ParcelGridHome / Privacy policy
Privacy policy
ParcelGrid Labs OÜ processes personal data to run the package mirror: identify workspaces, keep tokens safe, bill correctly and operate the service. We do not run advertising or analytics profiles.
1. What we process
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, work email, organisation, VAT ID | Contract, invoicing, support |
| Credential metadata | Token identifier, role, creation and last-use time | Authentication, audit |
| Request metadata | IP address, timestamp, host, path, status code, token identifier | Delivery of artifacts, abuse prevention, capacity planning |
| Usage figures | Egress, cache size, cache-hit ratio per workspace | Billing, plan enforcement |
| Support correspondence | Messages and attachments you send us | Answering the request |
We do not process package contents beyond what is required to store and serve them, and we do not build user profiles from download behaviour.
2. Legal bases
- Contract — providing the mirror, authenticating tokens, billing usage.
- Legitimate interest — preventing abuse, keeping the service available, capacity planning.
- Legal obligation — tax and accounting records.
- Consent — where you subscribe to product email; it can be withdrawn at any time.
3. Retention
| Data | Retention |
|---|---|
| Access logs (IP address, request path, status code) | 30 days |
| Authentication and token audit events | 90 days |
| Usage and egress aggregates | 13 months |
| Invoices and billing records | 7 years, as required by law |
| Support threads | 24 months after the last message |
4. Cookies
The public site sets no cookies and loads no third-party resources. The console uses one session cookie after
sign-in, marked Secure, HttpOnly and SameSite=Lax; it expires when the
session ends.
5. Sharing
We share data with processors only: hosting and object storage inside the EU, a payment provider for card and SEPA processing, and an email provider for transactional messages. Each processor is bound by a data processing agreement. Data is disclosed to authorities only where legally required and, where permitted, the workspace owner is informed first. Personal data is not sold.
6. International transfers
Service data is stored and processed in the European Economic Area. If a support case requires access from outside the EEA, it happens on the basis of the European Commission's Standard Contractual Clauses.
7. Your rights
You may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Write to privacy@parcelgrid.mywire.org; we answer within one month and may ask for verification of identity. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate.
8. Security
Traffic is encrypted with TLS 1.3, tokens are stored as hashes, access to production systems is limited to personnel with a need to know and reviewed quarterly. A digest mismatch is treated as a security event and blocks the affected artifact.
9. Contact
Controller: ParcelGrid Labs OÜ, Tallinn, Estonia. Data protection contact: privacy@parcelgrid.mywire.org.
Last updated 28 October 2026.