Privacy Policy
Version 2.3 · last updated 2 October 2026
The short version
If we're delivering a parcel to you, we got your details from the shop you ordered from, not from you. We use them to deliver your parcel, keep you updated on when it's arriving, and show that it arrived. We keep delivery records for six years, mainly for tax and in case of disputes. We don't sell your information or use it for advertising. You can ask us what we hold about you, ask us to correct or delete it, or object to us using it. Just email matt@quiver.co.uk.1. Who we are
Quiver is run by Quiver Solutions Limited (company number 16961611), registered at 27 Old Gloucester Street, London, England, WC1N 3AX. We're the controller of the information described in this notice, and we're registered with the Information Commissioner's Office under number ZC243618.
This notice is for two groups of people: the people we deliver to, and the people we work with at the merchants we deliver for. Most of it applies to both. Section 12 explains what's different for merchants, and section 13 covers connecting Quiver to an AI assistant. Couriers who work through the Quiver app have their own notice at quiver.co.uk/courier-privacy-policy.2. Information we collect
If we're delivering to you: your name, delivery address, email address and phone number; what you ordered, as the merchant described it to us; any delivery instructions; when the delivery happened and how it went; messages and calls between you and the courier; and, if one is taken, a photo of the parcel where it was left or a signature.
If you work for a merchant: your name, work email and phone number, your role, the addresses we collect from and deliver to, and records of what was booked, delivered and invoiced.
We don't ask for sensitive information (what the law calls special category data), such as details of your health, ethnicity or beliefs. Please don't include any in delivery instructions.3. Where your information comes from
If we're delivering to you, your information comes from the merchant you ordered from, not from you. They share it with us so we can make the delivery. We and the courier then add some details as the delivery happens: the time, the outcome, any photo or signature, and anything you tell the courier or tell us through the tracking page.
If you work for a merchant, your information usually comes from you or a colleague when the account is set up. Some merchant contact details came to us from Quiver Delivery Ltd, the company that ran this business before us. It went into liquidation in April 2026.4. How we use your information
We use it to plan routes and get parcels to the right place, keep you updated and let you track your delivery, let you and the courier contact each other, record that the delivery happened and sort out any disagreement about it, invoice the merchant, answer questions and complaints, keep the service secure and running, and meet our legal obligations, including tax.
We don't sell your information, we don't share it with anyone for their marketing, and we don't use it to profile you or make automated decisions about you.5. Photographs and signatures
Couriers record proof that each delivery was made, usually a photo of the parcel where it was left and sometimes a signature. A photo taken at your door is information about you, so we treat it that way.
We only use it to show the delivery happened and to resolve any dispute about it, and we keep it with the delivery record. If a photo has captured something it shouldn't have, let us know and we'll remove it.6. Calls and messages
When a courier needs to contact you, the call or message goes through a number-masking service, so the courier doesn't see your number and you don't see theirs. That service is Twilio, which receives both numbers and a record of the call or message.7. Our lawful bases
When we deliver to you, our lawful basis is legitimate interests: ours and the merchant's in getting your order to you, and yours in receiving it. We don't rely on consent, because your details came to us from the merchant, and we couldn't stop a parcel that's already on its way if you withdrew it. You do have the right to object, which is explained in section 11.
For merchant accounts, our basis is performance of a contract with the merchant, plus legitimate interests in running and improving the service. Where tax and accounting law requires us to keep records, our basis is legal obligation.
An earlier version of this notice said we relied on consent. That was incorrect, and we fixed it on 15 September 2026.8. Who receives your information
The courier making the delivery handles your information, and so does the merchant, who is a separate controller of the information they hold about their own customers. Apart from that, we only share it with suppliers who process it for us, on our instructions, and can't use it for their own purposes:
Amazon Web Services hosts our systems. Doorstep AI tells the courier when they've arrived at the delivery point, and to do that it receives the delivery address. Twilio handles the calls and messages described in section 6. Sentry and PostHog tell us when something breaks and how the service is used. When we're very busy we may also use another delivery company, which receives what it needs to complete the delivery.
