Courier Tales

Tools

Log in Sign up

Legal

Privacy policy

Effective from 20 October 2026

This policy explains how Courier Tales Shipping Private Limited ("Courier Tales", "we", "us") handles personal data when you visit couriertales.com, use the Courier Tales platform at app.couriertales.com or our APIs, or when a seller ships an order to you through Courier Tales. Courier Tales is a separate company from the sellers who use it.

1. Who we are and our role

  • For sellers' own account data (your name, business, KYC and payment details) and for visitors to our website, we are the data fiduciary (controller): we decide why and how that data is used.
  • For buyers' data in a seller's orders (the person the parcel is shipped to), the seller is the data fiduciary and Courier Tales is the seller's data processor. We process that data only on the seller's instructions, given by using the platform to ship, track and manage their orders, and as described in our Merchant agreement.

2. Personal data we collect

Sellers and their team members

  • Account details: name, business name, email address, mobile number, password (stored only as a one-way hash), profile picture, and your Google name, email and picture if you sign in with Google.
  • KYC details: date of birth, gender, address, PAN, Aadhaar number, GSTIN, business PAN and copies of these documents, and your bank account holder name, bank, account number, account type, IFSC and a cancelled cheque.
  • Pickup addresses and contact people, rate plan, wallet transactions, invoices, COD remittances and bank transfer proofs (UTR and screenshot).
  • Support tickets and the files you attach, such as photos, videos and invoices.
  • Technical data such as IP address, browser and device, and sign-in times, used for security.

Buyers (the people sellers ship to)

  • Name, delivery and billing address, pincode, phone number and, if the seller provides it, email address.
  • Order details needed to ship: items, quantities, order value, payment mode (prepaid or COD) and the COD amount.
  • Shipment events: pickup, tracking, delivery attempts, failed-delivery reasons, proof of delivery and returns.
  • If the seller turns these features on: replies to order-confirmation messages, and notes from calls our team makes to resolve a failed delivery.

Website visitors and enquiries

  • Details you send through our contact, callback and careers forms (name, email, phone, business details, message).
  • Tracking lookups: the AWB, order ID or Shipping ID you enter, and the delivery phone number needed for some lookups.
  • Analytics cookies, only if you accept them (see section 9).

3. Where the data comes from

  • From you, when you sign up, complete KYC, create orders or contact us.
  • From the sales channels a seller connects, such as Shopify and WooCommerce, and from marketplaces such as Amazon if the seller authorises us. A seller connects a channel only through that channel's own authorisation screen. We never ask for, or accept, a seller's marketplace password or API keys.
  • From CSV or Excel files and API requests a seller sends us.
  • From couriers, which send us tracking updates, weights and proof of delivery for shipments booked through us.

4. How we use personal data

  • To create and secure seller accounts, verify identity and business details (KYC), and prevent fraud.
  • To show rates, book shipments, print labels and invoices, arrange pickups, deliver parcels, track them, handle failed deliveries and returns, and send tracking updates to buyers when the seller asks us to.
  • To charge for our services, issue GST invoices, remit COD amounts and resolve weight disputes and claims.
  • To answer support requests and enquiries.
  • To meet legal, tax and regulatory obligations and respond to lawful requests from authorities.
  • With consent only, to measure how our website is used.

Buyer data is used only to ship and deliver the seller's orders, to support that seller, and to meet legal and tax requirements. We do not sell personal data. We do not use buyer data for our own marketing, for advertising, to contact buyers for reviews, or to build profiles. We do not combine one seller's buyer or order data with another seller's, or share it with other sellers.

5. Who we share data with

We share personal data only as needed for the purposes above:

  • Couriers that carry the seller's shipment, such as Delhivery, Xpressbees, Ekart, Shadowfax, Amazon Shipping, and international carriers for international shipments. Each courier receives only the details needed to pick up, carry and deliver that shipment.
  • Service providers that run parts of our platform under contract: Amazon Web Services (servers, file storage and email), Brevo (account emails), Meta WhatsApp Business Platform (WhatsApp messages the seller turns on), Razorpay (payments), Google (sign-in with Google and, with consent, website analytics).
  • The seller's own channels, when we send fulfilment and tracking details back to a store or marketplace the seller has connected.
  • Authorities, when the law requires it.

We share data only with parties bound by written terms to protect it and use it only for the task we give them, and we share it only with parties whose security standards we assess to be at least as strict as ours. Our employees and contractors can access personal data only where their job needs it (for example, to answer a support ticket or resolve a delivery problem). They are bound by confidentiality obligations and must complete data protection and security training.

