Logistics & Shipping
The file exists because a shop gave them your address, and it fills up with doorstep photographs, signatures and notes of where the parcel was left. Address records outlive the deliveries, and read in order they show everywhere you have lived.
The read at a glance
Carriers and customs both keep your address against each parcel.
A leak exposes your address and what you send and receive.
Shipment and customs records are kept for years under trade rules.
Sending or receiving needs a name and address; ID for high-value or customs.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A delivery file says where you live, when somebody was home, and where a parcel goes when nobody is. It names the neighbour who takes them in, who never signed up to anything.
What repeats in the policies
Somebody else opened this file for you
Almost nobody chooses a courier. A shop picks one and hands over your name, address, phone and usually your email. There is no account to close and no relationship to end, and the carrier still holds a copy of its own.
A photograph of your door, kept as evidence
Doorstep photographs, signatures and a note of where a parcel was left are kept as proof for a dispute that will probably never happen. That makes an image of your home and who answered a commercial record, held for as long as the carrier judges a claim is possible.
An address list is a map of your moves
Delivery records outlive the deliveries. Every address you shipped to or from stays on file, and read in order that is a history of where you have lived and who you send things to. Anything that crossed a border adds customs paperwork with a legal hold of its own, naming you, the contents and the value.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Where you go Likely
Delivery addresses map where you and your contacts are.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Customs and shipping declarations Law sets it about 4 to 7 years
Customs law makes them keep the declarations naming who sent a shipment and who received it.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
An address confirmed by a delivered parcel is worth more than one typed into a form, which is why postal and delivery operators sell address validation and change-of-address products. Your moves are the part with commercial value, not your parcels.
Sold or shared Possible
Address and shipment data is shared across partners.
AI training Low
There is limited training use for this kind of personal data.
Even anonymised, this can still be you
A shipment carries sender and recipient by name and address, which single people out on their own.
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Location traces Typical
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“we handle your information on behalf of the retailer who arranged your delivery”
The carrier presents itself as acting for the shop, which lets it point you back there. It still chose what to collect at the door, what to photograph and how long to keep it, and it answers for that.
The move The shop and the carrier each hold a copy, and the same request works on both.
“we retain proof of delivery, including photographs and signatures, to resolve disputes”
An image of your property and a record of who answered the door, kept against the possibility of a claim. The picture is of a place rather than an account, so nothing you close removes it.
The move An access request covers the images, signatures and delivery notes held against your address.
“left in a safe place or with a neighbour”
Your standing instructions become a record of your habits, and the neighbour who signs for a parcel is written into a file about your delivery. They agreed to nothing and are not told.
The move Who accepted a parcel is part of the delivery record, and an access request reaches it.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.