Team, security and privacy
Data export and privacy
Export everything in your workspace, see what is kept and what can be erased, and copy a ready-made privacy notice for your customers.
Updated
Your workspace's data is yours: you can export all of it at any time. This article also explains who is responsible for which data, what is kept for good, what can be erased, and how to make a privacy request.
Exporting your workspace
Owners and Admins export everything from Settings → Data and privacy with “Export data”, after their authenticator code. The export is a ZIP file with a README.txt that explains each file:
shipments.csv: every shipment, archived and sample ones included, with its tracking number in full, both as we use it and as it was entered;events.csv: the courier's updates for every tracking number the workspace follows;contacts.csv: your customers' details on each shipment;notes.csv: the notes on shipments;tags.csv: the workspace's tags;members.csv: the people in the workspace, past and present;audit_log.csv: the workspace's audit log;alert_rules.json: every alert rule, with its trigger, filters and recipients;webhooks.json: every webhook endpoint, its events and status; signing secrets are never exported, in any form;payments.csv: every payment recorded for the workspace, with its reference;activation_codes.csv: every activation code entered in the workspace: its plan, length, when it was entered and by whom, and the plan's new end date; never the code itself;report_schedules.json: every scheduled report, archived ones too;report_runs.csv: every run of a scheduled report, with any error in full.
The report files themselves aren't in the ZIP: they stay ready to download under Analytics → Reports.
The export is prepared in the background. When it is ready, whoever asked for it gets a notice in the app, “Your data export is ready”, and the export is listed on the same page with a “Download” button. Each download asks for your authenticator code if your session hasn't used it yet, and opens a link that works for 24 hours; the file itself is kept, so you can download it again later. A workspace can export once an hour, and every export and every download is recorded in the workspace's audit log.
Who is responsible for what
- Your customers' details (names, phone numbers, emails, addresses, and your labels and notes): your business decides why and how they are used, and TrackParcel processes them on your behalf, under the Data Processing Addendum you accept when you create a workspace. The services we use to do that are listed on the sub-processors page, and Owners get a notice in the app 30 days before we add one.
- Your own account (your name, email address and sign-in details): TrackParcel is responsible for these, as described in our privacy policy. Your own privacy rights are below.
A notice for your customers
Tell your customers that you share their details with TrackParcel. You can use this wording on your website, checkout or order confirmation:
We share your name, phone number, email and delivery address with our tracking provider, TrackParcel, to track your delivery.
What is kept and what can be erased
| Data | What happens to it |
|---|---|
| Tracking numbers, couriers, courier updates and statuses | Kept permanently, including after a workspace closes. They are the record of each shipment. |
| Order IDs, tags, and the pincode, city and state | Kept permanently. |
| Customer names, phone numbers, emails and address lines | Kept while the workspace exists. Can be erased on request, and are erased when it closes. |
| Shipment labels and notes | Kept while the workspace exists. Can be erased, and are erased when it closes. |
| The import files we keep | Kept permanently. Erasing customer details, or closing the workspace, empties only the columns each import matched to customer name, phone, email, address, label and note, on the sheet it read; columns it didn't match and the file's other sheets are kept as you uploaded them. |
| Payments and refunds | Kept permanently. Erasing customer details never touches them. |
| Activation codes entered, and who entered each | Kept permanently, as billing records. Only each code's last 4 characters and a one-way hash are stored, never the code. |
Erasing a customer's details
When one of your customers asks you to erase their details, an Owner or Admin selects their shipments and chooses “Erase customer details”, in the list's selection bar or a shipment's ⋯ menu. After your authenticator code, the dialog says what will be erased, and you type ERASE to confirm. Their name, phone, email and address line, and the shipments' labels and notes, are erased; their tracking numbers and delivery history stay. The erasure runs in the background and reaches the export and import files we keep as well as the app. In an import file, it empties the columns the import matched to customer name, phone, email, address, label and note, on the sheet it read; columns it didn't match, such as a second phone number or address line, and the file's other sheets are kept as you uploaded them. Tracking numbers are always kept. A notice in the app tells you when it is done.
Privacy requests about the workspace
Under Settings → Data and privacy → Privacy requests, Owners and Admins can ask us to correct something we hold about the workspace (“Correct our data”) or raise a grievance about how we handled its data or a request (“Raise a grievance”). Every request the workspace has made is listed there with when it was received, its due date and where it stands, and our answer shows there once we have given it. Your customers' own details are erased with “Erase customer details”, above.
The same page lists, under “Notices and your rights”, the policies the workspace agreed to, our Grievance Officer, and how fast we answer each kind of request:
| Request | Answered |
|---|---|
| Access to your personal data | Within 30 days |
| Correction | Within 30 days |
| Erasure | Within 30 days |
| Grievance | Acknowledged within 2 business days; resolved within 30 days, and never later than 90 days (DPDP Rules, rule 14) |
| Nomination | Within 30 days |
Letting support see your workspace
Our support team can't see inside your workspace unless you allow it. Under Settings → Data and privacy → Support access, an Owner or Admin chooses “Allow support access” for 24 hours, 72 hours or 7 days, and can end it early with “End access now”. Support then sees the workspace read-only, without being able to change anything. Every visit appears in the workspace's audit log, and “Support access history” on the same page lists every time access was allowed, who allowed it, and each visit made under it, with its times and ticket number.
Closing a workspace
Only the Owner can close a workspace, from Settings → Data and privacy, by choosing a reason, typing the workspace's address and using an authenticator code. Export your data first if you want a copy.
- For 7 days the workspace keeps working, with a banner, and the Owner can choose “Cancel closure”.
- Then any subscription is cancelled, members lose access and pending invitations are cancelled, API keys and webhooks stop, scheduled reports pause, and every shipment is archived.
- Your customers' names, phone numbers, emails and address lines, and your labels and notes, are erased. Tracking numbers, couriers, order IDs, tags, pincodes, cities and states, and the delivery history are kept, as are payment and refund records. In the import files we keep, the columns each import matched to customer name, phone, email, address, label and note are emptied, on the sheet it read; columns it didn't match, such as a second phone number or address line, and the file's other sheets are kept as you uploaded them.
Your own privacy rights
Whatever your role, Owner to Viewer, Account → Your privacy rights is about your own account, not a workspace's shipments:
- Download my data gives you one JSON file with your profile, your workspaces and roles, your sign-in sessions, what you did in each workspace (tracking numbers in full), your alert mutes and your requests. It needs an authenticator app: you're asked for its code first, and you can download once an hour. Each download is recorded as a request on your account.
- Correct your data or raise a grievance about how we handled your personal data or one of your requests.
- Name a nominee: the email address of someone who may exercise your rights for you if you die or can't act yourself. Only TrackParcel sees it.
Your requests are listed there with their due dates, and answered within the times in the table above.
Leaving or deleting your account
- You can leave a workspace from Account → Workspaces, unless you are its Owner (see Team and roles).
- Deleting your account, under Account, asks for your authenticator code if you use one, and for
DELETEtyped to confirm. It ends all your sessions and erases your name. Shipments you added stay with their workspace, and the audit log shows “Deleted user”. If you own a workspace that is still open, you first need to transfer ownership or close it.