Privacy Policy · ParcelMood.ai

01Introduction

ParcelMood.ai is an online platform owned and operated by ADS Delivery OOD, a company incorporated under the laws of Bulgaria, company number 208549000, with its registered seat at 192A Cherni Vrah Blvd., 1407 Sofia, Bulgaria ("ADS", "we", "us" or "our").

ParcelMood gives online stores branded tracking pages for their buyers. Buyers can ask friends a one-tap question about their purchase and make a story video on their own device. Buyers and friends use these pages without an account.

This Privacy Policy explains how we process personal data under Regulation (EU) 2016/679 ("GDPR") and other applicable data-protection laws, and the rights you have.

Privacy enquiries: privacy@parcelmood.ai.

02Data protection roles

For store accounts, store content, friends who answer on a friend page, messages sent to us, and the security and operation of ParcelMood, ADS is the controller.
For buyer data on tracking pages, the store that sold the order is the controller. ADS processes that data on the store's behalf, under its instructions and the Data Processing Agreement. If you are a buyer, you can also contact the store directly.
The same split applies to what a buyer adds to their page: the store is the controller of the buyer's own content (the buyer's cut-out photo and the rating cards the buyer makes), and ADS is the controller of the ratings friends give and of the anti-abuse identifiers behind them.

03What personal data we process and why

Type of information	Purpose and legal basis
Store account data: name and work email of the store owner and team members, their role, the sign-in method, a Google or Apple account identifier where used, the store code in hashed form, and records of acceptance of our terms (document, version, time and a keyed hash of the IP address).	Creating and securing store accounts, sign-in, support and service messages (contract; legitimate interest in security).
Store billing data, for a store on a paid plan: the plan, plan-change history and billing state, the subscription's status and billing period, the payment provider's customer and subscription identifiers, the email the checkout is opened with, together with the billing address and any tax or VAT identification number collected by our payment provider for invoicing. Card and bank details are entered at the payment provider (Stripe, or Shopify for stores billed through their Shopify bill) and never reach us; we do not store full payment-card numbers, CVV codes or complete payment-card details.	Subscription administration, charging the store for its plan, invoicing and restricting new sends when a payment fails (contract), and keeping accounting and financial records (legal obligation).
Store content: the store's logo and product photos (sent for background removal), colours, texts, coupon and gift codes, shop link.	Building the store's branded pages (contract).
Buyer data, supplied by the store through its dashboard, through a link in its own shipping email or, for a connected shop, by the shop itself: first name, order reference, product name and photo, carrier, tracking number, delivery status and scan history, the delivery city, region and country where the store supplies them (never a street address), and counts of how often the page was opened, shared, answered and clicked through (numbers only, per page and day).	Showing the buyer's tracking page and keeping it up to date, on the store's instructions (we act as the store's processor).
Shared-page data: when a buyer asks friends, the friend page and its link preview show the buyer's first name and the product.	Showing the page the buyer chose to share. It is reachable only by its link and is kept out of search engines.
The buyer's own photo, where the store's page offers it: a photo the buyer takes of what arrived. It is sent to our background-removal provider, and only the cut-out is kept, with the tracking page. The original photo is not stored.	Showing the buyer's own item on their page and in the film made from it, at the buyer's request, on the store's instructions (we act as the store's processor).
Rating cards: the card a buyer makes (its name, finish and criteria, the picture already on the order, the buyer's first name and a random identifier of the maker's browser), and each rating given to it: the scores, a random identifier kept in the rater's browser and the time.	Showing the card the buyer chose to share, counting one rating per device and showing the averages (legitimate interest; see Section 11 on browser storage).
Friend data: the answer given, a random identifier kept in the browser, and the time of the answer. For the question itself, a random identifier of the browser that asked it.	Counting one answer per device, keeping the asker's own answer out of the count, and showing the totals (legitimate interest; see Section 11 on browser storage).
Technical and security data: IP address, browser and device information, times and the address of each page requested, which for a store's template link includes the order fields the store placed in it (such as the order reference, first name and tracking number). For rate limits we keep only a keyed hash of the IP address or email, never the address itself.	Security, abuse prevention and rate limiting, troubleshooting and operation of the service (legitimate interest).
Content reports: when you report content, the page concerned, your reason and explanation, your name and email address (optional only for reports concerning a child), and a keyed hash of your IP address.	Handling the report, telling you and the person concerned what we decided, and handling any challenge (legal obligation under the Digital Services Act; legitimate interest in keeping the service free of illegal content).
Communication data: your email address and the content of messages you send us, including privacy requests.	Answering you (legitimate interest) and handling requests about your rights (legal obligation).

