Privacy Policy

Last Updated: August 7, 2026

Effective Date: August 7, 2026

This Privacy Policy is published by Parcel Apps Private Limited ("ParcelApps", "we", "our", or "us"), a company incorporated in India. It is a single, unified policy that applies to every ParcelApps application and service, whether you use it as a mobile app on Android or iOS, as a desktop application on Windows, as a web dashboard, or through our websites.

We have written this policy to be read by the people who actually use our apps, and to give app store reviewers, institutions and regulators a complete picture of what we collect, why we collect it, who we share it with, how long we keep it, and how you can get it deleted.

If you do not agree with this policy, please do not use our applications.

1. Applications Covered by This Policy

This policy covers all of the following ParcelApps applications, including their mobile apps, desktop applications, web dashboards, admin portals, APIs and marketing websites. Wherever this policy says "the app", "our apps" or "the Services", it means any one or more of these:

A single application may be offered under more than one form - for example a desktop application for shop counters, a mobile app for field staff, and a web dashboard for administrators. This policy applies to all of them.

Not every disclosure in this policy applies to every app. An app only collects a category of data, or requests a device permission, if it actually offers the feature described. For example, an app without a maps or field-tracking feature never requests location access. You can see exactly which permissions a specific app requests on its Google Play or Apple App Store listing, and on the app's own permission screens.

2. Who We Are and How to Reach Us

Parcel Apps Private Limited
Registered address: 3/327, Kamaraj Nagar, Kasinayakkanpatti, Periyakunichi, Vellore, Tirupathur, Tamil Nadu - 635602, India
Privacy queries: privacy@parcelapps.in
General queries: hello@parcelapps.in
Phone: +91 9731 519 519

For the purposes of India's Digital Personal Data Protection Act, 2023, ParcelApps is the Data Fiduciary for the account data described in Section 4.1. For the purposes of the EU/UK GDPR, ParcelApps is the data controller for that same data. Section 3 explains the different role we take for business data uploaded by our customers.

3. Our Two Different Roles

It is important to understand the difference between two kinds of data, because your rights and our obligations differ.

a) Data about you as our user. When you create a ParcelApps account, subscribe to a plan, or contact our support team, we decide how that information is used. We are the data fiduciary / controller for it, and this policy governs it directly.

b) Data your organisation puts into our apps. Many of our apps are used by a business or institution to manage its own records - a restaurant's customer orders, a school's student fee records, a service company's customer contacts, a sales team's retailer visits. That information belongs to the organisation that entered it, not to us. The organisation decides what is collected and why; we only process it on their instructions in order to run the app for them. In that situation we act as a data processor.

If your details are in one of our apps because a school, employer, retailer or service provider put them there, please direct requests for access or deletion to that organisation first. We will help them respond, and we will act on their instructions. You can still write to us at privacy@parcelapps.in and we will route your request to the right organisation and tell you who they are.

4. Information We Collect

4.1 Information You Give Us

• Account details: your name, email address, mobile number, password (stored only as a salted hash), profile photo where you choose to add one, and preferred language.
• Business details: business or institution name, business address, GSTIN or tax identifiers, business category, logo, and the outlets or branches you operate.
• Team details: names, contact details and assigned roles of staff members you invite to your account.
• Subscription and billing details: plan selected, billing address, invoices and payment history.
• Support and communications: messages, emails, call notes, screenshots and attachments you send us when you request help, report a problem or give feedback.
• Anything else you choose to provide: for example survey responses, or content you enter into free-text notes.

4.2 Information Collected Automatically When You Use Our Apps

• Device information: device make and model, operating system and version, app version, screen size, language and region, network type, and mobile country and network codes.
• Device and installation identifiers: an app-generated installation ID, and for mobile apps the platform advertising identifier (Android Advertising ID / Apple IDFA) only where it is used for the limited purposes in Section 11.
• Log and diagnostic information: IP address, date and time of requests, pages or screens viewed, referring URL, API endpoints called, and error codes.
• Usage information: which features you use, buttons and screens you interact with, session length and frequency of use.
• Crash and performance data: stack traces, memory and storage state at the time of a crash, and performance timings. This may incidentally contain fragments of data that were in memory when the crash occurred.
• Cookies and similar technologies on our websites and web dashboards, as described in Section 12.

