Privacy policy

Parcel is run by Westward Consulting ("we", "us"). This policy covers our website, the Parcel app, our API and our assistant connectors (the MCP server used from ChatGPT, Claude and similar tools).

Our customers are real estate agents, investors and their teams. They use Parcel to find properties from public records and to contact owners. For data about the people they contact, the customer decides who is contacted and how, and we process that data for them as a service provider. Section 7 explains what that means if you are a property owner.

Your account

• Your email address, your workspace name and the email addresses of people you add to it.
• Short-lived sign-in codes (they expire after 10 minutes) and a signed session cookie. We have no passwords to store.
• Your plan, usage counts and settings. If you pay, Stripe handles your card; we keep the Stripe customer and subscription ids and invoices.

What you put into the AI tools

• The text, documents and images you give an AI tool are sent to Anthropic's API (the Claude model) to produce your result. They are not used to train models.
• For one-off tool runs we keep a usage record (which tool, when, how much text, what it cost), not your text. Work you save in a product, such as a prospect note, a draft email or a deal analysis, is stored in your workspace.

Public-record property data (Deal Radar)

• Deal Radar downloads records that cities and counties publish on their open-data portals: property addresses, parcel numbers, case and record details, dates and, where the government publishes them, owner names and mailing addresses.
• Lists you upload (for example from a list vendor or a court clerk) are stored in your workspace and scored the same way.

Owner contact lookups

• When a customer looks up an owner's contact details, we send the owner's name and property address to our lookup provider and store the phone numbers and emails it returns, with any Do Not Call or litigation flags. Phone numbers are never sent to an AI model.

Email Outreach

• The mailbox settings you connect, with the mailbox password or app password encrypted at rest.
• The messages sent, their status, unsubscribes and the do-not-email list.
• When reply reading is on, replies to your outreach in that mailbox, so a reply can stop a sequence and an opt-out is honored. Reply text may be sent to Anthropic to sort it (interested, not now, stop, and so on).

Seller pages, buyer pages and consent records

• What a person types into a customer's seller or buyer page: name, phone, email, property address, timeline, condition, their message and buying criteria.
• If they check a consent box, a consent record: the exact words shown, their version, the time, the page address, the button they pressed, their IP address and browser user agent. Consent records and revocations are written to an append-only log so they can't be edited later.

AI Caller calls

• For workspaces that use AI Caller: phone numbers, call times and length, the call recording, the transcript, a summary and the answers the caller gave (for example timeline and condition), plus any appointment booked. Every call says it is recorded and that the caller is an AI assistant.
• Requests to stop calls (saying "stop calling" or pressing 9, or asking any other way) go on a do-not-call list.

Calendar and booking

• Appointments and the names and contact details of the people booked. If an agent links a private calendar address to block busy times, we store that address encrypted and read only the start and end times of events.

Requests on our website

• Coverage and early-access requests: your email, the county or product, and your note.
• If you give us your email on our site (for example to see your market or start a trial): your email, the name, role, state and city you typed, and whether you agreed to marketing email, with the exact words shown and the time. If you tick that box, we also keep your browser's time zone, so our emails reach you at a sensible local hour.
• Emails you send us.

Assistants and the MCP server

• When you use Parcel's public tools from ChatGPT, Claude or another assistant, we receive the tool's inputs: the market searched, the numbers for a calculation, or the state and channel for a rules check. ChatGPT also sends an anonymized requester id, which we use only to rate-limit.
• We log the tool name, timing and errors. We don't keep raw inputs beyond the market searched, and the public tools never return owner names or contact details.

