Privacy Policy

A note on the two roles your data can play

Parcel Optix is a multi-tenant platform. Personal information flows through the Service in two different ways, and our role differs for each:

• Information about you as an account user (your name, email, and how you use the Service). For this, we are the party that decides how the information is handled.
• Information inside the freight data your organization uploads — for example, the names and addresses of shippers and recipients on carrier invoices. Here, your organization decides why and how that data is used; we only process it on your organization’s behalf to provide the Service. If you are an individual whose information appears in a customer’s uploaded data, please direct privacy requests to that organization; we will support them in responding.

1. Information We Collect

Account and profile information. When you or your organization create an account, we collect your name, email address, and password (stored in hashed form). Depending on your role, your profile may also include job title, mobile phone number, and notes added by your administrators.

Organization and billing information. For each customer organization we store the organization name, status, plan, currency, and country. For paid plans we store billing identifiers from our payment processor (a customer ID), and limited payment-method metadata such as the card type and the last four digits. We do not collect or store full payment card numbers — card details are entered directly with our payment processor.

Sales and support information. If you contact us or request a demo, we collect the name, email, and organization name you provide.

Uploaded freight data. Customers upload carrier invoices and shipment data, which may contain personal information about shippers and recipients (names, company names, and address details) and reference fields such as PO numbers. Sensitive fields of this data are encrypted at rest.

Technical and usage information. When you use the Service we automatically record session information including your IP address, browser/device user-agent, and session activity timestamps. We also maintain API usage logs for security and operational purposes.

Cookies. We use a strictly necessary session cookie to keep you signed in and to protect against cross-site request forgery. This cookie is HTTP-only and uses a "lax" same-site setting.

On our public marketing pages we use Google Analytics, loaded through Google Tag Manager, to understand how visitors find and use the site. This sets Google Analytics cookies and shares page URLs, referrer, and browser/device information with Google. Google uses your IP address only to estimate your approximate location and does not store it.

We do not load analytics or advertising trackers inside the application itself. Once you sign in, and on every customer subdomain, no third-party analytics or advertising scripts run. We do not use advertising pixels anywhere, and we do not use analytics to profile you or to target advertising.

2. How We Use Information

We use personal information to:

• Provide, operate, and maintain the Service;
• Authenticate users and secure accounts (including password reset and email verification);
• Process subscriptions, payments, and billing notifications;
• Communicate with you about your account, service-related notices, and support requests;
• Generate the analytics and reports you request from your uploaded data;
• Monitor, troubleshoot, and protect the security and integrity of the Service;
• Comply with legal obligations.

We do not sell your personal information.

3. How We Share Information

We share personal information only as needed to operate the Service:

• Service providers (sub-processors). We use trusted third parties for payment processing (card details are entered directly with the processor; we receive only a customer reference and limited metadata), email delivery (this receives the recipient’s email address and message contents), and hosting and infrastructure. On our public marketing pages only, we also use Google Analytics / Google Tag Manager to measure site traffic; it receives page URLs, referrer, and browser/device information (your IP address is used by Google only to estimate location and is not stored), and never receives uploaded freight data or in-application activity.
• Within your organization. Other authorized users in your Tenant (such as Owners and Managers) may see account and data within your shared workspace, according to their roles.
• Legal and safety. We may disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of Parcel Optix, our users, or others.
• Business transfers. If Parcel Optix is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

4. Tenant Data Isolation

Parcel Optix is built so that each customer organization’s data is stored in its own separate database, isolated from other tenants. Access controls and tenant-aware routing keep one organization’s data from being accessible to another.

5. Data Security

We take reasonable measures to protect personal information, including:

• Encryption in transit — the Service is served over HTTPS/TLS, with HSTS enforced.
• Encryption at rest for sensitive fields in uploaded freight data.
• Hashed passwords — passwords are never stored in plain text.
• Role-based access controls and tenant isolation.
• Secure, HTTP-only session cookies.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

6. Data Retention and Deletion

• We retain account and organization information for as long as your account is active and as needed to provide the Service.
• API usage logs are retained for a limited period (currently 90 days) and then automatically deleted.
• When an organization’s account is deleted, its entire workspace — including its separate database and the data within it — is permanently deleted. Individual user accounts that are removed are also permanently deleted. These deletions are not reversible, so please export anything you wish to keep beforehand.
• We may retain limited information where required to comply with legal, tax, or accounting obligations, or to resolve disputes.

7. Your Choices and Rights

Depending on where you live, you may have rights regarding your personal information, such as the right to access, correct, or delete it, or to object to certain processing.

• Account information can be viewed and updated within the Service, or by contacting your organization’s administrator.
• For data inside uploaded freight files, please contact the organization that uploaded it; as a processor, we will assist that organization in fulfilling requests.
• To make a privacy request directly to us, contact us using the details below. We will respond within a reasonable timeframe and in accordance with applicable law.

8. Children’s Privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

9. International Users

The Service is operated in North America, and your information may be stored and processed there. By using the Service, you understand that your information may be transferred to and processed in a jurisdiction that may have different data-protection rules than your own.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by email or within the Service) and update the "Last updated" date above.

11. Contact Us

If you have questions or requests regarding this Privacy Policy or your personal information, contact Parcel Optix, Available Upon Request, or privacy@parceloptix.com.