4.3 Business and End-Customer Data Processed Through Our Apps

Depending on which app you use and which features you switch on, we process business records on your behalf. These may include:

• Customer, member, student, parent, retailer, reseller, supplier or subscriber names and contact details
• Orders, bookings, tickets, service jobs, visits, tasks and their status history
• Leads and enquiries, including contact details, source, follow-up notes, call and meeting outcomes, and conversion status
• Invoices, receipts, fee records, payment status, customer and supplier ledgers, and outstanding balances
• Amounts owed and received, due dates, settlement records, and the history of payment reminders sent to a payer
• Products, menu items, spare parts, batch and barcode details, stock levels and pricing
• For e-commerce and reseller apps: storefront and catalogue details, buyer orders, delivery and shipping addresses, dispatch and delivery status, returns, and reseller margin, commission and payout records
• Photographs, signatures, scanned documents and attachments captured in the course of a job
• Attendance, check-in and visit records for staff who use field features
• Study and preparation activity - materials accessed, practice tests attempted, scores and progress - where an app offers them

We do not use this data to build profiles of the individuals it describes, and we do not sell it. See Section 3(b) for who controls it.

4.4 Payment Information

We do not collect or store your full card number, CVV, UPI PIN, or net-banking credentials. Online payments are handled entirely by PCI-DSS compliant payment gateway partners. We receive only a transaction reference, the amount, the status, the payment method type, and a masked identifier (for example the last four digits of a card) so we can show you your payment history and reconcile invoices.

Payout details. Where an app pays money out to you - for example settling a reseller's or vendor's earnings - we collect the bank account number and IFSC code, or the UPI ID, that you give us for that purpose, together with the account holder name and any tax identifier (such as PAN or GSTIN) we are legally required to record. We may also collect verification documents where the law or our payment partner requires us to confirm your identity before releasing funds. This information is encrypted, is visible only to the limited staff who handle settlements, is used solely to pay you and to meet our tax and anti-fraud obligations, and is never used for marketing or shared with advertisers.

4.5 Information From Other Sources

• Sign-in providers: if you sign in with Google or Apple, we receive your name, email address and a provider user ID. We do not receive your password. Where we offer any third-party sign-in on iOS, we also offer Sign in with Apple.
• Your organisation: if your employer or institution creates an account for you, they provide your name, contact details and role.
• Payment and communication partners: transaction status, and delivery or failure status of messages sent on your behalf.
• Referral partners: where you reach us through our partner or referral programme, the partner tells us who referred you.

5. Device Permissions

Our mobile apps request device permissions only to deliver a specific feature. Every permission below is requested at the moment the feature is first used, with an in-app explanation of why it is needed, and every one of them is optional - if you decline, the rest of the app continues to work and only that feature is unavailable.

5.1 Location

Where an app collects location:

• Location is collected only while the app is open and you are actively using a feature that needs it - for example when you check in to a customer visit or attach a location to a completed job.
• If a specific app ever needs location in the background (for example continuous route tracking for a field sales team), the app will show you a separate, clear disclosure describing that background collection before asking, and you must give separate consent. We will not start background collection without it.
• Where a business enables field tracking for its staff, the employer decides that it is on, and the app displays an on-screen indicator to the staff member while tracking is active.
• We do not use your location for advertising, and we do not sell or share location data with data brokers.

