Privacy Policy

Effective date: September 22, 2026

This Privacy Policy explains how ParcelHub ("ParcelHub", "we", "us", or "our") collects, uses, discloses, and protects personal information when you use parcelhub.ca, my.parcelhub.ca, our applications, retail locations, and related shipping, printing, and design services (the "Services"). We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Information we collect

• Account information — name, email address, password, mobile phone number (if you add one), organization and business details.
• Shipment information — sender and recipient names, addresses, contact details, package contents, customs declarations, and tracking history.
• Payment information — processed by our payment providers; we store only limited card metadata and transaction records. This metadata includes the card brand, last four digits, expiry, issuing country, the cardholder name given to the payment provider, and a non-reversible identifier the provider generates for each card so that the same card can be recognized without us holding the card number. We also store, from our payment provider, a token that lets us charge a card you have saved.
• Fraud and security signals — the outcome of payment authorizations and declines, the IP address, device, and browser used to register and sign in, and indicators that the same card, device, or network is associated with more than one account. We collect this to protect customers, cardholders, our carriers, and ParcelHub from fraud and unauthorized payments.
• Usage information — device, browser, IP address, approximate location, and interactions with the Services, collected via cookies and similar technologies.
• Store and order information from connected sales channels — if you connect an online store (for example Shopify, Etsy, eBay, or WooCommerce), we receive the orders you choose to fulfil through ParcelHub. Those orders contain your shop's identity and, for each order, your buyer's name, shipping address, email address or phone number where the store provides it, the items ordered, and the order and fulfilment status. Section 4 explains what we do with this and how long we keep it.
• Communications — support messages, feedback, and, if you enrol in SMS updates, your phone number, verification status, and notification preferences.

2. How we use your information

• Provide the Services: create labels, arrange pickups, track shipments, fulfil print orders.
• Collect what a carrier bills us after a shipment has moved, where they re-weigh or re-measure a parcel and charge more than we quoted. Section 7 explains how long we keep a payment method for this, including after you remove it, and our Terms of Service set out what we may charge — the carrier's amount at cost, and nothing else.
• Process payments, and detect, investigate, and prevent fraud, unauthorized use of a payment method, money laundering, and other unlawful or abusive activity — including reviewing accounts and transactions, and placing holds, restrictions, or suspensions where we identify a risk. Our Terms of Service set out what we may do when we identify such a risk.
• Maintain account security and verify identity where required.
• Send service communications (order confirmations, tracking updates, account notices).
• Send text message updates you have opted into (see Section 3).
• Send marketing emails where you have consented; you can unsubscribe at any time.
• Improve the Services, and comply with legal obligations.

3. Text messaging (SMS) and your phone number

If you opt into SMS shipment updates, we use your verified mobile number solely to send you the automated status messages you selected (for example: ready for pickup, in transit, delivery exception, delivered) and related service messages such as verification codes. You can opt out at any time by replying STOP to any message or by updating your account settings; reply HELP for assistance. Message frequency varies and message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except with our SMS delivery provider solely to the extent necessary to deliver the messages you requested.

4. Connected stores and sales channels

You can connect an online store to ParcelHub so that its orders flow in and its tracking numbers flow back out. Connecting a store is always your choice, it is always started by you, and you can disconnect it at any time from your ParcelHub integrations settings or by uninstalling our app from the store platform.

What we do with the orders. We use the order information listed in Section 1 only to do the job the connection exists for: show you your unfulfilled orders, create a shipping label for the order you select, and write the tracking number and fulfilment status back to your store so your buyer is notified. We do not use your store's order information to market to your buyers, we do not build profiles of them, and we do not sell, rent, or disclose it for anyone else's advertising.

Who is responsible for your buyers' information. When you connect a store, the personal information of your buyers is yours, and we handle it on your instructions and on your behalf. You remain responsible for having told your buyers how their information is used and for having the consent your own privacy policy and local law require. If one of your buyers asks us directly to access or delete their information, we will refer them to you, and we will act on your instruction.

Access we ask for. We request only the permissions the integration needs — reading orders and products, and reading and writing fulfilments. We do not request access to your store's payment details, customer lists, or marketing tools.