We'll also share information if the law requires it, or to protect someone's safety.9. Where information is processed
Our systems and delivery records are hosted in the United Kingdom, in Amazon Web Services' London region. Our error reporting is processed in Germany and our product analytics in the European Union, both covered by the United Kingdom's adequacy regulations.
Some of our suppliers are based in the United States and may process information there. When that happens, we rely on the safeguards United Kingdom law provides for those transfers.10. How long we keep information
We keep delivery records (what was delivered, where, when, by whom, and proof that it arrived) for six years from the date of the delivery. That's generally how long someone has to bring a claim, and it's how far back our tax and accounting records have to go. After that, we delete the record or remove anything that identifies you.
We keep merchant account information while the account is open, then for six years for the same reasons.
If you ask us to delete your information, we will, unless we need to keep it for one of these reasons. If so, we'll tell you.11. Your rights
You can ask for a copy of the information we hold about you, ask us to correct anything that's wrong or complete anything that's missing, ask us to delete it, ask us to restrict how we use it while an issue is being resolved, and ask for it in a portable format.
Because we rely on legitimate interests, you can also object to us using your information at all. If you do, we have to stop unless we have compelling reasons that override your objection. In practice, if your parcel is already on its way, we'll complete that delivery, explain why, and tell you what we've done about everything else.
There's no charge for any of this, and we'll reply within one month. Email matt@quiver.co.uk or write to us at 27 Old Gloucester Street, London, England, WC1N 3AX.12. If you work for a merchant
Everything above applies, with two differences. Our basis is usually the contract with your employer rather than legitimate interests, and we'll contact you about the account, deliveries and invoices as part of running it.
We don't currently send marketing to merchant contacts. If that changes, we'll tell you, give you a way to opt out in every message, and respect your choice.
Email matt@quiver.co.uk and a real person will read it. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, https://www.ico.org.uk. We'd appreciate the chance to put things right first, but you don't have to come to us before going to the ICO.15. Changes to this notice
This is version 2.3, last updated 2 October 2026. Version 2.1 added section 13 about connecting Quiver to an AI assistant. Version 2.2 corrected what section 13 says about the assistant's own sign-in and cutting off its access. Version 2.3 rewrote the notice in plainer English without changing what it says. Version 2.0, from 15 September 2026, replaced an unversioned notice dated 10 February 2026. We keep a dated copy of every version, so if you need to know what this notice said at a particular time, just ask.
If we're delivering a parcel to you, we got your details from the shop you ordered from, not from you. We use them to deliver your parcel, keep you updated on when it's arriving, and show that it arrived. We keep delivery records for six years, mainly for tax and in case of disputes. We don't sell your information or use it for advertising. You can ask us what we hold about you, ask us to correct or delete it, or object to us using it. Just email matt@quiver.co.uk.1. Who we are
Quiver is run by Quiver Solutions Limited (company number 16961611), registered at 27 Old Gloucester Street, London, England, WC1N 3AX. We're the controller of the information described in this notice, and we're registered with the Information Commissioner's Office under number ZC243618.
This notice is for two groups of people: the people we deliver to, and the people we work with at the merchants we deliver for. Most of it applies to both. Section 12 explains what's different for merchants, and section 13 covers connecting Quiver to an AI assistant. Couriers who work through the Quiver app have their own notice at quiver.co.uk/courier-privacy-policy.2. Information we collect
If we're delivering to you: your name, delivery address, email address and phone number; what you ordered, as the merchant described it to us; any delivery instructions; when the delivery happened and how it went; messages and calls between you and the courier; and, if one is taken, a photo of the parcel where it was left or a signature.
If you work for a merchant: your name, work email and phone number, your role, the addresses we collect from and deliver to, and records of what was booked, delivered and invoiced.
We don't ask for sensitive information (what the law calls special category data), such as details of your health, ethnicity or beliefs. Please don't include any in delivery instructions.3. Where your information comes from
If we're delivering to you, your information comes from the merchant you ordered from, not from you. They share it with us so we can make the delivery. We and the courier then add some details as the delivery happens: the time, the outcome, any photo or signature, and anything you tell the courier or tell us through the tracking page.