5.2 Camera, Photos, Media and Files

• We access the camera only while a capture screen is open. We do not access the camera in the background.
• We access only the specific photos or files you choose. On Android we use the system photo picker where available; on iOS you may grant access to selected photos only.
• Photos and documents you capture are uploaded to your own account, attached to the record you were working on, and are visible only to users of that account.
• We do not scan your photo library, and we do not use your photos to train machine learning models.

5.3 Contacts

• We read contacts only at the moment you tap to pick a contact.
• Only the single contact you select is imported. We do not upload, copy or store your full contact list, and we do not use your contacts to find or invite other users.

5.4 SMS and Call Log

These are sensitive permissions and we treat them accordingly:

• SMS: where supported, one-time password auto-fill uses the Android SMS Retriever API, which lets the app read only the specific verification message we sent and requires no SMS permission at all. Where an app does request SMS permission, it is used solely to read our own verification message. We never read, upload, store or transmit the contents of your other messages.
• Call log: in apps that offer call-based follow-up for sales or service teams, and only if you grant permission, the app records that a call took place with a number already saved in your ParcelApps account, together with its time and duration, so the follow-up can be logged against that customer. We do not record call audio, and we do not read or upload call log entries for numbers that are not in your account.
• Neither is ever used for advertising, profiling, or sale to third parties.

5.5 Changing Your Mind

You can withdraw any permission at any time in your device settings (Android: Settings > Apps > [app name] > Permissions; iOS: Settings > [app name]). Withdrawing a permission disables only the feature that needed it. Data already collected under a permission you later withdraw can be deleted using Section 14.

6. What We Do Not Do

To be explicit, because these are the questions we are asked most often:

• We do not sell your personal data or your business data to anyone.
• We do not share your data with data brokers or advertising networks.
• We do not use the contents of your business records, customer lists, photos or messages to train artificial intelligence models for use outside your own account.
• We do not track you across other companies' apps and websites for advertising.
• We do not knowingly collect data from children in breach of Section 18.
• We do not read your SMS inbox, your call recordings, or your full contact list.

7. How We Use Your Information

We use aggregated and de-identified statistics (for example "average orders per outlet") for research and product planning. This data cannot identify you or any individual.

We do not carry out automated decision-making that produces legal or similarly significant effects on you. Where an app suggests, ranks or prioritises something automatically - such as a reminder schedule - it is a recommendation, and a human user of the account decides whether to act on it.

8. Legal Bases for Processing

Where the GDPR or a similar law applies, we rely on:

• Performance of a contract: to provide the Services you have signed up for.
• Consent: for optional device permissions, marketing messages, and non-essential cookies. You may withdraw consent at any time, without affecting processing carried out before withdrawal.
• Legitimate interests: to keep our Services secure, prevent fraud and abuse, and improve reliability - balanced against your rights and freedoms.
• Legal obligation: to comply with tax, accounting, and other statutory requirements.

Under India's Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent, and for the legitimate uses that Act permits.

9. How We Share Information

We share personal data only in the circumstances set out below, and only to the extent needed.

9.1 Service Providers and Sub-Processors

These providers may only process data on our documented instructions, are bound by written confidentiality and data protection terms, and are required to apply protections at least equivalent to those described in this policy. They may not use your data for their own purposes.

9.2 Within Your Own Organisation

Other users of your ParcelApps account - such as your account owner, administrators, managers or colleagues - can see the data in that account according to the role you or your administrator assigns them. Account owners can also see audit records of actions taken in the account.

9.3 Other Disclosures

• Legal requirements: where we are required to by law, regulation, legal process, or an enforceable governmental request. Where we are legally permitted to do so, we will notify you first.
• Protecting rights and safety: to investigate and prevent fraud, security incidents, or threats to the safety of any person, and to enforce our Terms of Service.
• Business transfers: in connection with a merger, acquisition, reorganisation or sale of assets. Any acquirer would remain bound by this policy for data transferred, and we will notify you of any change in the entity responsible for your data.
• With your direction: where you connect a third-party integration or instruct us to share data.

