ParcelClaimParcelClaim
Last updated: July 13, 2026

Privacy Policy

Your privacy matters. This page explains exactly what data ParcelClaim collects, how we use it, and—importantly—what we do not collect.

1. Overview

ParcelClaim ("we", "our", "us") operates the website parcelclaim.app and the related AI claim-letter generation service (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit, sign up for, or use our Service.

By using the Service, you agree to the data practices described in this policy. If you do not agree, please do not use the Service.

2. Data We Collect

We collect the following categories of information:

2.1 Account information

  • Email address — required for sign-in and important notifications (order confirmation, refund processing, security alerts).
  • OAuth provider & ID (if you use Google/Apple login) — only the provider name and a unique token, never your password.
  • Account creation timestamp — used for fraud detection and analytics.

2.2 Claim features you provide

  • Selected e-commerce platform (Amazon, TikTok Shop, Temu, Shein, Other)
  • Problem type tags (Late Delivery, Missing Items, Damaged, Wrong Address)
  • Delay days (only if you select "Late Delivery")
  • Order value (optional, in USD)
  • Evidence tags you toggle (Photo/Video Available, CS Ignored, Tracking Stale)
  • Free-text descriptions you type in the form

2.3 Order & payment metadata

  • order_sn — internal unique order ID
  • Payment status (paid / unpaid / refunded)
  • Gateway transaction ID (from Creem, used for refunds and accounting)
  • VIP subscription status (member level, expiration timestamp)
  • The generated claim letter (stored so you can re-view and re-copy it)

2.4 Technical & analytics data

  • Anonymized IP address (hashed with a rotating salt, never stored in plain text)
  • Browser type and version (User-Agent)
  • Referring page (where you came from)
  • Pages visited, buttons clicked (funnel analytics, aggregated)
  • Session ID (a random UUID stored in your browser's localStorage)

3. Data We Do NOT Collect

We are committed to data minimization. We deliberately do not collect:
  • Your real e-commerce order numbers. The platform order ID field is optional. If you leave it blank, the field is stored as empty (NULL) and you can fill it in later when copying the claim letter. We never ask for or store your login credentials for Amazon, TikTok Shop, Temu, or Shein.
  • Photo or video evidence. Files you select in the "evidence" step stay on your device. We never upload them to our servers. The claim letter states that you have documented evidence available on your device — the files themselves are not sent to support automatically, you attach them yourself when contacting support.
  • Payment card details. All payments are processed by Creem (PCI-DSS Level 1 compliant). We never see your full card number, CVV, or expiry date.
  • Government-issued ID, SSN, or address. We do not request identity verification beyond your email.
  • Biometric data, health data, or other "special categories" under GDPR Art. 9.

4. How We Use Your Data

We use the data we collect for the following purposes:

  • To provide the core Service — match your claim to the right platform rule, generate a customized letter, and let you copy it.
  • To process payments — issue receipts, handle refunds, prevent fraud.
  • To maintain your VIP subscription — track membership level and renewal date.
  • To send essential notifications — order confirmations, security alerts, refund results. We do not send marketing emails to non-VIP users.
  • To improve the Service — aggregate analytics (e.g., "30% of users abandon at the payment step") help us identify friction. We never sell or share individual-level analytics.
  • To comply with legal obligations — respond to valid legal process, enforce our Terms, prevent abuse.

5. Data Sharing & Subprocessors

We do not sell, rent, or trade your personal data. We share data only with the following vetted subprocessors, solely to provide the Service. We group them into primary (in active daily use) and backup (activated only when the primary is unavailable, so your claim letter isn't blocked by a single vendor outage).

5.1 Primary subprocessors

  • Supabase Inc. (database & authentication) — stores your account, order, and VIP status. Hosted in the US/EU regions. Privacy policy: View on Supabase .
  • Creem (payment gateway) — processes payments and handles customer portal/billing. They receive your email and the order amount. Privacy policy: View on Creem .
  • Google Gemini API (primary AI text generation) — receives the claim features you submitted (platform, problem tags, evidence tags, order value) plus the official platform policy excerpt, and returns the generated letter. No personal identifiers (email, name) are sent. ToS: View Google AI terms .
  • Cloudflare, Inc. (CDN, edge compute, DDoS protection) — sees request metadata (anonymized IP, path, headers). They are not granted access to any user content.

5.2 Backup subprocessors

These are activated only when the primary is unavailable (e.g., a Google Gemini regional outage, rate-limit, or safety block). When triggered, they receive the same minimal data payload as the primary, no more.

  • Anthropic (Claude API) — backup AI text generation, used when Google Gemini is unavailable. Privacy policy: View on Anthropic . Data usage: Anthropic's API does not train on customer inputs by default.
  • OpenAI (GPT API) — tertiary backup AI text generation, used when both Gemini and Claude are unavailable. Privacy policy: View on OpenAI . Data usage: API inputs are not used to train OpenAI models by default and are retained for ≤30 days for abuse monitoring only.
  • Resend Inc. (transactional email) — sends order confirmations, security alerts, and refund results. Currently used only for outbound notification emails; not yet wired to marketing. Privacy policy: View on Resend .

We will notify you via a banner on the Service at least 30 days before activating any new subprocessor that processes User Content, in addition to updating this page.

5.3 Legal disclosures

We may disclose your information only if required to do so by law or in the good-faith belief that such action is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) act in urgent circumstances to protect the personal safety of users or the public; or (d) protect against legal liability.

6. Cookies & Local Storage

We use the following browser storage technologies:

  • Supabase auth token (localStorage) — keeps you signed in. Without it, you'd have to log in on every page.
  • Analytics session ID (localStorage, UUID) — aggregates your page views into a single session for funnel analysis. No cross-site tracking.
  • Theme / preferences (localStorage) — remembers your UI choices.

We do not use third-party advertising cookies (no Facebook Pixel, no Google Ads tracking, no TikTok Pixel). We do not use cross-site tracking technologies.

7. Data Retention

  • Account data — retained while your account is active. Deleted within 30 days of account deletion request.
  • Order data & generated letters — retained for 2 years for tax, accounting, and dispute resolution. After that, anonymized aggregates only.
  • Analytics events — retained for 90 days, then aggregated into anonymous counters.
  • Payment records (gateway_transaction_id, amount) — retained for 7 years to comply with US/EU tax law.

8. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights:

  • Access — request a copy of the personal data we hold about you.
  • Correction — ask us to correct inaccurate or incomplete data.
  • Deletion — ask us to delete your account and associated data (subject to retention obligations above).
  • Export — receive your data in a machine-readable format (JSON).
  • Object — object to processing for direct marketing or analytics.
  • Withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. We respond within 30 days. EU/UK users may also lodge a complaint with their local data protection authority.

9. Security

We protect your data with industry-standard safeguards, including:

  • All traffic is encrypted in transit (TLS 1.3).
  • Data at rest is encrypted by Supabase (AES-256).
  • Access to production systems is restricted to a small number of authorized personnel with audit logging.
  • Payment data is handled exclusively by Creem (PCI-DSS Level 1); we never store card details.
  • Account passwords are hashed with bcrypt by Supabase Auth; we cannot see them in plain text.

No system is 100% secure. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities within 72 hours as required by GDPR.

10. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete the information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the policy was last revised. Material changes will be announced via a banner on the Service and (for logged-in users) via email at least 14 days before they take effect.

12. Contact Us

For any privacy-related question, request, or complaint, contact our Data Protection Officer: