Parcelo Privacy Policy

Effective date: 22 September 2026 · Version 1.0

1. Introduction

This Privacy Policy explains how Parcelo collects, uses, shares, stores and protects your personal data when you use the Parcelo mobile applications, shipper web portal, websites, APIs and related services (together, the Services).

Parcelo, available at parcelo.ai, is operated by Alhama Alulya Company, a one-person limited liability company registered with the Saudi Ministry of Commerce under National Number 7038492018, based in Riyadh, Kingdom of Saudi Arabia (Parcelo, we, us or our). Parcelo is the data controller for the personal data described in this Policy, except where we process data on behalf of a shipper or logistics partner, in which case that partner is the controller and we act as its processor.

We designed this Policy to meet the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations issued by the Saudi Data and AI Authority (SDAIA), and to follow recognised international standards, including the EU General Data Protection Regulation (GDPR), ISO/IEC 27001 and ISO/IEC 27701.

By creating an account, generating a Parcelo Code, or otherwise using the Services, you confirm that you have read and understood this Policy. Where the law requires your consent for a specific processing activity, we will ask for it separately and you may withdraw it at any time.

2. Definitions and scope

This Policy applies to all Receivers, Shippers, Couriers, visitors and business contacts. It does not apply to third-party apps, websites or services that link to or from Parcelo; those are governed by their own policies.

3. Personal data we collect

We collect only the data we need to verify addresses, confirm the right receiver and complete deliveries.

We do not use photos to create facial recognition templates. Automated photo checks confirm that a location or parcel image is genuine and relevant; they are not used to identify people.

If you give us personal data about another person, such as an alternate receiver, you confirm that you are allowed to share it and that the person has been told about this Policy.

4. How we use your data and our legal bases

We process personal data only for specific, stated purposes and on a lawful basis.

Your address privacy. Shippers and merchants see your Parcelo Code, not your full address. Couriers receive the location details needed for an assigned delivery only, and only for the duration of that delivery.

Automated decisions. Automated photo and fraud checks may flag a delivery or account for review. Where a decision would significantly affect you, a person on our team reviews it, and you can ask us to explain it or to reconsider.

No sale of data. We do not sell your personal data, and we do not share it with third parties for their own advertising.

5. Who we share data with

We share personal data only when needed to run the Services, and only the minimum required.

• Couriers and logistics partners — the Receiver's name, delivery location, instructions and contact number for an assigned delivery.

• Shippers and merchants — delivery status, timestamps and proof of delivery for their own shipments. They do not receive your full address unless you choose to share it.

• Service providers — cloud hosting, SMS and WhatsApp messaging, maps, payment processing, analytics, crash reporting and customer support tools. They act on our instructions under written data processing agreements and may not use your data for their own purposes.

• Authorities — courts, regulators, law enforcement and government bodies when the law requires it, or when needed to protect the rights, property or safety of Parcelo, our users or the public.

• Professional advisers — lawyers, auditors and insurers, under confidentiality duties.

• Corporate transactions — a buyer, investor, successor or affiliate in connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets. The receiving party must protect your data in line with this Policy, and we will notify you where the law requires.

• With your consent — any other party you ask us to share with.

We may share aggregated or de-identified data that cannot reasonably identify you, for example delivery-success statistics, with partners, investors or the public.

6. International data transfers

We store the personal data of users in the Kingdom of Saudi Arabia primarily on servers located in the Kingdom, or in other locations permitted by Saudi law.

Some service providers may process data outside the Kingdom or outside your country, for example for messaging, maps or crash reporting. When this happens, we transfer data only as permitted by the PDPL and its Regulations on Personal Data Transfer outside the Kingdom, and, where applicable, the GDPR. Safeguards include adequacy decisions, standard contractual clauses, binding corporate rules, or other approved mechanisms, together with a transfer risk assessment where required.

As we expand to other GCC and international markets, we may host data in the region where you use the Services to meet local data residency rules.

7. How we keep your data secure

Protecting your data is central to what Parcelo does. Our service exists to keep your home address private, and we apply the same care to everything you entrust to us.

Our safeguards include:

• Encryption — data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent industry-standard encryption.

• Address masking — your full address is replaced by your Parcelo Code and revealed only to the assigned Courier, only for the time needed to deliver.

• Access control — staff and contractors access personal data on a need-to-know basis, with role-based permissions, multi-factor authentication and access logging.

• Secure infrastructure — hosting with reputable cloud providers holding recognised security certifications, network firewalls, separated production and development environments, and app-integrity checks.

• Secure development — code review, security testing, dependency monitoring and periodic independent penetration tests.

• People and contracts — confidentiality obligations, privacy training, and data processing agreements with every service provider.

• Monitoring and recovery — continuous monitoring, encrypted backups and a documented incident response plan.

If an incident happens. If a personal data breach occurs, we will act promptly to contain it, notify SDAIA within 72 hours of becoming aware of it where the PDPL requires, and inform affected users without undue delay when the breach may cause them harm, together with steps they can take to protect themselves.

No method of transmission or storage is completely risk-free, so we cannot guarantee absolute security. We continuously review and upgrade our safeguards to match international best practice. You can help by keeping your password and OTP codes private and by telling us immediately at contact@parcelo.ai if you suspect unauthorised use of your account.

8. How long we keep your data

We keep personal data only as long as needed for the purposes in this Policy, then delete or anonymise it.

