Privacy policy

ParcelWren is a Shopify app made by ACTIVEDOTS LTD, a company registered in the UK (company number 17234408). This policy explains what the app does with personal data. Last updated 31 October 2026.

Who is responsible

The Shopify merchant who installs the app decides why and how their customers' data is used, so they are the controller. ACTIVEDOTS LTD handles that data only to run the app for the merchant, so we are a processor. For merchants' own account details (for example the email address we send alerts to) we are the controller.

What the app does

It sends the merchant's paid Shopify orders to their own Royal Mail Click & Drop account so they can buy postage, and it sends tracking details back to Shopify when the parcel is on its way.

What we send to Royal Mail

For each order, into the merchant's own Click & Drop account:

• the recipient's name, company name and shipping address;
• the order number, date, values and currency;
• item names, quantities, weights and, for international orders, customs details (HS code and country of origin);
• only if the merchant turns these on: the customer's phone number and email address (for Royal Mail delivery notifications) and the order's tags.

Royal Mail Group Ltd holds this under the merchant's own agreement with Royal Mail. See Royal Mail's privacy notice for how they use it.

What we store

We do not store customers' names, addresses, email addresses or phone numbers. We read each order from Shopify when we send it and pass it straight to Royal Mail. We keep:

• Shopify order IDs and order numbers, the order's status in the app, Royal Mail order numbers and tracking numbers;
• error messages, and a one-way fingerprint of the shipping address (to spot address changes; it can't be turned back into an address);
• a log of what the app did (for example "3 orders sent"), without customer details;
• the merchant's settings, alert email address, and Click & Drop API key (encrypted).

How long we keep it

• The activity log: 90 days.
• Records of finished orders (fulfilled, skipped or cancelled): 90 days after they were last updated.
• Everything for a store: deleted when Shopify tells us to, which is 48 hours after the merchant uninstalls the app.
• When a customer asks a merchant to delete their data, we delete our records for that customer's orders.

Who else processes data for us (sub-processors)

• Shopify: the platform the app runs inside.
• Supabase: database hosting, in London (UK).
• Fly.io, Inc.: runs the app, in London (UK).
• Resend: sends alert and summary emails to merchants (merchant email address and order numbers only).

Security

Connections are encrypted. Merchants' Click & Drop API keys are encrypted at rest (AES-256-GCM). We don't write customer names, addresses, emails or phone numbers to our logs.

Your rights

If you bought from a store that uses this app, contact that store first: they control your data and can ask us for anything we hold. Merchants and anyone else can contact us at support@activedots.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

Our Terms of Service and Data Processing Agreement set out the rules between us and merchants.

Changes

If we change this policy we'll update the date at the top. Significant changes will be shown in the app.