10. Third-Party Services in Our Apps

Our mobile and web apps use a small number of third-party software development kits (SDKs) and services. The categories, and what each receives, are:

• Crash reporting and performance monitoring: device model, OS version, app version, crash stack traces, and an installation identifier.
• Product analytics: pseudonymous usage events, device and app version, coarse region.
• Push notification delivery: a device push token and the notification content.
• Payment gateway SDKs: the payment amount, order reference, and the payment details you enter directly into the gateway's own secure screen.
• Map and geocoding services: where a map feature is used, the coordinates or address being displayed.
• Sign-in providers: where you choose to sign in with Google or Apple.

Sharing a bill or report to another app. When you share an invoice, receipt or report to WhatsApp, email, or any other app, your device hands the file directly to that app through the operating system's share function. We do not receive a copy of the message, and we are not told who you sent it to. Once the file reaches the other app, that app's own privacy policy governs it. Where an app instead sends messages on your behalf through our own servers (for example automated payment reminders), that is covered by the communication providers described in Section 9.1.

Each of these providers processes data under its own privacy policy in addition to its contract with us. The exact list for a given app is reflected in that app's Google Play Data safety section and its Apple App Store privacy labels.

11. Advertising, Tracking and Advertising Identifiers

• We do not display third-party advertising inside our applications.
• We do not use your data for cross-app or cross-site behavioural advertising, and we do not engage in "tracking" as the Apple App Tracking Transparency framework defines it. If any ParcelApps app ever introduces such tracking, it will request your permission through the App Tracking Transparency prompt on iOS first, and we will update this policy before doing so.
• Where an advertising identifier is present, it is used only for attributing app installs and detecting fraudulent or duplicate installations - never for building an advertising profile of you.
• You can reset or limit the advertising identifier at any time (Android: Settings > Privacy > Ads; iOS: Settings > Privacy & Security > Tracking).
• We honour "Do Not Track" and Global Privacy Control signals on our websites by not setting non-essential analytics cookies.

12. Cookies and Similar Technologies on Our Websites

Our websites and web dashboards use:

• Strictly necessary cookies: to keep you signed in, remember your account and outlet selection, and protect against cross-site request forgery. These cannot be switched off.
• Preference cookies: to remember your language, theme and display choices.
• Analytics cookies: to count visits and understand which pages are useful. These are set only where you consent, and are not used on our mobile apps.

You can clear or block cookies in your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

13. Data Retention

We keep data only as long as we need it:

When you close your account, we delete or irreversibly anonymise your data on the timeline in Section 14. Where we are required by law to retain a record (for example a tax invoice), we retain only that record, isolate it from active systems, and delete it at the end of the statutory period.

14. Account and Data Deletion

You can delete your ParcelApps account and all associated personal data at any time, free of charge. This section is the account and data deletion mechanism referenced in our Google Play Data safety declaration and our Apple App Store listing.

14.1 Deleting From Inside the App

1. Open the app and sign in.
2. Go to Settings (or Profile).
3. Select Account, then Delete Account.
4. Confirm when prompted. You will be asked to re-authenticate.

The same option is available in the web dashboard under Settings > Account > Delete Account.

14.2 Requesting Deletion Without the App

If you cannot access the app, email privacy@parcelapps.in from your registered email address with the subject line "Account Deletion Request", telling us the app name and the registered mobile number or email on the account. We will verify your identity before acting on the request, and we will not ask you for your password.

14.3 What Is Deleted, and When

• Deleted immediately: your profile, login credentials, device tokens, session data and app preferences. Your account is deactivated and can no longer sign in.
• Deleted within 30 days: your business records, uploaded files and photos, and all personal data held in our production systems.
• Deleted within 90 days: copies held in encrypted backups, which are overwritten on a rolling cycle.
• Retained: only records we are legally required to keep, such as tax invoices (see Section 13), plus a minimal record that a deletion request was made and completed. These are isolated from our active systems and are not used for any other purpose.