We may keep data longer where the law requires it, to resolve disputes, or to establish or defend legal claims. Anonymised data may be kept indefinitely.

9. Your rights

Depending on where you live, you have the following rights over your personal data:

• Be informed about how we collect and use your data, as set out in this Policy.

• Access your data and receive a copy in a clear, readable format.

• Correct data that is inaccurate, incomplete or out of date.

• Delete your data when it is no longer needed, subject to legal retention duties.

• Withdraw consent at any time, without affecting processing already carried out.

• Object or restrict processing based on our legitimate interests, including direct marketing.

• Data portability — receive your data in a machine-readable format or have it sent to another provider, where applicable.

• Human review of significant automated decisions.

• Complain to SDAIA in the Kingdom of Saudi Arabia, or to the data protection authority in your country.

You can exercise most rights in the app under Settings → Privacy, or by emailing contact@parcelo.ai. We may ask you to verify your identity first. We respond within 30 days, which may be extended as permitted by law for complex requests, and we will tell you if that happens. These requests are free, unless a request is clearly unfounded or excessive.

10. Children, cookies and third-party services

Children. The Services are intended for users aged 18 and over. We do not knowingly collect data from children. If we learn that a child has registered, we will close the account and delete the data.

Cookies and similar technologies. Our websites and portal use essential cookies to keep you signed in and secure. With your consent, we also use analytics cookies and software development kits (SDKs) to understand usage and fix errors. You can manage non-essential cookies through our cookie banner, your browser settings, or your device settings.

Device permissions. The app may ask for location, camera, photo library and notification access. Each is used only for the feature that needs it, and you can turn them off at any time in your device settings, though some features may then stop working.

Third-party services. Links to or integrations with third-party services, such as maps, payment pages or shipper websites, are governed by those parties' own privacy policies.

11. Free and paid services

Parcelo reserves the right, at its sole discretion and at any time, to convert any free Service, feature or plan into a paid one, and to introduce, change or remove fees, subscriptions, pricing tiers, usage limits or trial periods.

• Notice. We will give at least [30] days' notice in the app or by email or SMS before any new fee or price increase applies to you.

• Your choice. You may accept the new terms by continuing to use the paid Service, or stop using it and close your account before the change takes effect. Your data remains protected under this Policy either way.

• No retroactive charges. Fees apply only to use after the effective date. We will never charge for Services already provided free of charge.

• Free access limits. Free plans may carry limits on volume, features or duration, and we may end promotional or trial access at the end of its stated period.

• Taxes. Prices may be shown excluding VAT and other applicable taxes, which will be added as required by law.

• Payment data. Payments are processed by licensed payment providers. Payment-related personal data is handled as described in Sections 3 to 8.

Changing a Service from free to paid does not change how we protect your data. We will not use your data for new purposes, or sell it, as a result of a pricing change.

12. Parcelo's rights and limits of liability

To the fullest extent permitted by applicable law, Parcelo reserves the following rights:

1. Change the Services — add, modify, suspend or discontinue any feature, app, integration or Service, in whole or in part, temporarily or permanently.

2. Manage accounts — suspend, restrict or terminate any account that breaches our Terms of Service or this Policy, presents a fraud or security risk, or where required by law.

3. Refuse or limit use — decline registrations, limit usage, or block access from certain regions, devices or networks.

4. Use de-identified data — create, use, commercialise and share aggregated or de-identified data that does not identify you, for analytics, research, product development and business purposes.

5. Own the platform — all rights in the Services, software, Parcelo Codes, algorithms, AI models, trademarks and content remain the exclusive property of Parcelo or its licensors. Using the Services grants you a limited, personal, non-transferable, revocable licence only.

6. Use feedback — use any suggestions or feedback you provide, without obligation or compensation to you.

7. Engage partners — appoint, replace or add service providers, subcontractors and technology partners, subject to the safeguards in this Policy.

8. Transfer the business — assign or transfer our rights and obligations, including the Services and related data, to an affiliate or successor as part of a corporate transaction.

9. Protect Parcelo — preserve and disclose data where needed to enforce our agreements, investigate violations, or defend legal claims.

Limitation of liability. The Services are provided on an "as is" and "as available" basis. To the extent permitted by law, Parcelo is not liable for indirect, incidental, special or consequential losses, or for loss of profit, data or goodwill, arising from use of or inability to use the Services, or from acts of Shippers, Couriers or other third parties. Parcelo acts as a technology facilitator and is not a carrier or courier.

Your statutory rights are not affected. Nothing in this Policy limits rights you have under the PDPL, consumer protection laws or other mandatory laws that cannot be waived by agreement, or limits our liability where such a limit is not permitted by law.

13. Changes, governing law and contact

Changes to this Policy. We may update this Policy at any time to reflect changes to the Services, our business or the law. We will post the updated version with a new effective date. For material changes, we will notify you in the app or by email or SMS at least [30] days before they take effect and, where the law requires, ask for your consent again.

Governing law. This Policy is governed by the laws of the Kingdom of Saudi Arabia. Disputes are subject to the exclusive jurisdiction of the competent courts in Riyadh, without prejudice to mandatory protections in your country of residence.

Language. This Policy is available in Arabic and English. If the versions conflict, the Arabic version prevails.

Contact us.

Effective date: 22 September 2026 · Version: 1.0