Using a page without an account does not make you anonymous to us: a friend page keeps a random identifier in your browser and sends it with your answer, and your IP address is processed for security.

We do not ask for or intend to process special categories of personal data. Stores must not put them on a page. We do not perform facial recognition, collect precise location, or use analytics, advertising or session-recording tools.

04Legal bases

Performance of a contract: running store accounts and providing the service the store signed up for.
Legitimate interests: security, abuse and fraud prevention, one answer per device on friend pages, troubleshooting and answering messages. These interests are not overridden by yours because the data is minimal, kept briefly and never used for profiling or advertising.
Legal obligation: handling rights requests and keeping records the law requires.
On behalf of a store: for buyer data, the store determines the legal basis; we process on its documented instructions.

Where processing is necessary to provide a feature, the feature may not work without it.

05Recipients of personal data

We disclose personal data only where needed to provide, secure and support the service, or where the law requires. Depending on the feature, recipients fall into these categories:

the store, for its own buyers' tracking pages and the counts shown in its dashboard;
hosting, infrastructure, database and content-delivery providers;
an image-processing provider that removes the background from logos and product photos;
a parcel-tracking provider and, through it, the carrier, which receive the tracking number and carrier;
sign-in providers (Google, Apple) where a store member chooses them;
an email-forwarding provider for messages sent to our addresses;
an error-monitoring provider that receives reports of software errors, with email addresses, tokens and link identifiers removed before sending;
an email provider that sends our service emails to store owners and our team;
a payment provider that charges stores for paid plans (store billing data only, never buyer data);
professional advisers under confidentiality, and public authorities where the law requires.

The current list of the specific providers, with their location and safeguards, is published at parcelmood.ai/subprocessors and is available on request.

We do not sell personal data and do not disclose it for advertising. We use no advertising pixels, retargeting or advertising tools. Fonts and images load from our own site, not from third-party font or analytics services.

06Automated processing

Logos and product photos uploaded by a store are sent to an image-processing provider that separates the subject from its background and returns the result, which we then trim. Those images are the store's content, not images of people.

We do not use store content, buyer data or generated results to train or fine-tune artificial-intelligence models.

We make no decisions about anyone by automated means that produce legal or similarly significant effects.

Journey moments, films and scenes are illustrative and are not an official record of shipment or delivery.

07How long we keep data

Tracking pages and the buyer data in them: deleted 90 days after the page was last changed following delivery, and in any case 180 days after the page was created. The friend page and its answers are deleted with it.
The buyer's own cut-out and any rating cards made from the order: deleted with the tracking page.
The browser identifier behind a friend's answer, a rating or an asked question: deleted after 30 days; only the totals and averages remain.
Hashed IP addresses and emails used for rate limits and sign-in protection: deleted after one day.
Logos and product photos no longer used on any page or in the store's current branding: deleted after 30 days.
Store account data and store content: while the account is open, and deleted within 30 days after a closure request, except records we must keep by law (for example accounting records once paid plans exist) or need to establish, exercise or defend legal claims, for the applicable statutory period.
Content reports: deleted one year after they were received.
Shopify privacy-request records (order ids and the export made for them): deleted one year after the request arrived.
Webhook delivery ids, kept so a delivery from a shop or the tracking provider is handled once: deleted after 30 days.
Hosting logs: kept by our hosting provider for its own short retention period.
Error reports: deleted by our error-monitoring provider after 90 days at most.

Deletion runs automatically. Copies held by recipients of a shared link or in external apps where a buyer posted a story video are outside our control.

08International transfers

Several of our providers are in the United States, which is the principal destination outside the European Economic Area. Transfers concern hosting and database storage, image processing, parcel tracking, sign-in, email forwarding, service email and store billing.

Where a recipient participates in the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision. Otherwise we rely on the European Commission's Standard Contractual Clauses, with additional safeguards where appropriate: data minimisation (for buyers, a first name and order details only), encryption in transit, random page links and hashed identifiers.

Details of destinations, purposes and safeguards, and a copy of the relevant Standard Contractual Clauses, are available on request at privacy@parcelmood.ai.

09Your rights

Subject to applicable law, you have the right to:

access your personal data and receive a copy;
have inaccurate data corrected;
have data erased in certain circumstances;
restrict processing in certain circumstances;
receive data you provided in a portable format, where applicable;
object at any time to processing based on legitimate interests; and
lodge a complaint with a supervisory authority, including the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the authority where you live or work.

Write to privacy@parcelmood.ai with the subject "Privacy Request". We acknowledge requests and answer within one month, which the law allows us to extend by two further months for complex requests; we will tell you if we do. We may ask for information reasonably needed to confirm your identity, such as the link to the page concerned.

If you are a buyer, your request may concern data we hold for a store. We will pass it to the store or help it answer, as the store is the controller of that data.

