Privacy policy

ParcelClarity is operated by its owner (the "operator"). Contact for privacy questions and requests: hello@stockbrandenterprises.com.

Your 3PL (the company that invited you, or that you set up) decides what business data it puts into its workspace and who may see it. The operator provides the service and stores that data on the 3PL's behalf.

• Account details. Your email address, your name, and your password. The password is passed to our sign-in provider (Supabase Auth), which stores only a one-way hash; the application does not store it. When you create a 3PL account you also give a company name.
• Workspace and membership records. Which 3PL and which customer (brand) accounts you belong to, your role, and invitations (the invited email address, the role, and when it was sent, accepted or revoked). An invitation's secret link token is stored only as a hash.
• Business data you or your 3PL enter. Customer-facing rate cards, fee schedules, surcharge rules, calculator inputs, saved models and forecasts, and branding (display name, logo, accent color, contact name, email, phone and website shown to customers).
• Files you upload. Rate cards, zone charts, ZIP lists, order or shipment files, and adjustment-history files. These can contain confidential business information and, in an order file, whatever columns your own file has. The service is built for what the customer was or would be charged; it has no field or integration for carrier buy rates, and files that look like carrier costs are refused. Please do not upload personal data you do not need: modeling does not require names or street addresses.
• Activity records. An audit trail of security-relevant actions (for example creating or changing a workspace, customer account, membership or invitation, activating a rate card or fee schedule, exporting results or downloading a report), each with the user ID and time. Short-lived counters limit how often an account can perform an action.
• Reports you download. Reports and exports are generated when you ask for them and sent to your device. A record that the download happened is kept; the file itself is not stored for later.

We do not ask for your location, contacts, photos, microphone or camera, and the iPhone app does not request those permissions.

To sign you in, show each person only the data their role allows, run the calculations and reports you ask for, send account and invitation emails, keep the service secure and prevent abuse, and answer your requests. We do not sell personal data, and we do not use it for advertising.

• Sign-in cookies. The service sets cookies that keep you signed in. They are HttpOnly (page scripts cannot read them), SameSite=Lax, and Secure in production.
• Workspace choice cookie. A cookie named pc_ctx remembers which workspace you last picked, for up to 30 days. It is HttpOnly and is re-checked against your memberships on every request.
• No advertising or analytics. The service contains no advertising, no cross-site tracking, and no third-party analytics or crash-reporting code. The iPhone app does not track you across other companies' apps or websites.
• Device storage. A small service worker caches only a static offline notice. Pages, calculations, uploads and reports are never cached on your device by the app.

• Supabase hosts the database (including uploaded files) and the sign-in system. The current project is in the AWS US East (Ohio) region.
• Vercel hosts and serves the website and runs the server code. Like any host, it processes request metadata such as IP address and user agent in its infrastructure logs.
• Stripe and Apple process subscription payments for 3PL workspaces. We receive the plan, status and renewal date, and a provider customer or transaction id; we never receive card numbers. Apple purchases are made with your Apple ID through the App Store.
• Resend may be used to deliver invitation emails when it is configured; it then receives the recipient's email address and the message. Sign-up confirmation and password-reset emails are sent through Supabase's email service, or through the email provider the operator configures there.

We share data with no one else, except where the law requires it. Your 3PL can see the data of the customer accounts it serves, as described in the product.

Data is separated by account in the database itself. A brand customer sees only its own brand's data and only the pricing its 3PL assigned to it. A 3PL sees its own workspace. One 3PL cannot see another's. Platform operators have no ordinary application access to workspace data; database administrators of the hosting provider and the operator can technically reach stored data, and we limit that to what running and supporting the service requires. Data is encrypted in transit (HTTPS) and the hosting providers encrypt stored data at rest.

• Account, workspace, pricing, file and model data are kept while the account or workspace exists, because the service depends on them. There is no automatic expiry yet.
• Raw adjustment-history files and their sample rows are deleted when an import is committed, discarded or withdrawn.
• The audit trail is append-only and is kept after an account is deleted. It records user IDs, not profiles; some entries include the email address involved in an invitation or membership.
• Deleted data may remain in the hosting providers' backups until those backups expire. We cannot erase backups on request.

You can correct your name in Settings (or Account for customer users). To ask for a copy of your data, or for help deleting your account and personal data, write to hello@stockbrandenterprises.com from the email address on the account. We will verify it is you before acting.

Deleting your sign-in removes your profile and your memberships. Business data that belongs to a workspace (rate cards, files, models) belongs to the 3PL and stays with the workspace; its record of who created it is cleared. Deleting an entire 3PL workspace and all its data is a separate request to the same contact. You can delete your own account inside the app (Settings, or Account for customer users, then Delete account). If you are the only administrator of a workspace that has other members, or its paid plan is still renewing, the app asks you to sort that out first. A workspace left with no members is closed, and its data is removed on request.

Depending on where you live you may have further rights, such as to object to or restrict processing, or to complain to your local privacy regulator.

ParcelClarity is a business tool and is not directed to children. We do not knowingly collect data from anyone under 16.

If we change this policy in a way that matters, we will update the date above and, where we can, tell account holders.