Privacy Policy — Parcel Pulse

Last updated: 12 July 2026

Parcel Pulse ("the app", "we", "us") is a Shopify app that helps a merchant catch duplicate orders and broken shipping addresses on their own unshipped orders before a shipping label prints. This policy explains exactly what data the app accesses, why, how long we keep it, and how to have it deleted. It is deliberately narrow because the app is narrow.

Who this policy is for

Our direct customer is the merchant who installs Parcel Pulse on their Shopify store. In the course of its two pre-ship checks the app reads certain fields from that merchant's orders, which can include a shopper's phone number and shipping address. We process this on the merchant's behalf as a data processor.

What data we access

Parcel Pulse is classified as Protected Customer Data Level 2. It requests exactly two Shopify Admin API scopes — read_orders and write_orders — and deliberately does not request read_customers, because every field it uses is read off the order itself. To run its two checks it reads, from the merchant's own store only, the following fields off unshipped (unfulfilled, open) orders:

Order / shipping phone number
Order email — used only for the optional merchant-managed blocklist match (a Pro feature)
Shipping address — street, city, postal code, country
Order name, total and currency

The order query is scoped to unshipped orders only (Shopify filter fulfillment_status:unfulfilled AND status:open). If Shopify returns a field-level access-denied for a Protected Customer Data field (e.g. email before it is approved), the app tolerates it and proceeds with the remaining fields — it does not force access to data it is not entitled to.

How we use it

The data is processed in memory to run two deterministic, rule-based checks:

Duplicate-order detection — the same phone number across two orders placed within a merchant-configurable time window.
Address validation — a missing street number, a malformed postal code, or an invalid phone number on the shipping address.

The optional blocklist (Pro) additionally compares an order's phone/email to a list the merchant manages themselves. After the checks run, we discard the raw data. Parcel Pulse uses no AI and no third-party model — the checks are plain, deterministic rules, and no customer data is sent to any external service.

The one write we perform

The only change Parcel Pulse ever makes to a store is cancelling a duplicate order — and only when the merchant explicitly clicks "Cancel duplicate" on a specific flagged row (this is what write_orders is for). The cancellation is cash-on-delivery-safe (no refund, because nothing was charged), restocks the items, and does not email the shopper.

What we store (PII-minimised)

We persist only what the flagged-order queue needs to be actioned:

The order id and order name
A masked phone — last 4 digits only (e.g. •••• 0192)
The list of issue reasons and a one-line risk reason
The order total and currency

We do not store line items, customer names, email addresses, full shipping addresses, or raw (unmasked) phone numbers at rest. The flag queue is replaced on every scan, so it only ever reflects the current set of unshipped orders.

Sub-processors & hosting

Order data is read from Shopify's Admin API. The app runs on our own server infrastructure, using a PostgreSQL database (for the PII-minimised flags described above) and Redis (for background scan jobs). We do not sell, rent, profile, or share customer data with any third party, and we never combine data across different merchants.

What we never do

No cross-merchant data sharing or "serial refuser" scoring.
No selling, profiling, or sharing of customer data with third parties.
No retention of raw phone numbers or full addresses at rest.
No AI/ML processing of your data.

Retention

Flag rows live only until the next scan replaces them. On uninstall the store record is marked uninstalled and its derived flags are removed. On a customer-redact or shop-redact request we delete the relevant rows (see below).

Deletion & GDPR

We honour Shopify's mandatory compliance webhooks. On a customers/redact request we delete the flagged-order rows for that customer; on a shop/redact request we delete the store's data; the customers/data_request topic is supported. Because we store only masked, PII-minimised flags, there is minimal personal data to export or erase. Merchants and their customers may exercise GDPR rights (access, erasure, rectification) by contacting us at the address below.

Contact

Questions or data requests: privacy@syncerp.work.