14.4 Deleting Some Data Without Closing Your Account

You do not have to delete the whole account. You can delete individual records, files and photos inside the app, and you can ask us at privacy@parcelapps.in to erase a specific category of data - for example all location history, or all call-follow-up records - while keeping your account.

14.5 Export Before You Delete

Deletion is permanent and cannot be undone. Before you delete, you can export your data from Settings > Export Data, or ask us for an export at privacy@parcelapps.in. We provide it in a structured, commonly used, machine-readable format within 30 days.

14.6 Offline Data on Your Own Device

Deleting your account removes your data from our servers, but it cannot remove the offline copy held on your own computer or phone, because we have no remote access to it. To remove that copy, uninstall the application from the device, or use the app's Settings > Clear Local Data option before you uninstall it.

14.7 If Your Data Was Entered by an Organisation

If your details are in one of our apps because a business or institution put them there, that organisation controls the record and we cannot unilaterally delete it. Write to us at privacy@parcelapps.in and we will identify the organisation for you, pass on your request, and act on their instruction.

15. Data Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit using TLS 1.2 or higher for all connections between our apps and our servers.
• Encryption at rest for stored data and backups.
• Passwords stored only as salted one-way hashes - we can never see your password.
• Role-based access control and least-privilege access for our own staff, with access to production data restricted to named personnel who need it and logged when used.
• Multi-factor authentication for administrative access to our systems.
• Network isolation, firewalling and continuous monitoring of our infrastructure.
• Regular patching, dependency scanning and periodic security testing.
• Confidentiality obligations and data-protection training for all employees and contractors.
• A documented incident response process.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to you, we will notify you and the relevant authorities - including the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India - without undue delay and within the timelines the law requires.

You also play a part: use a strong, unique password, keep your device locked and updated, and tell us immediately at privacy@parcelapps.in if you think your account has been compromised.

16. Where Your Data Is Stored, and International Transfers

Our primary servers and backups are located in India. Some of our service providers (for example crash reporting, analytics or email delivery) may process limited data outside India.

Data held on your own device. Several of our applications are designed to keep working without an internet connection. Billman, for example, runs fully offline on your desktop, and our mobile apps cache data locally so you can keep billing during an outage. That offline data is stored on your own computer or phone, under your control. We can neither read it nor delete it remotely until it syncs. If you enable cloud sync or backup, a copy is uploaded to our servers in India and this policy applies to that copy. Please protect the device itself with a password or screen lock, and use your operating system's disk encryption where available.

Where data is transferred outside your country, we ensure an appropriate safeguard is in place - such as the European Commission's Standard Contractual Clauses, or a transfer to a jurisdiction recognised as providing adequate protection - and we transfer only the minimum data needed for that provider to do its job. You can ask us for details of the safeguards we use at privacy@parcelapps.in.

17. Your Rights and Choices

Subject to the law that applies to you, you have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Correct data that is inaccurate, incomplete or out of date.
• Delete your data, as described in Section 14.
• Port your data to another provider in a machine-readable format.
• Withdraw consent you previously gave, including device permissions and marketing consent.
• Object to or restrict certain processing carried out on the basis of legitimate interests.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity, as provided under India's Digital Personal Data Protection Act, 2023.
• Complain to a supervisory authority - in India, the Data Protection Board of India; in the EU/UK, your local data protection authority.

To exercise any of these rights, email privacy@parcelapps.in. We will verify your identity, respond within 30 days, and tell you if we need longer and why. We will never charge you for exercising these rights, and we will never discriminate against you or degrade your service for doing so.

You can opt out of marketing messages at any time using the unsubscribe link in any marketing email, by replying STOP to a marketing SMS, or in Settings > Notifications. You cannot opt out of essential service messages - security alerts, billing notices and important changes to the Services - while you hold an account.

18. Children's and Students' Privacy

Different ParcelApps applications have different audiences, so this section sets out three distinct situations.

