Privacy policy

Who this covers

This policy covers the Parcel Intake web application and the Parcel Intake — Order Extractor Chrome extension. Parcel Intake is a tool for merchants who take orders over chat and book them with courier companies.

Parcel Intake is not affiliated with, sponsored by, or endorsed by WhatsApp LLC or Meta Platforms, Inc. WhatsApp is a trademark of its respective owner.

What the extension reads

The extension adds an Extract order button to the chat header on web.whatsapp.com. It reads message text only when you press that button and then tick specific messages. Nothing is read in the background, on page load, or from chats you have not opened.

When you press Extract, the following leaves your browser:

• The text of the messages you ticked. In an order chat this normally contains your customer’s name, phone number, delivery address and the amount to collect.
• Nothing else from the page: no contact list, no chat list, no media, no message history beyond what you ticked, and no WhatsApp account identifier.

The extension does not read, and cannot read, any site other than web.whatsapp.com. That is enforced by Chrome: the extension declares no permission for any other page.

What is stored in your browser

In chrome.storage.local, on your machine only:

• The Personal Access Token you paste in the popup, which authenticates your extension to your Parcel Intake account.
• The address of your Parcel Intake installation.
• A queue of orders waiting to be sent, including their message text, until each one finishes.

Local storage is used rather than Chrome’s synced storage specifically so the token is not copied to other machines signed into the same Chrome profile. Removing the extension deletes all of it. Disconnecting in the popup deletes the token.

Where the text goes

The picked text is sent over HTTPS to your Parcel Intake account, where it is processed into order rows for you to check and correct before anything is booked. To do that, the text is passed to a third-party large language model provider, which returns the structured fields. That provider is Groq. It processes the text to produce that response and does not use it to train models.

When an order is booked, the delivery details are sent to the courier company you chose for that order, because that is what a courier needs to collect and deliver the parcel.

Your data is not sold, not rented, not used for advertising, and not used to train any model. It is not shared with anyone other than the processors described above and where we are legally required to disclose it.

How long it is kept

The message text you extract and the order rows made from it are kept in your Parcel Intake account for as long as that account is open, because they are the record of what you booked. Write to us at the address below to have your account and its data deleted, and we will do so within 30 days except where a courier or tax record must be retained by law.

The queue inside the extension is cleared as soon as each order finishes.

Limited use

Use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Concretely: the message text is used only to produce the order rows you asked for, and for nothing else.

Security

Traffic between the extension and Parcel Intake is HTTPS. Tokens are stored as hashes on our side and shown to you in full exactly once, when you create them; a token can be revoked at any time from Settings → Extension, which immediately stops the extension that holds it. The extension’s content script never holds your token — it shares an execution context with WhatsApp Web, so the credential is kept in the extension’s own background worker instead.

Your choices

• Revoke a token: Settings → Extension in Parcel Intake.
• Stop all extraction: remove the extension from chrome://extensions.
• Request a copy or deletion of your data: write to the address below.

Contact

Questions about this policy, or a data request: privacy@parcelintake.app.

Changes

If this policy changes in substance, the date at the top changes with it and the current version is always at this URL.