Protected customer data — Parcel Pulse

Parcel Pulse is classified as Protected Customer Data Level 2. It requests exactly two Admin API scopes — read_orders and write_orders — and deliberately does not request read_customers, because every field it uses is read off the order itself. To run its two pre-ship checks it reads, from your own store only, the fields below off your unshipped (unfulfilled, open) orders:

• Order / shipping phone number
• Order email (used only for the optional blocklist match)
• Shipping address (street, city, postal code, country)
• Order name, total and currency

Parcel Pulse uses no AI or third-party model — the checks are plain, deterministic rules. No customer data is sent to any external service.

What we do with it

The data is processed in memory to run two deterministic rules — duplicate-order detection (same phone within a configurable window) and address validation (missing street number, malformed RO postal code, invalid phone). We then discard the raw data. The only write we ever perform is cancelling a duplicate order when you explicitly click "Cancel duplicate" on a flagged row (the write_orders scope) — COD-safe, restocked, with no shopper email.

What we retain (PII-minimised)

We persist only what the flagged-order queue needs to be actioned: the order id and name, a masked phone (last 4 digits, e.g. •••• 0192), the list of issue reasons, and a one-line risk reason. We do not store line items, customer names, email addresses, or full addresses. The flag queue is replaced on each scan.

What we never do

• No cross-merchant data sharing or "serial refuser" scoring.
• No selling, profiling, or sharing of customer data with third parties.
• No retention of raw phone numbers or full addresses at rest.

Deletion & GDPR

We honour Shopify's mandatory compliance webhooks. On a customer-redact or shop-redact request we delete the relevant flagged-order rows. On uninstall the store record is marked uninstalled and its derived flags are removed.