If you work for a merchant, your information usually comes from you or a colleague when the account is set up. Some merchant contact details came to us from Quiver Delivery Ltd, the company that ran this business before us. It went into liquidation in April 2026.4. How we use your information
We use it to plan routes and get parcels to the right place, keep you updated and let you track your delivery, let you and the courier contact each other, record that the delivery happened and sort out any disagreement about it, invoice the merchant, answer questions and complaints, keep the service secure and running, and meet our legal obligations, including tax.
We don't sell your information, we don't share it with anyone for their marketing, and we don't use it to profile you or make automated decisions about you.5. Photographs and signatures
Couriers record proof that each delivery was made, usually a photo of the parcel where it was left and sometimes a signature. A photo taken at your door is information about you, so we treat it that way.
We only use it to show the delivery happened and to resolve any dispute about it, and we keep it with the delivery record. If a photo has captured something it shouldn't have, let us know and we'll remove it.6. Calls and messages
When a courier needs to contact you, the call or message goes through a number-masking service, so the courier doesn't see your number and you don't see theirs. That service is Twilio, which receives both numbers and a record of the call or message.7. Our lawful bases
When we deliver to you, our lawful basis is legitimate interests: ours and the merchant's in getting your order to you, and yours in receiving it. We don't rely on consent, because your details came to us from the merchant, and we couldn't stop a parcel that's already on its way if you withdrew it. You do have the right to object, which is explained in section 11.
For merchant accounts, our basis is performance of a contract with the merchant, plus legitimate interests in running and improving the service. Where tax and accounting law requires us to keep records, our basis is legal obligation.
An earlier version of this notice said we relied on consent. That was incorrect, and we fixed it on 15 September 2026.8. Who receives your information
The courier making the delivery handles your information, and so does the merchant, who is a separate controller of the information they hold about their own customers. Apart from that, we only share it with suppliers who process it for us, on our instructions, and can't use it for their own purposes:
Amazon Web Services hosts our systems. Doorstep AI tells the courier when they've arrived at the delivery point, and to do that it receives the delivery address. Twilio handles the calls and messages described in section 6. Sentry and PostHog tell us when something breaks and how the service is used. When we're very busy we may also use another delivery company, which receives what it needs to complete the delivery.
We'll also share information if the law requires it, or to protect someone's safety.9. Where information is processed
Our systems and delivery records are hosted in the United Kingdom, in Amazon Web Services' London region. Our error reporting is processed in Germany and our product analytics in the European Union, both covered by the United Kingdom's adequacy regulations.
Some of our suppliers are based in the United States and may process information there. When that happens, we rely on the safeguards United Kingdom law provides for those transfers.10. How long we keep information
We keep delivery records (what was delivered, where, when, by whom, and proof that it arrived) for six years from the date of the delivery. That's generally how long someone has to bring a claim, and it's how far back our tax and accounting records have to go. After that, we delete the record or remove anything that identifies you.
We keep merchant account information while the account is open, then for six years for the same reasons.
If you ask us to delete your information, we will, unless we need to keep it for one of these reasons. If so, we'll tell you.11. Your rights
You can ask for a copy of the information we hold about you, ask us to correct anything that's wrong or complete anything that's missing, ask us to delete it, ask us to restrict how we use it while an issue is being resolved, and ask for it in a portable format.
Because we rely on legitimate interests, you can also object to us using your information at all. If you do, we have to stop unless we have compelling reasons that override your objection. In practice, if your parcel is already on its way, we'll complete that delivery, explain why, and tell you what we've done about everything else.
There's no charge for any of this, and we'll reply within one month. Email matt@quiver.co.uk or write to us at 27 Old Gloucester Street, London, England, WC1N 3AX.12. If you work for a merchant
Everything above applies, with two differences. Our basis is usually the contract with your employer rather than legitimate interests, and we'll contact you about the account, deliveries and invoices as part of running it.
We don't currently send marketing to merchant contacts. If that changes, we'll tell you, give you a way to opt out in every message, and respect your choice.
