Privacy Policy

This Privacy Policy explains how ShipStack ("we", "us") handles personal information when you visit our website, create an account, or use the ShipStack service.

Our customers use ShipStack to process their own customers' orders and shipments. For that data ("Customer Data"), the customer is the controller and we act as a processor on their instructions. Recipients with questions about their data should contact the business they ordered from.

• Account information: name, email, password (stored only as a salted hash), organization name, role and preferences.
• Customer Data: orders, recipient names, addresses, phone numbers and emails, products, inventory, shipments and returns that you import or create.
• Integration credentials: API keys and tokens for stores and shipping providers you connect, stored encrypted.
• Billing information: plan, invoices and payment status. Card details are handled by our payment processor.
• Usage and device data: log data such as IP address, browser type, pages visited and actions taken, used for security and product improvement.
• Communications: messages you send through our contact form or support channels, including the details you choose to provide.

• Provide, operate and support the Service, including buying labels and syncing with services you connect.
• Secure the Service: authentication, rate limiting, fraud and abuse prevention, and audit logging.
• Bill for subscriptions and communicate about your account.
• Respond to inquiries and support requests.
• Improve the Service using aggregated or de-identified usage information.
• Comply with legal obligations and enforce our Terms of Service.

Where laws such as the GDPR apply, we process personal information to perform our contract with you, for our legitimate interests in operating and securing the Service, to comply with legal obligations, and with consent where required.

We do not sell personal information. We share it only:

• with service providers (subprocessors) that help us run the Service, under contracts that limit their use of the data;
• with shipping providers, carriers and stores you connect, as needed to perform actions you request (for example, a recipient address is sent to your provider to buy a label);
• when required by law or to protect the rights, safety and security of our users and the Service; and
• in connection with a merger, acquisition or sale of assets, subject to this Policy.

We use subprocessors in the following categories. A current list of named subprocessors is available on request.

We protect information with measures including encryption in transit, encryption of stored third-party credentials, database-level tenant isolation, role-based access controls and audit logs. No system is perfectly secure; please use strong, unique passwords and protect your API keys.

• Account and Customer Data are retained while your organization is active.
• After an organization is closed, Customer Data is available for export for 30 days and then deleted from active systems; backups age out on their regular cycle.
• Security logs and audit records are kept for a limited period for security and compliance purposes.
• Billing records are retained as required by tax and accounting law.
• Contact form submissions are retained as long as needed to respond and follow up, then deleted.

We and our subprocessors may process information in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses for those transfers.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can update most account information in your workspace settings.

To exercise a right, email privacy@shipstack.app. If your information is Customer Data held for one of our customers, we will refer your request to that customer. You may also complain to your local data protection authority.

We use strictly necessary cookies to keep you signed in and to secure the Service, and local storage for preferences such as your color theme. We do not use third-party advertising cookies on the Service.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect their information.

We may update this Policy. If changes are material we will notify account owners by email or in the Service before they take effect.

Privacy questions or requests: privacy@shipstack.app, or use our contact form.