging Services
ParcelAce uses the official WhatsApp Business API (provided by Meta Platforms Inc.) to send shipment notifications, delivery updates, NDR confirmations, COD verifications, and to operate AI-powered WhatsApp agents on behalf of merchants.
What we send via WhatsApp
- Order confirmation and AWB generation notifications
- Out-for-delivery and delivery confirmation messages
- NDR and failed delivery verification requests
- COD verification calls and confirmations
- Reverse pickup scheduling messages and AI agent conversations
- Tracking link notifications with branded content
AI WhatsApp Agent
For merchants who have enabled our AI WhatsApp agent, recipient messages are processed by our AI system to understand intent and trigger automated actions (such as booking a reverse pickup). Message content is processed in real time and may be retained for operational quality assurance purposes.
Consent for WhatsApp messaging
Merchants using ParcelAce to send WhatsApp communications to their customers are responsible for obtaining appropriate consent from recipients under applicable laws, including the DPDP Act 2023 and WhatsApp's Business Policy. By enabling WhatsApp features on the ParcelAce platform, merchants represent that they have obtained the necessary consents.
Meta's data practices
Messages sent via the WhatsApp Business API are subject to Meta's Privacy Policy available at whatsapp.com/legal/privacy-policy. ParcelAce is not responsible for Meta's data processing practices.
Voice AI Calling: ParcelAce may operate automated voice calls for COD verification and NDR follow-up. Recipients may opt out of such calls by contacting the merchant or by emailing
support@parcelace.io.
10
Cookies & Tracking Technologies
We use cookies and similar tracking technologies on our website and dashboard. A cookie is a small text file placed on your device to help us recognise you and remember your preferences.
Types of cookies we use
| Cookie Type | Purpose | Retention |
|---|
| Essential | Required for the platform to function — session management, authentication, security tokens | Session / up to 30 days |
| Functional | Remembering your preferences, dashboard layout, and display settings | Up to 12 months |
| Analytics | Understanding how our website and dashboard are used — page views, feature adoption, error tracking | Up to 24 months |
| Marketing | Measuring the effectiveness of marketing campaigns (only on public website, not dashboard) | Up to 90 days |
Managing cookies
You can control and delete cookies through your browser settings. Disabling essential cookies will affect the functionality of our platform. Analytics and marketing cookies can be disabled without affecting core service functionality.
Most modern browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Refer to your browser's help documentation for instructions.
11
Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to comply with legal, regulatory, accounting, and reporting obligations.
| Data Category | Retention Period | Basis |
|---|
| Shipment records (AWBs, tracking, addresses) | 7 years | GST and legal record-keeping requirements |
| COD remittance records | 7 years | Financial records, tax compliance |
| Merchant account data | Duration of account + 3 years post-closure | Legal and contractual obligations |
| WhatsApp message logs | 12 months | Operational quality assurance |
| Support and communications records | 3 years | Dispute resolution and legal protection |
| Website analytics data | 24 months | Service improvement (anonymised after 24 months) |
| Marketing consent records | Duration of consent + 3 years | Compliance with consent obligations |
When data is no longer required, we securely delete or anonymise it. Where deletion is not immediately possible (for example, because data is stored in backup systems), we will securely isolate it from further processing until deletion is possible.
12
Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction.
Technical measures
- Encryption of data in transit (TLS/HTTPS) and at rest
- Access controls and role-based permissions on our platform
- Secure API authentication for integrations and courier partner connections
- Regular security reviews and vulnerability assessments
- Monitoring for unauthorised access attempts and anomalous activity
Organisational measures
- Data access limited to team members who require it to perform their duties
- Confidentiality obligations for all staff and contractors who access personal data
- Vendor due diligence for third-party processors
- Incident response procedures for data security events
Data breach notification: In the event of a personal data breach that is likely to result in a risk to your rights, we will notify affected parties and, where required, the relevant data protection authority, within the timeframes required by applicable law.