13. If you connect Quiver to an AI assistant
If you work for a merchant, you can connect your Quiver account to an AI assistant such as Claude, ChatGPT, Codex or Cursor using our connector at mcp.quiver.co.uk. Nothing is connected unless someone at your business sets it up.
When you ask the assistant to do something in Quiver, the connector sends the request to Quiver using your own sign-in or API key and passes the answer back. The connector doesn't keep the content of those requests or answers. Customer names, addresses and order details pass through without being stored, and the connector doesn't store or log your sign-in or key. If you connect by signing in with your Quiver account, the assistant gets its own Quiver sign-in. It lasts up to an hour, and the assistant can renew it for up to 30 days.
For each action the assistant takes, we keep a short usage record: your merchant account, who was signed in (their Quiver sign-in ID and work email address), which AI app was used, what it did, whether it worked and how long it took, the delivery or return number if it booked one, and the time. We use this to show your account admins, in the Quiver dashboard, who connected which app and what it did, and to keep the connector secure and working. Our basis is the contract with your business and our legitimate interest in running the service securely. We keep these records in Amazon Web Services' London region for 400 days, then delete them automatically. PostHog receives the same record without the email address, and Sentry receives technical error reports with the request content removed.
The AI assistant is not one of our suppliers. When you ask it to fetch or act on Quiver information, that information goes to the company that provides the assistant, such as Anthropic or OpenAI, under the terms you or your business agreed with them. They're responsible for what they do with it. We don't use any of this information to train AI models.
You can disconnect the assistant at any time in its settings. Because the assistant has its own sign-in, if you need its access cut off straight away (for example, when someone leaves your business), email matt@quiver.co.uk and we'll end it. It stops working within an hour. To find out what we hold about your use of the connector, or to have it deleted, email matt@quiver.co.uk.
14. Questions and complaintsIf you work for a merchant, you can connect your Quiver account to an AI assistant such as Claude, ChatGPT, Codex or Cursor using our connector at mcp.quiver.co.uk. Nothing is connected unless someone at your business sets it up.
When you ask the assistant to do something in Quiver, the connector sends the request to Quiver using your own sign-in or API key and passes the answer back. The connector doesn't keep the content of those requests or answers. Customer names, addresses and order details pass through without being stored, and the connector doesn't store or log your sign-in or key. If you connect by signing in with your Quiver account, the assistant gets its own Quiver sign-in. It lasts up to an hour, and the assistant can renew it for up to 30 days.
For each action the assistant takes, we keep a short usage record: your merchant account, who was signed in (their Quiver sign-in ID and work email address), which AI app was used, what it did, whether it worked and how long it took, the delivery or return number if it booked one, and the time. We use this to show your account admins, in the Quiver dashboard, who connected which app and what it did, and to keep the connector secure and working. Our basis is the contract with your business and our legitimate interest in running the service securely. We keep these records in Amazon Web Services' London region for 400 days, then delete them automatically. PostHog receives the same record without the email address, and Sentry receives technical error reports with the request content removed.
The AI assistant is not one of our suppliers. When you ask it to fetch or act on Quiver information, that information goes to the company that provides the assistant, such as Anthropic or OpenAI, under the terms you or your business agreed with them. They're responsible for what they do with it. We don't use any of this information to train AI models.
You can disconnect the assistant at any time in its settings. Because the assistant has its own sign-in, if you need its access cut off straight away (for example, when someone leaves your business), email matt@quiver.co.uk and we'll end it. It stops working within an hour. To find out what we hold about your use of the connector, or to have it deleted, email matt@quiver.co.uk.
Email matt@quiver.co.uk and a real person will read it. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, https://www.ico.org.uk. We'd appreciate the chance to put things right first, but you don't have to come to us before going to the ICO.15. Changes to this notice
This is version 2.3, last updated 2 October 2026. Version 2.1 added section 13 about connecting Quiver to an AI assistant. Version 2.2 corrected what section 13 says about the assistant's own sign-in and cutting off its access. Version 2.3 rewrote the notice in plainer English without changing what it says. Version 2.0, from 15 September 2026, replaced an unversioned notice dated 10 February 2026. We keep a dated copy of every version, so if you need to know what this notice said at a particular time, just ask.