Website visits and cookies

• Our servers log each request: IP address, browser user agent, the page and the referring page, including any campaign tags in the address.
• "Use my location" asks your browser for your position only when you tap it. It is rounded to about 100 meters and sent to our server and the US Census geocoder to find your ZIP and city. We keep the ZIP or city you searched, never the position.
• /near-me guesses your city from your IP address, looked up on our own server in a database we keep (nothing is sent to anyone and the lookup isn't stored), to show that city's page. IP Geolocation by DB-IP, licensed under CC BY 4.0.
• Cookies: pcl_session keeps you signed in (14 days); pcl_ref remembers an affiliate link you followed (60 days); pcl_oppref remembers the click id of a ChatGPT ad you clicked (30 days). Your browser may also keep small display preferences locally.
• Our own analytics. On our public pages (not inside the app) a small script of ours records how the site is used: pages viewed and where you came from (the referring site and campaign tags), which parts of a page were on screen and for how long, which buttons you saw, how far you scrolled, where you clicked (position and the text of what you clicked, never what you type into fields), switches like the billing period, forms started and sent, which form field you were in and whether it was filled (never its contents), script errors and how fast the page loaded, your screen size and device type, time on the page (and how much of it the tab was in front and in use), switching to another tab and back, scrolling back up, how long the pointer rests on a plan, whether you copied or selected text (how much, never the text itself), how you left (closed the tab, went back, followed a link) and which version of a page you saw when we test changes. It is tied to a random id in the pc_vid cookie (1 year), and to your email only if you give it to us or open a link from an email we sent you; once you have an account, it is joined to your account's sign-up, checkout and trial steps. Inside the app we count which features each workspace uses and which locked features someone opens, and we record which sections of the app you open and when, tied to your account (never what you type, and not if you opt out or your browser sends Do Not Track or Global Privacy Control), to improve the product and see who keeps using it. When something on a public page seems not to work for you (you click something that does nothing, click it again and again, or leave a form half filled), we keep a short replay of that moment: a copy of the page as it looked, with anything typed into fields replaced by dots, and where the pointer moved, scrolled and clicked in the seconds before. We never record keystrokes, and replays are deleted after 30 days. We never store your full IP address with any of it: we keep a shortened form (the last two of its four parts removed, like 73.162.x.x), the approximate area it comes from (city and state, looked up on our own servers), and your browser and operating system, so we can tell different visitors from one person coming back. Our own staff's visits while signed in, and known bots, aren't counted: we keep only a short note of them (for staff, the email they signed in with), deleted after 90 days. We don't fingerprint your browser. It is sent only to our own servers; no third party receives it. Turn it off at any time: turn off analytics for this browser (this sets a pc_optout cookie for 5 years and deletes the id; turn it back on). We also skip it entirely when your browser sends Do Not Track or Global Privacy Control.
• The quiz. If you take the quiz at /quiz, your answers (your role, city, biggest problem, what you use and spend, and how soon you want deals) stay in a pc_quiz cookie for 30 days so your result survives a reload. When you sign up or give your email, we save them with your account and use them to set up your plan and to shape the emails we send you. We also count how many people answer each question.
• We don't run third-party analytics or advertising scripts on our pages.

Emails about Parcel

• We may email real estate investors and agents about Parcel, using business contact details and property facts from public records. Every email names us, gives our postal address and has a one-click unsubscribe that takes effect at once. Links in those emails carry a signed code so we can tell the email was opened on our site.

Ad measurement

• If you reach us by clicking an ad in ChatGPT, OpenAI adds a click id to the link. If you then sign up, subscribe or send a request, we may tell OpenAI which of those happened, with that click id and a one-way (SHA-256) hash of your email, so we can tell whether the ad worked. We send no names, property data or message content.
• We don't do this if your browser sends Global Privacy Control, and you can ask us to stop at any time (section 6).

• To run the service: sign you in, run your tools, pull and score records, send the emails you set up, place and answer the calls you set up, and book appointments.
• To enforce safety rules: sending caps, opt-outs, do-not-call and do-not-email lists, consent checks and calling hours.
• To bill you, answer support requests and tell you about changes to the service.
• To keep the service secure: rate limits, abuse prevention and debugging.
• To measure our own ads, as described above.
• To improve our website and tell people about Parcel: first-party analytics, testing versions of our pages and emails, and emailing people who asked for it or whose public business records suggest Parcel could help them (with an unsubscribe in every email).
• We don't sell personal information, and we don't use your content or the people in your workspace to market to anyone else.

Only the service providers we need, for the purpose listed:

• Google Cloud: hosting and storage (United States).
• Anthropic: the AI model behind the tools, reply sorting and the AI Caller's conversation.
• Stripe: payments.
• Our email delivery provider: sign-in codes, booking confirmations and notices.
• Your own mailbox provider (for example Google Workspace or Microsoft 365): outreach is sent from, and replies read in, the mailbox you connect.
• Vapi, Twilio, ElevenLabs and Deepgram: AI Caller's call handling, phone numbers, voice and transcription, only for workspaces that use AI Caller.
• Tracerfy: owner contact lookups, only when a customer runs one.
• OpenAI: ad measurement, only for visitors who clicked a ChatGPT ad (section 2).
• Government open-data portals: we only download from them and send them no personal information.

