privacy policy.

Parchel Ltd (“Parchel”, “we”, “us”) is the data controller for personal data collected through this website, quote requests, bookings and customer support. We are registered in England and Wales, company number 16849647. Our registered office is Office 173, Unit 5, 399–405 Oxford Street, Mayfair, London W1C 2BU.

If you have any questions about how we handle your data, please contact us at support@parchel.com.

When you use our Service we collect the following personal data:

We do not collect payment card details directly — payments are processed by our third-party payment provider and are subject to their privacy policy.

We use your personal data for the following purposes:

• Quotes and bookings — checking routes, prices and availability, processing your booking, and coordinating collection and delivery with courier partners.
• Customer communications — sending quotes, confirmations and available tracking updates by email or text, and responding to enquiries through our team or automated phone assistant.
• AI assistance — if you upload photos or ask our AI to help describe an item, the relevant images or description are sent to our AI providers to suggest sizing, weight, safety or customs information. Suggestions need customer and staff review. Our phone assistant also uses AI to understand and respond to calls. Parchel does not use your photos for marketing.
• Legal compliance — retaining booking records as required by UK tax and financial regulations.
• Service improvement — aggregated and anonymised usage data to improve the booking flow. We never sell individual personal data.

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:

• Contract and steps you request before a contract (Article 6(1)(b)) — handling your quote request, booking, collection and delivery.
• Legal obligation (Article 6(1)(c)) — retaining financial records for HMRC compliance.
• Legitimate interests (Article 6(1)(f)) — fraud prevention, service security, handling enquiries and complaints, and understanding how our service works, balanced against your rights.
• Consent (Article 6(1)(a)) — where required for optional cookies or marketing. We will ask separately before starting these activities, and you can withdraw consent.

We share your data only where necessary:

• Couriers, carriers and booking networks — including services arranged through Parcel2Go or Courier Exchange, where used. Route, parcel and necessary sender/recipient contact details are shared to obtain quotes or arrange, fulfil and track a shipment. The information shared depends on the stage of the request. Carriers also handle information under their own privacy notices.
• Gophr instant estimates — when you check a same-day estimate, the collection and delivery addresses, delivery deadline and parcel measurements are sent to Gophr to calculate a price. Your name, phone number and email are not included in this estimate request.
• Address and postcode services — text you type into address suggestions is sent to Google Maps/Places; complete UK postcodes may be sent to Ideal Postcodes for a Royal Mail address list. Postcodes.io is used for postcode location and coverage checks.
• Stripe — processes card details, payment authorisations, charges and refunds. Parchel receives payment references and status, rather than your full card number.
• Supabase — our primary database and retained photo storage are hosted in its London, UK region and encrypted at rest and in transit.
• Google Gemini and OpenAI — provide optional image and text analysis; OpenAI also supports the automated phone assistant. Providers process the relevant inputs under their service terms and data-handling policies; provider retention can differ from Parchel's own retention below.
• Hosting and communications — Vercel and Google Cloud host the service; email providers deliver service messages, and Twilio supports telephone and text services. Google Sheets booking spreadsheets are used by authorised staff to coordinate shipments.

We do not sell, rent, or otherwise share your personal data with third parties for marketing purposes.

Some providers and international carriers may process data outside the UK. Where this involves a restricted transfer, UK data-protection rules require an appropriate transfer mechanism, such as adequacy regulations or approved contractual safeguards. Contact us for information about the providers and safeguards relevant to your request.

We retain your data for the following periods:

• Booking and financial records — kept for accounting, tax and claims purposes. Company accounting records normally need to be kept for six years from the end of the financial year they relate to, and longer where required by law or an unresolved claim. We review other booking information against those purposes.
• Photos — only the first/overview photo is retained in private Supabase storage with a time-limited access link. Additional front/back label views are analysed for that request and are not stored by Parchel. A daily job deletes retained photos once they are 90 days old, unless a documented legal hold requires longer retention.
• Quotes, correspondence and phone transcripts — kept while needed to handle your enquiry, arrange a shipment or resolve a complaint; material needed for a booking, legal obligation or claim is retained with that record. Other enquiry data is reviewed and deleted when no longer needed.
• Application server logs — normally 30 days in Google Cloud. Security/audit records and providers' own logs may have different retention periods.
• Optional consent records — kept for as long as needed to honour and demonstrate your choices. Minimal suppression information may be retained so we do not contact you against your wishes.

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — request deletion of your data where there is no legal obligation to retain it.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to restrict processing — ask us to pause processing in certain circumstances.

To exercise any of these rights, email support@parchel.com with the subject line “Data Request”. We normally respond within one month. If the law permits an extension for a complex request, we will explain it within that month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

We use functional cookies and browser storage for features such as authenticated admin sessions and retaining information during a booking. Payment and address services also process technical information when you use those features. We have not enabled advertising pixels or optional analytics on this site. If we introduce non-essential cookies or similar tracking, we will request consent before using them.

You can disable cookies in your browser settings, but doing so may prevent the booking flow from working correctly.

All data is transmitted over HTTPS. Data stored in our database is encrypted at rest. Access to production data is restricted to authorised personnel and protected by the service's access controls. Private retained photos use time-limited access links.

Despite these measures, no internet transmission is 100% secure. If you believe your data has been compromised, please contact us immediately at support@parchel.com.

We may update this Privacy Policy from time to time. We will notify you of material changes where required. The “last updated” date at the top of this page will always reflect the current version.