18.1 Business and Management Applications

Our business applications - including ParcelPOS, TrackNew, TrackFina, Billman, Clear Trace, SalesDaddy and Shescale - are business tools that are not directed to children. An account on these applications may only be created by a person aged 18 or over. We do not knowingly allow anyone under 18 to register for them.

18.2 Study and Examination Applications

Some of our applications, such as TNExams, provide study materials and practice tests, and a learner under the age of 18 may use them. Where that is the case:

• If you are under 18, you may use the app only with the consent and under the supervision of your parent or legal guardian. During sign-up we ask you to confirm your age, and where you tell us you are under 18 we require verifiable consent from a parent or guardian before the account is activated, as India's Digital Personal Data Protection Act, 2023 requires.
• We collect only what the learning feature needs - name, contact details of the account holder or guardian, the exam being prepared for, and study progress. We do not ask a child for more data than the feature requires.
• We never track a child across other apps or websites, never serve behavioural or personalised advertising to a child, never profile a child for advertising, and never collect or transmit an advertising identifier where the app is used by a child.
• A parent or legal guardian may at any time review, correct, export or delete their child's data, or withdraw their consent, by writing to privacy@parcelapps.in. Withdrawing consent closes the account, and we delete the data on the timeline in Section 14.
• Where an app is listed for younger audiences, we design and operate it to meet Google Play's Families policy and Apple's Kids Category requirements, including the restrictions on persistent identifiers, third-party analytics and advertising.

18.3 Data About Children Entered by an Institution

Where a school, coaching institute or examination body uses our applications to manage its own records:

• Information about a student under 18 is entered by the institution, or by a parent or guardian - not by the child.
• The institution is responsible for obtaining verifiable consent from the parent or legal guardian before entering a child's data, and for confirming that it has the authority to do so. This obligation is set out in our Terms of Service.
• We process that data only to provide the service to the institution, on its instructions, and never for advertising or profiling.

18.4 If We Get It Wrong

If you believe a child has given us personal data without the consent of a parent or legal guardian, contact us at privacy@parcelapps.in. We will verify and delete it promptly, and in any event within 30 days.

19. Links and Integrations to Other Services

Our apps may link to, or integrate with, services we do not control - payment pages, mapping services, social media, government portals, or third-party tools you connect yourself. This policy does not cover them. Please read their privacy policies before providing them with your information. We are not responsible for their practices.

20. Changes to This Policy

We may update this policy as our apps evolve or as the law changes. When we do:

• We will update the "Last Updated" date at the top of this page.
• For material changes - for example a new category of data, a new purpose, or a new class of recipient - we will give you at least 30 days' notice by email to your registered address and by an in-app notice, before the change takes effect.
• Where the change requires your consent under applicable law, we will ask for it before the change applies to you.
• Previous versions are available on request at privacy@parcelapps.in.

Continuing to use the Services after a change takes effect means you accept the updated policy. If you do not accept it, you may delete your account under Section 14.

21. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it, and India's Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer with any complaint about how your personal data is handled:

Grievance Officer
Parcel Apps Private Limited
Email: grievance@parcelapps.in
Phone: +91 9731 519 519
Address: 3/327, Kamaraj Nagar, Kasinayakkanpatti, Periyakunichi, Vellore, Tirupathur, Tamil Nadu - 635602, India

We acknowledge complaints within 24 hours and resolve them within 15 days of receipt. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

22. Contact Us

For any question about this Privacy Policy, or about how your data is handled:

Parcel Apps Private Limited
Privacy: privacy@parcelapps.in
Grievances: grievance@parcelapps.in
General: hello@parcelapps.in
Phone: +91 9731 519 519
Address: 3/327, Kamaraj Nagar, Kasinayakkanpatti, Periyakunichi, Vellore, Tirupathur, Tamil Nadu - 635602, India

See also our Terms of Service and our Refund & Cancellation Policy.