6. Data received from marketplaces, including Amazon

When a seller authorises Courier Tales to access their Amazon Seller Central account through Amazon's Selling Partner API, these additional rules apply to every piece of information we receive from Amazon:

  • Only what we need. We request only the data needed to ship the seller's merchant-fulfilled (self-ship) orders: order details, and the buyer's name, delivery address and phone number to print the label and give to the courier.
  • Only for shipping. We use buyers' personal data from Amazon only for merchant-fulfilled shipping of that order and to meet legal or tax requirements, and never for marketing, advertising or contacting buyers about reviews.
  • Only with the courier. We share it only with the courier carrying that order, never with other sellers or anyone else.
  • Deleted after delivery. We delete buyers' personal data received from Amazon no later than 30 days after the order is delivered, unless a law requires us to keep it longer, in which case we keep it only for that legal purpose.
  • Deleted when access ends. If the seller disconnects Amazon or closes their account, or Amazon asks us to, we securely delete all information received from Amazon for that seller within 30 days, except what the law requires us to keep.
  • Protected. It is encrypted in transit (TLS 1.2 or higher) and at rest, kept apart from or tagged separately from other data, and accessible only to staff and systems that need it.
  • Incidents. If we detect a security incident affecting it, we inform Amazon within 24 hours and the affected seller without undue delay.

The same rules apply to buyer data we receive from any other marketplace that sets equal or stricter requirements.

7. Where data is stored

Our servers run on Amazon Web Services. Platform data, KYC documents, labels and proof-of-delivery files are stored in AWS data centres in India (Mumbai region). Until 31 October 2026, copies on servers we retired when we moved to India remain in AWS data centres in the United States; they are switched off and will then be deleted. Some service providers listed in section 5 may process data in other countries. Wherever data is processed, we require the protections described in this policy.

8. How long we keep data

  • Seller account, KYC and transaction records: for as long as the account is active, and afterwards for as long as tax, accounting and other laws require (for example, GST records).
  • Buyer data in a seller's orders: for as long as the seller needs it for their shipping records while their account is active, unless the seller asks us to delete it earlier. Buyer data from Amazon is deleted as set out in section 6.
  • Proof-of-delivery files: 30 days after we receive them.
  • Enquiries and callback requests: until they are resolved, and then only as long as needed to keep a record of them.

When data is no longer needed, we delete it or make it anonymous.

9. Cookies and analytics

Our platform uses essential cookies to keep you signed in securely. With your consent, this website also uses Google Analytics (Google LLC) to understand how visitors use it, for example which pages are viewed and how people arrive at the site. Google Analytics sets cookies and collects information such as pages visited, approximate location, device and browser. We also use the Meta Pixel (Meta Platforms, Inc.), which sets cookies and sends Meta information about your visit, such as pages viewed, browser and IP address, so that we can measure and improve our advertising on Facebook and Instagram. Meta may combine this with information it already holds about you, under its own privacy policy. Nothing is collected until you click Accept, and you can change your choice at any time from "Cookie settings" at the bottom of every page.

10. How we protect data

We use technical and organisational measures appropriate to the data we handle, including encrypted connections (HTTPS) between your browser and our platform, passwords stored only as one-way hashes, role-based access so that staff see only what their role needs, private storage of uploaded documents that can be opened only through short-lived signed links, and masking of passwords, tokens and account numbers in our logs. No system is completely secure; if a personal data breach affects you, we will inform you and the authorities as the law requires.

11. Your rights

Subject to the law, you can ask us to:

  • tell you what personal data we hold about you and how we use it;
  • correct, complete or update it;
  • delete it, where we no longer need it or are not required by law to keep it;
  • withdraw a consent you gave (this does not affect what we did before);
  • nominate another person to exercise your rights in case of death or incapacity; and
  • resolve a grievance about how we handled your data.

If you are a buyer and your data came from a seller's order, we will pass your request to that seller, who decides on it, and help the seller to answer it. Sellers can ask us for help with any request they receive from their buyers. To make a request, contact the Grievance Officer below. We may need to verify your identity first, and we aim to respond within 30 days.

12. Children

Courier Tales is a service for businesses. It is not meant for people under 18, and we do not knowingly collect their data.

13. Changes to this policy

We may update this policy. We will post the new version here with its effective date and, for significant changes, tell registered sellers by email or in the dashboard.

14. Grievance Officer and contact

Grievance Officer: Atal Dubey
Email: team@couriertales.com
Courier Tales Shipping Private Limited, 241, Medicaps Business Park, Pithampur, Madhya Pradesh 453441
Phone: +91 70008-94678

If you are not satisfied with our response, you can complain to the Data Protection Board of India.