How to have data deleted, step by step for store teams, buyers and friends, is set out at parcelmood.ai/data-deletion.

10Security

We protect personal data with technical and organisational measures that include encryption in transit, access controls that let each store reach only its own data, hashed store codes and sign-in protection, rate limits, signed webhooks and hashed identifiers. The measures are described in Annex II of the Data Processing Agreement.

Tracking and friend pages are served from random links that are not listed or indexed, but anyone who holds a link can open it. No online service can guarantee absolute security. Where the law requires, we notify the supervisory authority and affected individuals of a personal data breach.

11Cookies and browser storage

We use only cookies and browser storage that are strictly necessary for the service you ask for, so they do not require consent. Everything in browser storage stays on your device: it is not sent to us unless a feature needs it for the request you make, as noted below.

What and where	Purpose and lifetime
Sign-in cookies (store teams only), including short-lived security cookies during Google or Apple sign-in, and pm_oauth_state while a store connects its Shopify shop.	Keeping a store member signed in and protecting the sign-in and the shop connection against forgery. The sign-in cookie lasts up to 30 days or until you sign out; the security cookies are deleted when the step completes or the browser closes.
pm_device, in local storage, on tracking, friend and card pages.	A random identifier so each device answers or rates once, and the maker of a card or the buyer who asked a question is recognised. Sent with an answer, a rating, or when a buyer or a store opens a question. Kept until you clear it; on our side it is replaced after 30 days.
pm_vote_, pm_seen_, pm_card_rated_, pm_card_mine_, pm_once_*, in local storage.	Remembering the answer or rating you gave, that you have seen a friend page's film, which cards you made, and that a visit to the shop or a gift code from a page was already counted, so the page shows them back to you and counts each once. Kept until you clear it.
pm_a11y, in local storage.	Your accessibility settings, if you choose any. Kept until you change or clear them.
pm_cookie_notice_v1, in local storage.	A record that the cookie notice was shown and when, so it is not shown again. Kept until you clear it.
pm_store_upload_terms_v1 and pm_mine_terms_v1, in local storage.	The moment you confirmed the terms for sending a photo (a store uploading a logo or product photo, or a buyer adding their own photo), so you are not asked before every photo. The moment is sent with each photo as the record of that confirmation. Kept until you clear it.
pm_intro_v1, in local storage.	Notes that the first-visit introduction on the home page was shown, so it plays only once. Kept until you clear it.
pm_welcomed_<store> in local storage, and pm_door_<store> in session storage (store dashboard).	Notes that the welcome screen, and the store's opening screen for this browser session, were shown. The first is kept until you clear it; the second ends when the tab or browser is closed.
pm_send_journey_v1 and pm_drop_journey_v1, in session storage (store dashboard).	A random identifier for the send or test drop being made, so a resubmit or a reload during sending creates one order, not two. Sent with the send; renewed after it succeeds, and ends when the tab is closed.
pm_send_draft_v1, in session storage (store dashboard).	The order a store member is preparing on Send (buyer's first name, product, order and tracking number, carrier, estimate, the product cut-out and the chosen settings), so a reload or a switch of tabs does not lose it. It stays on the device, is removed once the order is created, and ends when the tab is closed.
pm_held_drop_v1, pm_held_sent_v1, pm_mine_open_, pm_story_open_, in session storage.	Remembers a drop, a sent link or an open story or photo step, so the page returns to where you were after sharing to another app. Ends when the tab is closed, and is ignored after 24 hours.
pm-held-v1, an IndexedDB database.	Holds a film or a drop you made on this device, so you can share it again after the phone reloads the page. It stays on the device and is ignored after 24 hours; it is replaced when you make a new one and can be cleared in your browser settings.

We use no analytics, advertising or cross-site tracking cookies. You can delete cookies and browser storage at any time in your browser settings; a friend page will then treat your device as new, and a dashboard draft or a held film is lost.

12Children

ParcelMood is intended for users aged 16 and over. Answering on a friend page, making or rating a card, or making a story video requires a confirmation that you are 16 or older. This is a self-declaration; we do not collect dates of birth or verify age. If we learn that we hold data about a child in breach of these rules, we delete it.

A parent or guardian with concerns can contact privacy@parcelmood.ai.

13Changes to this policy

We update this policy when the service or the law changes. For material changes we inform store accounts by email or in the dashboard; the date at the top shows the latest version. Where the law requires consent to a change, we will ask for it.

14Contact

ADS Delivery OOD, UIC 208549000, 192A Cherni Vrah Blvd., 1407 Sofia, Bulgaria.

Privacy enquiries: privacy@parcelmood.ai, subject "Privacy Request".