Disconnecting and deletion. When you disconnect a store or uninstall our app, the access token for that store is revoked and we stop retrieving orders immediately. Where the store platform sends us a data-deletion or data-access request on your behalf or on a buyer's behalf — as Shopify does through its mandatory shop and customer redaction requests — we action it within 30 days, and we confirm it back to the platform. Shipping records for orders you already shipped are kept as described in Section 7, because a carrier, a customs authority, or a tax authority can still raise a question about a parcel that has already moved.

5. When we share information

• Carriers and logistics partners — shipment details needed to transport and deliver your packages.
• Service providers — payment processing, cloud hosting and object storage, email delivery, SMS and voice delivery, address validation, and analytics providers, bound by contractual confidentiality and limited to providing their service to us. They act on our instructions and may not use your information for their own purposes.
• Sales channel platforms — where you have connected a store, the platform that hosts it (for example Shopify), limited to the order and fulfilment information needed to read the order and write the tracking number back.
• Fraud prevention — where we investigate suspected fraud or unauthorized use of a payment method, the information necessary to resolve it, shared with our payment processors, the financial institution that issued the payment method, the affected cardholder, or law enforcement.
• Legal requirements — where required by law, court order, customs authorities, or to protect our rights, users, or the public.
• Business transactions — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

6. Where we store and process information

ParcelHub is a Canadian company and our databases are hosted in Canada. Some of the service providers in Section 5 — in particular payment processing, email and SMS delivery, and content delivery — process information in the United States and other countries. Where information is processed outside Canada it is subject to the laws of that country, including lawful access by its courts and authorities.

Wherever information is processed, we require the provider by contract to protect it to a standard comparable to this Policy, to use it only to provide their service to us, and to return or delete it when that service ends. You can ask us which providers hold what, and where, at [email protected].

7. Retention

We keep personal information only as long as needed for the purposes above and to meet legal, tax, and customs record-keeping requirements. When you close your account, we delete or anonymize your identifying information as described in Section 8, except where retention is required by law.

Shipment records. A shipping label is a transaction record, and it is also a customs and tax record. We keep shipment records — including the sender and recipient details printed on the label, the carrier, the amount charged, and the tracking history — for at least seven years, which is the period Canadian tax and customs record-keeping rules require. These records are also what lets us answer a carrier adjustment, a lost-parcel claim, a chargeback, or a law-enforcement or customs enquiry about a parcel long after it was delivered. Shipment records are retained when an account is closed; the account they belonged to is anonymized around them.

Payment methods you have removed. When you remove a card from your account it stops being available to you at once, and it is no longer offered anywhere in the Services. We do keep the payment token behind it for one narrowly defined purpose: settling an adjustment a carrier raises on a shipment that card already paid for, which carriers can do weeks after a parcel has moved. We keep it for that purpose for 24 months from the day you remove it, and then we delete it and instruct our payment provider to delete it too, after which the card cannot be charged. What we keep after that is the card's brand, last four digits, and the non-reversible identifier described in Section 1 — enough to recognize the same card across accounts, and not enough to take payment. Our Terms of Service set out what an adjustment charge may cover, and how to dispute one.

Where an account has been restricted, suspended, or closed for suspected fraud or unauthorized use of a payment method, we retain a limited record of that decision and the related fraud signals — including the non-reversible card identifier described in Section 1 — for as long as necessary to prevent the same activity recurring, to deal with chargebacks and disputes, and to meet our legal obligations. Deleting this record would defeat its purpose, so it is retained even after an account is closed.

8. Deleting your account

You can delete your ParcelHub account yourself. Sign in at my.parcelhub.ca and go to Account → Security → Delete account. You do not need to email us, and you do not need our permission. If you would rather we did it for you, write to [email protected] from the address on the account and we will action it.

What happens. Deleting signs you out everywhere and starts a 30-day grace period during which the account is inactive but recoverable — signing in again during those 30 days cancels the deletion. After 30 days the deletion is final and cannot be reversed. At that point we scrub the identifying information in the account: your name, your email addresses, your phone number, your avatar, your password and two-factor secret, your linked Google, Apple, Microsoft and Facebook sign-ins, your address book, any business profile, and any unshipped drafts. Your API keys are revoked, your device notification registrations are deleted, and the identity documents you uploaded are queued for deletion from storage.

