Privacy notice

Last updated 5 November 2026

What Parcyo collects, why, who handles it for us, how long we keep it, and how to have it changed or deleted.

Who we are

Parcyo is run by Ermitage, LLC, 2810 North Church Street, Wilmington, DE 19802 US. We decide how the information on this page is used, which makes us its “controller” under UK and EU data protection law.

For anything on this page, email [email protected]. We reply within one month at the latest.

What we collect and why

When you sign up for the free watch

your store's web address and the email address for alerts;
a mobile number for text alerts, only if you give one and tick its box, with the exact words next to that box, when you ticked it and in which language;
a test shipping address, if you give one: country, first and last name, street, city, state or region, and ZIP or postal code. We ask for your business or warehouse address, never a customer's;
the test product and the price you expect shoppers to see, if you give them;
what you asked us to do: the exact words of the box you ticked to have your store checked, when you sent the form and in which language;
when you clicked the confirmation link we email you, which is what starts the checks;
the language of the page you signed up on, English or French;
the campaign tags of the link that brought you here, if it had any (the utm_ part of the address, for example from one of our ads or emails).

Why: to run the checks you asked for, send you alerts and, now and then, a summary of your checks, and email you about your watch, in your language. The mobile number is only for texting you alerts about your store. The campaign tags tell us which of our channels works.

Legal basis: our agreement to provide the watch you asked for (contract). For the campaign tags, our legitimate interest in knowing which of our marketing works. For text alerts, your consent, which you can withdraw at any time by replying STOP or writing to us.

So that nobody can use the form to flood an inbox, we send at most a few confirmation emails a day to one address or from one connection. To count them we keep a one-way code made from the email address and from your connection's IP address, never the address itself, and delete it the next day. Legal basis: our legitimate interest in keeping the form from being abused.

What the checks do on your store

Only after you sign up, a browser we run visits your store about once an hour, as a phone and as a desktop: a product page, a size or color, add to cart, the cart and checkout.

At checkout it types only your test address. It never types an email, a phone number (not even the one for text alerts) or card details, never presses pay, and stops before payment, so no order is placed.
It blocks ad and analytics pixels (Meta, Google, TikTok and others) during every visit, so your ad accounts don't get fake events.
It names itself in its user agent: CheckoutSmokeAlarm. More about the test browser

Each check records screenshots of every step (they show your test address as typed into your checkout), a short video and the page's code when a step fails, timings, the scripts and apps your pages loaded, and the shipping options and payment methods your checkout showed. Screenshots of your product page and cart from the latest check, on a phone and a computer, are also copied to Vercel and shown on your store's page. Screenshots of your product page (or offer page) and cart are also included in the alert and first-check emails we send you, through Resend. Screenshots of checkout pages, which show your test address, never leave the server and are never in an email.

Why: to tell you what broke, with the evidence. Legal basis: contract.

If you answer “Was this real?”

Each alert has a link where you can tell us whether the break was real, a false alarm, or you're not sure, with a comment if you like. We record your answer, your comment, which alert it is about and when you answered. No login, and nothing else about you. Why: to count our false alarms and reduce them. Legal basis: our legitimate interest in making the alerts accurate.

Your store's page

Most emails we send you start with a link to your store's page. Anyone with that link can see the page, but not change anything, for 30 days; opening it keeps it open in that browser until the link expires. When the address that gets your alerts changes, every link sent before stops working.

To change a setting, you ask for a sign-in link, which we send only to the address that gets your alerts. It works once, for 15 minutes.
When you change where alerts go, we email the new address to confirm and tell the previous address, which can undo the change for 7 days.
We keep a record of each change (what changed and when, never the addresses in plain text) with your sign-up. The site keeps the address that gets your alerts and, after a change, the previous one, so the change can be undone. If we added your store by hand, the site also keeps the alert address you sign in with.
When you pick a product, our site reads your store's public product list. It uses that copy for 10 minutes and keeps only the latest one.
Sign-in links are limited like confirmation emails, with the same kind of one-way codes, deleted the next day.