While we take reasonable precautions to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at support@parcelace.io.
13
Your Rights
Depending on your location and the nature of your data, you may have the following rights with respect to your personal data.
| Right | What It Means | How to Exercise |
|---|
| Access | Request a copy of the personal data we hold about you | Email support@parcelace.io |
| Correction | Request correction of inaccurate or incomplete personal data | Dashboard settings or email us |
| Deletion | Request deletion of your personal data (subject to legal retention obligations) | Email support@parcelace.io |
| Portability | Receive your data in a structured, machine-readable format | Email support@parcelace.io |
| Restriction | Request restriction of processing in certain circumstances | Email support@parcelace.io |
| Objection | Object to processing based on legitimate interests | Email support@parcelace.io |
| Withdraw Consent | Withdraw consent where processing is consent-based | Account settings or email us |
| Opt Out of Marketing | Unsubscribe from marketing and promotional communications | Unsubscribe link in emails or email us |
We will respond to all verified rights requests within 30 days. We may request proof of identity before processing your request. Requests from authorised agents will require valid written authorisation.
Exercising your rights will not affect our ability to fulfil active shipment contracts, but may limit your access to certain platform features.
14
India — Digital Personal Data Protection Act 2023
ParcelAce is incorporated in India and fully complies with the Digital Personal Data Protection (DPDP) Act 2023 and applicable Rules thereunder.
Data Fiduciary
Parcelace Tech Solutions Private Limited is the Data Fiduciary for personal data of Indian residents processed through the ParcelAce platform and its associated services.
Your Rights Under the DPDP Act
- Right to Information — know what personal data is being processed and for what purpose
- Right to Correction and Updation — request correction or updation of inaccurate or incomplete personal data
- Right to Erasure — request erasure of personal data where the purpose of processing has been fulfilled or consent has been withdrawn (subject to legal retention obligations)
- Right to Grievance Redressal — raise a grievance with our Grievance Officer and have it resolved within 30 days
- Right to Nominate — nominate another individual to exercise your rights in the event of your death or incapacity
Consent
Where we process personal data of Indian residents on the basis of consent, we provide clear, plain-language notice of the purpose before or at the time of collection. Consent may be withdrawn at any time by contacting us at support@parcelace.io. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Grievance Officer
For grievances related to the processing of personal data of Indian residents, please contact our Grievance Officer:
Grievance Officer
Parcelace Tech Solutions Private Limited
Email:
support@parcelace.io
We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 days.
15
GDPR — European Economic Area & United Kingdom
If you are located in the EEA or UK, additional rights and protections apply under the General Data Protection Regulation (GDPR) and UK GDPR.
Data Controller
Parcelace Tech Solutions Private Limited is the Data Controller for personal data processed through ParcelAce. Our contact details are set out in Section 2 and Section 18.
International Data Transfers
Your data may be processed in countries outside the EEA including India and the United States. Where we transfer data outside the EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) approved by the European Commission.
Right to Lodge a Complaint
If you believe we have violated your data protection rights, you have the right to lodge a complaint with your local data protection authority. For EEA residents, find your authority at edpb.europa.eu. For UK residents, contact the Information Commissioner's Office (ICO).
16
Children's Privacy
ParcelAce is a business-to-business logistics platform intended for use by merchants, businesses, and adult individuals. Our services are not directed at individuals under the age of 18.
We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe we have inadvertently collected personal data from a child under 18, please contact us immediately at support@parcelace.io and we will delete such data promptly upon verification.
17
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or business practices. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Send an email notification to the primary email address on your account for material changes
- Display a prominent notice on the ParcelAce dashboard for at least 30 days following material updates
Your continued use of ParcelAce services after the effective date of an updated policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you should stop using ParcelAce and contact us to close your account.
Previous versions of this policy are available on request by emailing support@parcelace.io.
18
Contact Us
For any privacy-related questions, data requests, or complaints, please contact us using the details below. We are committed to resolving your concerns promptly and transparently.
