Legal & Privacy
v1.1Effective date: October 21, 2026 · Version 1.1
This policy describes how ParcelDuty ("we," "us") processes data through the API and developer portal. For data submitted via the API about your consignments, parcels, and items (item descriptions, HS/HTSUS codes, declared values, quantities, and consignment identifiers), you are the data controller and ParcelDuty is a data processor acting under Article 28 GDPR. For account, authentication, and billing data you provide directly (name, email, organization), ParcelDuty acts as the data controller.
A calculation or manifest request (including EU H7 line grouping, US Section 321 de minimis evaluation, ACE Entry Type 86/11 routing, and Pre-Flight HS Sanity checks) may include: SKUs, product descriptions, 6-digit HS codes, 10-digit HTSUS codes, quantities, unit prices, net mass, countries of origin, consignment identifiers, carrier codes, declarant EORIs, and IOSS registration numbers. This data describes commercial goods and physical shipments, not identified individuals. Where it incidentally includes personal data (e.g. a person's name appearing in an item description or declarant record), it is processed solely to perform the calculation and verification requested.
Calculation requests are processed synchronously, in memory, entirely offline (the HS-6 and HTSUS tariff tables, Sanity heuristics, and trade-remedy schedules are embedded locally in the service and execute without external network lookups). The full item-level payload of an order — descriptions, unit prices, masses, and EORI numbers — is not written to persistent storage. Ephemeral calculation tokens (calc_tok_...) used to link a calculation to a subsequent manifest generation call are held in memory only and expire shortly after issuance.
What is persisted for metering and dashboard analytics is a minimal usage ledger per request: the consignment identifier, raw item count, grouped line count, duty saved, execution duration, and timestamp. This record excludes item descriptions, item prices, or consumer identities.
To operate a developer account, we store your name, email address, organization, subscription tier, and API key metadata (key nickname, environment prefix, creation date, and a cryptographic one-way SHA-256 hash of the key — never the raw secret after initial issuance). This data is retained for the life of your account and deleted or anonymized within 90 days of account closure, except where retention is required for tax, accounting, or audit compliance.
Account data, API key hashes, and usage metering records are stored exclusively on dedicated infrastructure located in the European Union (Germany). We do not rely on transatlantic data transfers or standard contractual clauses to store your data outside the EU. Enterprise-tier EU data residency addenda with specific statutory commitments are available upon request.
We utilize a minimal set of European infrastructure subprocessors (dedicated cloud hosting, transactional email delivery, and persistent volumes) strictly necessary to operate the Service, each bound by a Data Processing Agreement consistent with Article 28 GDPR. We do not use subprocessors that ingest request payloads for advertising, machine learning training, or commercial resale.
Where ParcelDuty acts as controller (account and billing data), processing is grounded in the performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in securing our infrastructure against fraud and abuse (Art. 6(1)(f) GDPR). Where ParcelDuty acts as processor (API consignment payloads), processing is executed strictly on your documented instructions pursuant to Art. 28 GDPR.
Where GDPR applies to data for which ParcelDuty is controller, you may request access, rectification, erasure, or portability of your account data, or object to or restrict its processing, by contacting [email protected]. If you believe your rights have been infringed, you have the right to lodge a complaint with your supervisory data protection authority. Where ParcelDuty is a processor of data submitted via the API, requests concerning end-consumer information must be directed to you as the data controller.
API keys are stored exclusively as one-way SHA-256 cryptographic hashes. All communications with the API and developer portal are encrypted using TLS 1.3 / HSTS in transit. Direct access to production database volumes is restricted to essential engineering personnel under strict key-based authentication.
The Service is an enterprise B2B developer API and does not knowingly collect or process data from children.
We may update this policy periodically to reflect statutory changes or API updates. Material modifications will be communicated via the developer portal or by email at least 14 days before taking effect.
For data protection and GDPR inquiries, contact: [email protected].