Why: to show you what we check on your store and let you change what we test and where alerts go, safely. Legal basis: contract.

If you pre-order

Stripe takes the payment on its own page. We see your name, email address, country and the last four digits of your card in Stripe, never the full card number. The pre-order button also tells Stripe the language of the page and the campaign tags of the link that brought you here, if it had any, so we can see which channel led to the pre-order. When you pay for a store, Stripe tells us which store the subscription is for: the store's id and the email address Stripe collected, so we can keep checking that store. If we can't tell which store it is, we keep that email with the payment until we've matched it ourselves. Why: to bill and support your subscription and keep accounting records. Legal basis: contract, and the accounting and tax rules we must follow. For the campaign tags, our legitimate interest in knowing which of our marketing works.

If we contacted you first

We email or message stores that are running ads, to offer them checkout monitoring. For each store we note:

its name, website and country;
its published business email address (from its contact page, footer or legal notice) or its public Instagram account;
the owner's first name, if the store's own pages give it;
whether it is running ads, from the Meta Ad Library and the Google Ads Transparency Center, and for UK stores, whether it is a limited company, from Companies House.

Where it comes from: the store's public website and Instagram profile, the public ad libraries and Companies House. We never buy lists or guess addresses. Before you sign up, the only visit we make to your store is one ordinary load of its homepage, to confirm it runs on Shopify. We don't check, scan or monitor a store until its owner signs up.

Why, and on what basis: our legitimate interest in offering a relevant service to businesses. We rely on it only where the law allows business-to-business emails without prior consent: stores in the United States, UK limited companies and LLPs, and stores based in France. We don't email or message UK sole traders or partnerships, or stores in Germany or any other country.

Keeping it fair: at most three emails, or a single Instagram message, with no tracking pixels and no tracked links. Reply “no” and we stop at once.

When you visit this website

Vercel, which hosts the site, handles your IP address, browser details and the pages you ask for, to deliver them and protect the site from abuse. We don't use analytics. This site sets no cookies for ads or analytics.

When you email us

We keep our email conversations in our mailbox, to answer you and keep track of what we agreed.

Who handles it for us

These services store or process data on our behalf:

Vercel hosts this website, runs the sign-up form, and stores each sign-up and your store's page, with its summary, screenshots and settings (Vercel Blob).
Resend sends the link to confirm your sign-up, alert and summary emails (alert and first-check emails include screenshots of your product page or offer page and cart, never of checkout), sign-in links and notices about changes to your settings, and mails us when a store asks to be watched.
Twilio sends text-message alerts, only to a mobile number you gave us and ticked the box for.
Slack, when we use it as our own alert channel, receives a copy of each alert.
Stripe takes pre-order payments. Stripe also uses some payment data for its own purposes, such as fraud prevention, under its own privacy policy.
DigitalOcean (DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, United States) rents us the one server that runs the checks, in the EU. Their data-processing agreement was last updated 14 October 2026.
Healthchecks.io, based in the EU, receives a regular signal from our server, with no data about you or your store, so we hear if it stops.
Our email provider stores the emails we send and receive.

Every store, wherever it is, including stores in the United States and Canada, is checked from that one server in the EU. Once you click the confirmation link, the server fetches your sign-up from Vercel over an encrypted, authenticated connection, along with any changes you make on your store's page, and keeps the store's sign-up details, test address, screenshots and results there. So we can watch over the service and show you your store's page, the server also sends Vercel a short summary of each store's checks: the store's web address, when each check ran and how it went, the step that failed and a short reason, the product, option and price it tested, what each alert said and whether it was delivered, and the free watch's dates. It never includes test addresses, email addresses, phone numbers or checkout screenshots. To check who may sign in to a store's page, it includes a code computed from the store's alert email with a secret key, so without that key the address can't be read back. The site keeps each store's latest summary, with the checks and alerts of the last 14 days, for your store's page. When a store leaves the server, its summary and screenshots are kept 30 more days, then deleted. The optional iPhone checks, when we turn them on for a store, run on our own computer instead, which keeps their screenshots and results. We keep no backups of the server. Your sign-up also stays at Vercel, and a store we add by hand, such as a paying one, is also kept on an encrypted list on our own computer. Deleting your data means deleting it from each of these places.

