Privacy Policy — Parcel for ChatGPT
Last updated: 24 August 2026
Identity and contact details are aligned with the published Parcel privacy policy on the delivery web app (
vendor/parcel-delivery-web), so this document is consistent with what customers already agree to.OpenAI requires a published privacy policy stating, at minimum: the categories of personal data collected, the purposes of use, the categories of recipients, retention timelines, and the controls offered to users. Each has its own section below. The retention periods match the TTLs in the source; change one, change the other, or this document stops being true.
Parcel for ChatGPT lets you create and track Parcel courier deliveries in Bahrain from a conversation in ChatGPT. This policy explains what it does with personal data.
The service is operated by Parcel Delivery ("we"), registered at Building 1226 Road 5124 Block 351 Office 62, 6th Floor, Manama — Alsuwayfiah, Kingdom of Bahrain.
1. Categories of personal data we collect
We collect only what a delivery cannot be created without.
From you, the Parcel account holder
| Data | Where it comes from |
|---|---|
| Your Parcel customer id, business name, email address and region | Parcel's /0/me, after you authorise the connection |
| Your Parcel API client credentials | Issued by Parcel when you authorise; stored encrypted |
| An account identifier from your ChatGPT sign-in | The OAuth token ChatGPT presents |
About the person receiving a delivery
| Data | Why it is unavoidable |
|---|---|
| Recipient name | Printed on the delivery task so the courier can identify the drop |
| Recipient phone number | The courier calls it on arrival; a delivery cannot be dispatched without it |
| Delivery address, and its coordinates | The courier has to be sent somewhere |
| Delivery notes, if you add any | Passed through verbatim |
A note on precise location. Coordinates are collected because a courier delivery is not possible without them. They are used only to dispatch that delivery, are never used to build a location history, and are never used for advertising or profiling. Where an exact building cannot be identified, we dispatch to the centre of the block and tell you so — we do not guess a more precise point than we have.
What we deliberately do not collect
Payment card details, government identifiers, health information, passwords, or your Parcel account password. The connection is authorised on Parcel's own page; we never see or ask for your password. We do not collect anything "just in case".
2. What we use it for
- To create, price, track and cancel the deliveries you ask for.
- To turn an address you give us into coordinates a courier can be sent to.
- To confirm you are who you say you are, and that the Parcel account is yours.
- To prevent a network error from creating the same delivery twice.
- To keep short-lived operational logs so failures can be diagnosed.
We do not use personal data for advertising, profiling, resale, or to train machine learning models.
3. Who we share it with
| Recipient | What they receive | Why |
|---|---|---|
Parcel (external-api.tryparcel.com) |
The order: recipient name, phone, address, coordinates, notes | To dispatch the courier. Parcel is the operator of the delivery and applies its own privacy terms. |
| Google Maps Geocoding | The address text you provide, when no exact pin is available | To resolve an address to coordinates. Sent only when needed, and only the address. |
| OpenAI / ChatGPT | Whatever appears in your conversation | ChatGPT is the interface you are using. Its handling of the conversation is governed by OpenAI's own privacy policy. |
We do not sell personal data, and we do not share it with anyone else. There are no advertising or analytics third parties in this service.
4. How long we keep it
These periods are enforced in code, not by policy alone.
| Data | Retained | Notes |
|---|---|---|
| Order drafts (recipient name, phone, address, coordinates) | 2 hours | Deleted automatically. A draft is conversation scratch space; it disappears whether or not you place the order. |
| Resolved address references | 1 hour | Deleted automatically. |
| Single-use authorisation tokens | 10 minutes | Deleted automatically. |
| Your linked Parcel account and encrypted credentials | Until you disconnect | This is what stops you re-authorising on every use. |
| Duplicate-prevention records for created orders | 90 days | Holds the order reference and a hash, so a retry cannot create a second delivery. |
| Operational logs | Per the server's log rotation | Identifiers, paths and error reasons — credentials and request bodies are never logged. Logs are written to the host's system log; we recommend rotating them at 30 days. |
Completed deliveries are records of Parcel's own service and are retained by Parcel under its terms, not by this app.
5. Your controls
- Disconnect at any time. Remove the Parcel app from ChatGPT, or ask us to revoke the connection. Revoking deletes the stored credentials; the app can then do nothing on your account.
- Nothing is dispatched without your explicit confirmation. Building an order creates nothing. A delivery is created only after you confirm the exact order shown to you, and the confirmation is void if any detail changes afterwards.
- Ask for a copy, or for deletion. Write to us at the address below and we will provide or delete the data we hold, subject to records Parcel must keep for a completed delivery.
- Recipients. If you are a delivery recipient and want to know what we hold about you, contact us with the tracking link or phone number used.
6. How it is protected
- Your Parcel client secret is encrypted before storage using envelope encryption, with a key held separately from the database. A copy of the database alone does not reveal it.
- Credentials and request bodies are never written to logs.
- Every request is authenticated, and tokens are bound to this service specifically, so a token issued for something else cannot be used here.
- One customer's data is unreachable from another's: drafts and address references are partitioned by account.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your data, we will tell you.
7. Children
This service is for business use by Parcel account holders and is not directed at children. It is not intended for anyone under 13.
8. Changes
If this policy changes materially we will update the date above and, where the change affects how your data is used, tell you before it takes effect.
9. Contact
support@tryparcel.com — for privacy questions, data access requests, or to have a connection revoked. Post: Building 1226 Road 5124 Block 351, Office 62, 6th Floor, Manama, Alsuwayfiah, Kingdom of Bahrain. Phone: +973 173 333 070.
Governing law: Kingdom of Bahrain.