Privacy policy
Effective October 12, 2026. Updated October 14, 2026: Agency plan section added.
Parcel uses the information needed to prepare your image export, recover saved results, prevent abuse, and handle payment or support issues. No connection to your store is required.
Parcel is operated by Lumen Collective LLC, which is responsible for the information described in this policy. Privacy questions can be sent to support@parcelexport.com.
What you upload
Your CSV is read and parsed in your browser. The application does not upload the original CSV file.
For a saved background export, selected image metadata is sent to the server, including image URLs, product identifiers (such as handles, URL slugs or product IDs), titles, SKUs, barcodes where you choose them for filenames, positions, alt text, the platform the file came from, your store’s web address if you enter one, and your export options. Parcel also records each image’s width and height. The service stores this metadata, downloaded images, and the generated ZIP archive to prepare and recover your package. Include only the product information needed for your export. Before payment, Parcel may test-download a few of the images to check that they can be fetched.
Optional email notifications
You can optionally save an email address with your export. If delivery is not yet configured, the interface says so; the request stays queued and can be sent only if delivery is enabled before the export expires. Keep your private return link because email delivery is not guaranteed. The address and recovery key are encrypted at rest in the notification queue. Resend receives the address and results link to send the requested notification. Queue payloads are cleared after the provider accepts the message or removed when the export expires. Delivery and retry status may remain until expiry. The notification is transactional; the address is not used by Parcel for marketing.
Payments
When checkout is available, payments take place on Stripe or PayPal. Parcel does not collect card numbers. It stores the export price, payment-provider references, payment status, and any billing-review or correction status needed to authorize downloads and reconcile transactions. Payment providers handle your payment information under their own privacy policies.
Agency plan
When you start Agency checkout, Parcel creates a pending account record with your chosen plan, a hashed copy of a new agency key and, if you entered one, your billing email. If you don’t finish paying, that record is deleted about an hour later and the Stripe checkout page is closed.
If you subscribe to the Agency plan, Parcel keeps an account record: the email address you gave at Stripe checkout, your Stripe customer and subscription references, your plan, billing period and status, and a hashed copy of your private agency key.
Your browser saves the agency key so you can return to your account. Anyone with the key can use your plan, so keep it private.
If you ask to recover a lost key, Parcel emails a one-hour access link to that address through Resend. Your current key keeps working until the link is used. This email is transactional and not used for marketing.
Client names you enter for agency exports are stored with those export records and used to name the ZIP file.
No fixed automatic deletion period currently applies to account records. To ask for your account to be closed and its email removed, see Support.
Browser storage and private links
Your browser may store the export IDs and recovery keys locally and a pending export attempt in session storage. Clearing that storage can remove your ability to return without the original recovery link. Anyone who has your recovery link can access the associated results while the link remains valid. Keep recovery links private and avoid including them in support messages. Your cookie choice is also saved there.
Cookies and analytics
Parcel uses Google Analytics cookies only if you accept them in the cookie banner. The Cookie policy explains what they collect and how to change your choice at any time.
Usage limits and operational records
Parcel uses a salted hash of your IP address or available hosting identity to enforce usage limits. Error records help diagnose failures and abuse. Hosting providers may also process IP addresses, request headers, and operational logs as part of running and protecting the service.
How long information is kept
Processing has a 24-hour deadline from submission. Once results are ready, download access lasts 24 hours. The scheduled worker removes stored metadata files, images, ZIP data, and sensitive notification payloads after expiry. Minimal failed-email records remain until reviewed by the operator. Physical deletion can be delayed during a service interruption.
Job records, usage records, payment references, and billing-review information are separate from the downloadable files. Job and payment records remain beyond the download window for recovery and reconciliation; no fixed automatic deletion period currently applies to them. Application error records are scheduled for removal after seven days.
Service providers
Cloudflare provides hosting, database, file storage, and scheduled background processing. Source images are downloaded only from the image hosts allowed for the platform your file comes from: for Shopify files, Shopify’s CDN (cdn.shopify.com); for Squarespace files, Squarespace’s image service (images.squarespace-cdn.com); for Webflow files, Webflow’s file service (cdn.prod.website-files.com); for Wix files, Wix’s media server (static.wixstatic.com). Those hosts receive a request from Parcel’s servers, not from your device. For WooCommerce files, images are downloaded from the store’s own website, which you confirm before the export starts. Parcel identifies itself to that website as ParcelBot (see parcelexport.com/bot). The website sees a request from Parcel’s servers, not from you. Resend is used for enabled email notifications, and Stripe or PayPal is used for enabled checkout. Google Analytics measures visits for visitors who accept analytics cookies. Providers receive information necessary for their role in delivering the requested service.
Your choices and privacy requests
You can use Parcel without creating a separate Parcel account, omit the optional email address, decline analytics cookies, and clear saved export information from your browser. Clearing browser storage does not delete server records. For questions or a request concerning your information, see Support. Include the export ID and the information involved; do not include card details or a recovery key. Requests may require verification and are subject to applicable retention obligations.
Do not upload customer records, passwords, API tokens, payment information, or other sensitive personal information. This policy may be updated as the service changes; the effective date identifies the current version.