Most of these companies are based in the United States, so your data may be processed there, although the server that runs the checks is in the EU. For data from the UK and the EU, these transfers rely on the safeguards in each provider's data-processing terms, such as the standard contractual clauses.

We don't sell your data or use it to show you personalized ads.

How long we keep it

Sign-up details, test address and check results: while your watch or subscription runs, then deleted within 60 days after it ends.
The record of your consent (store, email, the text you agreed to and when): 3 years after the last check, so we can show we had your permission.
Your free watch's dates: when it ends, the server keeps only your store's web address and the watch's start and end dates, for 3 years, so that each store gets one free watch.
The confirmation-email and sign-in limits: the one-way codes are deleted the day after.
Your store's page summary (the checks and alerts of the last 14 days, and what we tested): while the server checks your store, then 30 more days.
Screenshots on your store's page: only the latest of each. Each is replaced at the next check and deleted at the latest 30 days after it was taken.
Your settings changes and the addresses your store's page uses (the one that gets your alerts, the previous one after a change, and a new one waiting to be confirmed): like your sign-up details, while your watch or subscription runs, then deleted within 60 days after it ends.
Sign-in, confirm and undo links: a record that each link was used, with no address in it, kept until the link expires. If we added your store by hand, the address you typed to sign in is kept only until the link is used or expires.
Your store's product list, read when you pick a product: only the latest copy, deleted with your store's page summary.
Your mobile number for text alerts: while your watch or subscription runs, then deleted within 60 days after it ends. If you reply STOP or ask us to stop texting, we stop at once and take the number off our alert list. The record of your text-alert consent, and of its withdrawal, is kept 3 years, like the one above.
Answers to “Was this real?”: as long as the check results, then deleted within 60 days after your watch ends.
Payment records: as long as accounting and tax law requires.
Outreach contacts: deleted 60 days after our last email if you don't reply. If you ask us to stop, we keep only your store's domain and the date on a do-not-contact list, so we never write again.
Emails with us: up to 3 years after our last exchange.

Your rights

You can ask us to:

tell you what we hold about you and send you a copy;
correct it, or delete it;
stop contacting you, or stop using your data for a purpose you object to. An objection to our outreach always wins;
stop the checks on your store: reply to any of our emails, or write to us. We stop at once.

Email [email protected] from the address we have for you, or tell us your store's web address. It's free, and we answer within one month. If we need to confirm the request is yours, we'll ask.

In the UK or the EU you can also complain to a data protection authority: the ICO in the UK, the CNIL in France, or the authority where you live or work. Several US states, California among them, give similar rights to know, correct and delete; we apply them for everyone.

Cookies

This site sets no cookies for ads or analytics, and loads no advertising or analytics tags.

If you open your store's page, the site sets strictly necessary cookies, never used for ads: parcyo_my_v_ followed by your store's id, which keeps the page open until the link you used expires (at most 30 days), and parcyo_my_s_ followed by your store's id, which keeps you signed in for 12 hours, or 30 days if you choose. Both are sent only to your store's page. Our own team's dashboard sets one more, parcyo_ops, only in our own browsers.

One more thing is stored without asking, because it only remembers your language: if you click a pre-order button on the French page, the tab keeps “fr” in its session storage while you pay on Stripe, so you come back to the French page. It's deleted as soon as you're back, or when you close the tab.

Changes

When this page changes, so does the date at the top. If a change affects the stores we watch, we email them before it takes effect.