Privacy Policy
Last updated: 2026-11-07
This policy explains what personal data the RCourier tracking API handles and why. It covers API customers, their end users where tracking is shown to them, and the operators of the Service.
Who we are
RCourier is operated from India. Contact: rcourier@thermh.in.
What we collect
- API requests: the courier, the waybill number, the time, the result, and the network address of the caller. Request logs record the path and result, never your API key or the query string.
- Tracking results: shipment status, location text and times returned by the courier. The Service does not store or collect consignee or sender names, addresses, phone numbers or email addresses.
- Customer account data: the customer's name, plan and limits, a hashed API key (we cannot read your key after it is created), usage counts, and for connected online stores the store domain and plugin version.
- Operator data: the email address, hashed password and login records of administrators.
- The API sets no cookies and uses no advertising or analytics trackers.
Why we use it
To answer your requests, keep tracking up to date, enforce limits and quotas, bill correctly, secure the Service, find faults and provide support. We do not use it for advertising and we do not sell it.
Where tracking data comes from
From courier systems, retrieved through third-party tracking data providers on our behalf. When you ask about a waybill we send that waybill number and courier name to those providers.
How long we keep it
- Tracking events: until 90 days after a shipment is delivered, returned or cancelled. Shipments still in transit are refreshed for up to 30 days.
- Lookup logs: 90 days. Login records: 30 days.
- Database backups: 14 days.
- Customer account data: while the account is active and for a short period after, as needed for billing and law.
Who we share it with
We do not sell personal data. We use service providers to run the Service: server hosting (servers in Germany), email delivery for operator alerts, and the tracking data providers described above. They process data only for those purposes. We may disclose data if the law requires it.
Security
Traffic uses HTTPS. API keys and passwords are stored only as hashes, the admin area requires two-factor sign-in, access is limited to operators, secrets are kept out of logs, and the database is backed up daily. No system is perfectly secure, and we will tell affected customers promptly if a breach affects them.
Your choices
You can ask us to access, correct or delete personal data we hold about you, or to delete the tracking data for a waybill number, by emailing rcourier@thermh.in. We will respond within a reasonable time. If you are a shop owner, you are responsible for telling your own customers how you use tracking information.
Children
The Service is for businesses and is not directed at children.
Changes
We will update this policy as the Service changes. The date above shows the latest version.
Contact
Email rcourier@thermh.in.
Questions about this page: rcourier@thermh.in. See also Terms of Service and Privacy Policy.