We also disclose information when the law requires it, to protect people from harm, or to a buyer of our business, who would be bound by this policy. People in a workspace can see that workspace's data.

• Account and workspace data: while the account is open. When you ask us to delete it, we delete it within 30 days, apart from the records below. Copies may stay in backups for a short time after that.
• Consent records, opt-outs and do-not-call and do-not-email lists: at least 5 years after the last call or message that relied on them, as telemarketing rules require. Opt-outs are kept so the person is never contacted again.
• Call records (times, numbers, transcripts, summaries): at least 5 years after the call. Recording files are held by our call provider under its retention settings.
• Owner contact lookup results: reused for up to 90 days, then looked up again if needed; the record that a lookup happened is kept 5 years.
• Billing records: as long as tax law requires.
• Server logs: about 30 days.
• Website analytics (our own, described in section 2): about 13 months.
• Replays of moments a page didn't work for a visitor (section 2): 30 days.
• Coverage and early-access requests: until we have answered them, and at most 2 years.

• Ask for a copy of your data, a correction, or deletion.
• Stop our emails with the unsubscribe link, and stop calls by saying "stop calling" or pressing 9.
• Turn off our website analytics with the opt-out link, or by turning on Do Not Track or Global Privacy Control.
• Opt out of ad measurement (which California law may treat as "sharing") by turning on Global Privacy Control in your browser or by emailing us.

Email privacy@westwardconsulting.ai from the address on your account. We answer within 45 days. Depending on where you live (for example California, Colorado, Connecticut, Virginia or Texas) you may have more rights; we honor them the same way for everyone. If we turn down a request, reply to our answer to appeal and someone else will review it. We never charge you or treat you differently for using these rights.

If a business contacted you about your property through Parcel, that business found your property in public records or a list it uploaded, and chose to contact you. We don't contact owners ourselves, and the public tools on our website and in AI assistants never show owner names or contact details.

• To stop emails, use the unsubscribe link in the message. To stop calls, say "stop calling" or press 9 during the call.
• Or email privacy@westwardconsulting.ai with the business name and how they reached you. We'll make sure that business stops contacting you through Parcel, and, if you ask, block you across every Parcel workspace.
• Opt-outs take effect immediately and are kept for at least 5 years.

The extension connects your Gmail to Parcel; you manage everything in Parcel. It sends the emails you approve from your own Gmail and tells Parcel which were sent, answered or bounced. It reads the rest of your mail only if you press Read my Gmail and agree.

• Emails you approve in Parcel go out from your own Gmail while it's open, as drafts unless you choose to send them.
• To show who answered and what bounced, the extension reports only inbox emails from people you emailed through Parcel, and Gmail's delivery-failure notices about them. We keep only that it was answered or bounced, and when.
• When you press Read my Gmail, the extension reads the sender, subject, date and Gmail's short preview of your email history, inbox and sent, up to 5,000 conversations, and the full text of up to 15 emails you sent. It reads only your own mailbox. They go to Parcel and to Anthropic's AI, which picks out your real estate conversations and learns how you write. We keep only what it found: each contact, a one-line summary, the stage, the area and the date, plus templates and notes on how you write. Everything else is dropped as soon as it's read, including personal mail and the text of your emails. It sends nothing. You can delete it any time, and it's deleted if you disconnect.
• On your device, the extension stores only your Parcel connection key, which workspace it connects to, and whether it's working.
• We don't sell this data or use it for anything else, including ads or training AI models.
• Disconnect any time, revoke the key under API keys in your workspace, and email privacy@westwardconsulting.ai to have the extension's data deleted.

Data is encrypted in transit, mailbox passwords and private calendar addresses are encrypted at rest, sign-in uses one-time codes instead of passwords, and API keys are shown once and stored hashed. No system is perfectly secure; if you find a weakness, please tell us at privacy@westwardconsulting.ai.

Parcel is a business tool for adults. It is not meant for anyone under 18, and we don't knowingly collect children's data.

When this policy changes, we update the date at the top, and we email account owners about significant changes before they take effect. Questions: privacy@westwardconsulting.ai, or see Support.