Disconnect any online store you have connected before you delete, from your integrations settings or by uninstalling our app in the store — that is what revokes our access to it, and Section 4 describes what we then delete.

What we keep, and why. We do not delete shipment, invoice, and wallet records. They are financial and customs records we are required to keep (Section 7), and they are how a carrier adjustment, a refund, a claim, or a chargeback raised after you leave can still be answered. Those records stay, with the identifying information around them removed, so that what remains is a record of a shipment rather than a record about you.

We also keep, for the periods and reasons Section 7 describes, the saved payment token needed to settle a carrier adjustment on a shipment that card already paid for (24 months from the day the card was removed, then deleted), the card metadata that lets us recognize the same card, and — where an account was closed for suspected fraud or unauthorized card use — a limited record of that decision and its signals.

Business accounts. Deleting a business or organization account works the same way and is done from Account → Organizations by the account owner. Any remaining wallet balance is queued for refund, and an account with an unpaid invoice or an outstanding balance stays in grace until it is settled rather than being closed with money or debt outstanding.

9. Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit, access controls, and audit logging. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner as required by law.

10. Your rights

You may access, correct, or delete your personal information through your account settings (see Section 8) or by contacting us. You may withdraw consent to optional communications (marketing emails, SMS updates) at any time without affecting your use of the Services. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

If you are outside Canada. ParcelHub serves merchants who sell worldwide. Where the law of your country or state gives you rights over your personal information — including the rights of access, correction, deletion, portability, restriction, objection, and withdrawal of consent under the European and UK GDPR, and the rights to know, delete, correct, and opt out of sale or sharing under California law — you may exercise them with us at [email protected]. We will respond within the period that law requires, and we do not charge for a first request or treat you differently for making one. Where the personal information is your buyer's rather than your own, Section 4 explains who to ask.

These rights have limits set by law. We may decline a request to access, correct, or delete information where doing so would reveal personal information about another person, where the information was generated in the course of a fraud or security investigation, where disclosure could reasonably be expected to compromise such an investigation or the detection of fraud, or where we are required or permitted by law to retain the information. We will tell you when we refuse a request and why, to the extent we are permitted to.

11. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used. You can control cookies through your browser settings; some features may not work without them.

12. Children

The Services are not directed to children and we do not knowingly collect personal information from anyone under the age of majority without parental consent.

13. Automated decisions and fraud screening

Some of our fraud and security checks run automatically. They compare the information described in Section 1 — including payment outcomes, the cardholder name held by our payment provider, the card identifier, and device and network signals — to identify accounts and payments that carry a risk of fraud or unauthorized card use.

Where a decision that significantly affects you — such as declining a payment, holding a wallet balance, or restricting or suspending your account — is made exclusively by automated processing, we will tell you so at the time. You may ask us what personal information was used and the principal factors that led to the decision, submit your own observations, and ask that the decision be reviewed by a member of our staff. Contact us at [email protected] to do any of these.

Your local rights. Privacy laws differ from place to place. Where a law that applies to you gives you greater rights than this Policy, that law prevails. If you reside in Quebec, you also have the rights given by Quebec's private-sector privacy legislation, including the rights described in this section, the right to the portability of your information, and the right to complain to the Commission d'accès à l'information.

14. Changes to this Policy

We may update, add to, or replace this Policy at any time and at our discretion, including to reflect changes to the Services, our service providers, our fraud and security controls, or applicable law. The current version is always posted at parcelhub.ca/privacy and applies from the effective date shown at the top of the page.

Where a change is material, we will post the updated Policy with a new effective date and give you at least 30 days' notice before it takes effect, by email or through the Services, describing what is changing. Where the law requires your consent for a new use of your personal information, we will obtain it before that use begins. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

15. Contact us

Privacy questions or requests — including access, correction, and deletion requests, and questions about a store connection — reach our privacy contact at [email protected] or toll-free at 1-888-301-7447. ParcelHub is based in Toronto, Ontario, Canada.

We answer privacy requests within 30 days. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada, to your provincial regulator, or to the data protection authority where you live.