Privacy policy

1. In short

Sending a parcel needs the details of whoever sends it and whoever receives it, and those details have to reach the carrier: without them there is no shipment. Beyond that, we collect the minimum needed to run your account and keep it safe.

We do not sell your data. We do not advertise. We use no profiling cookies, and no third-party analytics runs on this site - not Google, not Meta, nobody. The details of a shipment only reach those who need them to deliver it (see section 4).

2. What we collect

Account. Username, password (stored only as a hash, never in clear text), language, your link with our Telegram bot if you use it, and the date you last signed in.

Shipments. Name, address, postcode, city, country, phone and email of the sender and the recipient; the weight and size of the parcel; for shipments leaving the EU, a description of the contents; and the tracking number the carrier assigns.

Payments. Amount, currency and date. For blockchain top-ups we also record the address the payment comes from, which is how we credit it to the right account.

Technical data. Like any website, our server records the IP address and what the browser sends by itself with every page (browser, operating system, language). We use it only to keep the service secure and to prevent abuse, for example to slow down automated sign-ups. We put no trackers on your device and do not follow you to other sites.

3. Why we process it

• To perform the contract: creating the label, handing it to the carrier, and running your balance, refunds and support.
• To meet legal obligations: tax and accounting records, and customs declarations for shipments leaving the EU.
• For our legitimate interest: the security of the service, preventing fraud and abuse, and defending our rights in a dispute.

4. Who we share it with

The carrier that makes the delivery receives the sender's and the recipient's details, because it cannot deliver without them. It handles them as an independent controller, under its own privacy policy.

The logistics operators we buy transport capacity from, only as far as issuing the label requires.

The technical providers that host the site and protect it against attacks: traffic passes through their systems on its way to us.

The authorities, if and when the law requires it, or to establish or defend a legal claim.

We do not pass data to anyone for marketing purposes.

5. How long we keep it

• The label PDF: 72 hours after purchase, then it is deleted.
• Shipment tracking: 15 days from purchase.
• Names, addresses, phone numbers and emails of the sender and the recipient: only as long as they are needed to issue the label (up to 7 days if the purchase does not go through, so it can be retried). After that only a fingerprint remains, for 365 days, from which the details cannot be recovered. While the service keeps it on, we also hold an encrypted copy for up to 14 days that opens only with your password, so you can look it up from your list of shipments: we cannot read it.
• Amounts, countries, carrier and tracking number of a shipment, and balance movements: as long as accounting and tax obligations require.
• The address a crypto top-up comes from: 90 days in clear, because that is how we credit the payment to the right balance and trace it if something goes wrong. After 90 days only a fingerprint remains, from which the address cannot be recovered.
• The server's access log: up to 15 days. It is the ordinary log of a web server, not a profile of you: we only open it to investigate a security problem.

6. Cookies and data kept in your browser

The website sets no cookies for customers. Your session, your chosen language and any invite code are kept only in your browser, in this site's local storage: no other site can read them, and the session is removed when you sign out. The version of the shop that works without JavaScript, open only at our onion address, keeps its session, your language and an anti-forgery token in cookies that only that version uses. No advertising trackers and no third-party analytics.

The fonts are served from our own server and nothing is loaded from external networks; only the mini-app opened inside Telegram uses Telegram's own code.

7. Your rights

You can ask for access to your data, its correction or deletion, the restriction of its processing and its portability, and you can object to processing based on legitimate interest. You can delete your account yourself from your account settings.

Some data cannot be deleted on request while it is still needed: a shipment already handed to the carrier cannot be withdrawn from its systems, and accounting records must be kept for the period the law sets.

You also have the right to lodge a complaint with the competent supervisory authority.

8. Contact

For anything about your data, write to us on Telegram: @agora_logistic, or open a ticket from your account.