Privacy policy
SHIPAID Privacy Policy
Last Updated: September 11, 2026
This Privacy Policy explains how ShipAid, LLC ("SHIPAID," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information in connection with our websites, applications, customer and recipient portals, communications, integrations, and related products and services (collectively, the "Services").
1. Scope and Our Role
This Privacy Policy applies when SHIPAID determines why and how personal information is processed, including information about website visitors, merchant-account users, business contacts, prospects, suppliers, and people who communicate directly with us. In those situations, SHIPAID is the controller or business under applicable privacy law.
SHIPAID also processes information on behalf of merchants that use our Services, including information about their customers, orders, shipments, returns, and delivery issues. For that processing, the merchant generally determines the purposes and legal basis, and SHIPAID acts as a processor or service provider under the merchant's instructions, our agreement, and our Data Processing Addendum. If you are a merchant's customer, you may wish to contact that merchant first about its privacy practices or a request concerning your information.
This Privacy Policy does not apply to a third party's independent processing. Third-party websites, ecommerce platforms, carriers, payment providers, and other services are governed by their own notices.
2. Personal Information We Collect
Depending on how you interact with the Services, we may collect:
- Contact and account information: name, business name, job title, postal or billing address, email address, telephone number, username, authentication information, account preferences, and authorized-user details.
- Transaction and service information: merchant, customer, order, cart, product, shipment, tracking, delivery, claim or issue-reporting, return, refund, fulfillment, postage, and billing information needed to provide the Services.
- Payment and financial information: billing contact, payment status, transaction identifiers, and limited payment details. Payment providers generally process full payment-card or bank information on our behalf; we do not intentionally retain full card numbers unless expressly stated at collection.
- Communications and support information: messages, call or chat details, feedback, survey responses, support records, and troubleshooting information.
- Device and usage information: IP address, browser and device type, operating system, identifiers, referring pages, pages or features used, links selected, timestamps, approximate location derived from IP address, and cookie or similar-technology data.
- Marketing and preference information: newsletter or campaign subscriptions, consent records, communication preferences, campaign engagement, attribution, and suppression or unsubscribe status.
- Security and fraud information: authentication events, audit and system logs, suspected abuse, device or network indicators, and investigation records.
- Integration information: information received from or sent to Shopify, carriers, ecommerce tools, customer-selected applications, and other integrations that you or a merchant enables.
- Optional location information: precise location or motion information only when an optional feature requests it and you authorize collection through your device or browser.
We do not knowingly request special-category or sensitive personal information unless a specific feature, legal obligation, or customer instruction requires it. Please do not submit information that is unnecessary for the requested Service or support issue.
3. Sources of Personal Information
We collect personal information:
- directly from you when you create an account, request a demo, use a Service, submit a form, report a delivery issue or return, contact support, subscribe, or communicate with us;
- from merchants and their authorized users when they use our Services;
- from ecommerce platforms, carriers, payment providers, integrations, and other services that you or a merchant connects;
- automatically through the Services, cookies, pixels, logs, and similar technologies, subject to applicable consent requirements; and
- from service providers, partners, public business sources, and commercially available sources used to verify or update business contact information.
4. Purposes and GDPR Article 6 Legal Bases
Where the European Union or United Kingdom General Data Protection Regulation applies, we use personal information only for the purposes and legal bases below. We rely on contract only when processing is objectively necessary to enter into or perform a contract with the individual; legal obligation only when a specific applicable duty requires processing; legitimate interests only after considering the individual's rights and reasonable expectations; and consent for optional marketing, non-essential cookies, and similar tracking. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
| Purpose | Personal information typically involved | GDPR legal basis |
|---|---|---|
| Create and administer a merchant account; authenticate users; maintain settings | Contact, account, authentication, preference, and security information | Contract, Article 6(1)(b), when the individual is party to the contract; otherwise our legitimate interest in administering authorized business users, Article 6(1)(f) |
| Provide requested Services, transactions, portals, shipping or return functions, billing, and user-enabled integrations | Account, transaction, service, integration, communications, and limited payment information | Contract, Article 6(1)(b). When we process a merchant's customer data only on instructions, the merchant determines the basis and we act as processor |
| Respond to demo requests, sales inquiries, and pre-contract questions | Contact, business, communications, and preference information | Steps requested before a contract, Article 6(1)(b), or legitimate interests in administering a B2B inquiry, Article 6(1)(f) |
| Provide customer service, troubleshoot, retain support transcripts, and improve support quality | Contact, account, service, device, and communications information | Contract, Article 6(1)(b), and legitimate interests in reliable support, training, and dispute records, Article 6(1)(f) |
| Send transactional, security, and mandatory service communications | Contact, account, service, transaction, and security information | Contract, Article 6(1)(b); legal obligation, Article 6(1)(c); and legitimate interests in security and service administration, Article 6(1)(f) |
| Protect accounts and Services; prevent fraud, abuse, and credit risk; monitor logs; respond to incidents | Account, transaction, device, usage, security, fraud, and communications information | Legitimate interests in protecting SHIPAID, customers, users, and the public, Article 6(1)(f); legal obligation when a specific law applies, Article 6(1)(c) |
| Enforce agreements, resolve disputes, protect rights, and establish or defend legal claims | Account, transaction, service, communications, and security information | Legitimate interests in protecting legal rights, Article 6(1)(f), or legal obligation, Article 6(1)(c) |
| Meet tax, accounting, regulatory, reporting, and binding legal-request duties | Contact, account, transaction, payment, communications, and service information | Legal obligation, Article 6(1)(c) |
| Maintain, analyze, improve, and develop the Services using essential operational analytics and voluntary feedback | Device, usage, service, transaction, communications, and de-identified or aggregated information | Legitimate interests in operating and improving the Services, Article 6(1)(f). Consent, Article 6(1)(a), applies to non-essential cookies or similar tracking where required |
| Send newsletters and promotional email or SMS; operate Klaviyo marketing automation, campaign segmentation, personalization, attribution, and non-essential onsite engagement | Contact, marketing preference, consent, device, usage, transaction, and campaign-engagement information, depending on configuration | Consent, Article 6(1)(a), where required. A narrow existing-customer or B2B exception may rely on legitimate interests, Article 6(1)(f), only where electronic-marketing law permits it |
| Operate interest-based advertising, RB2B or Retention.com tracking, and cross-site or input association | Contact, cookie, device, usage, marketing, and attribution information | Consent, Article 6(1)(a), where required for non-essential tracking or advertising technologies |
| Provide optional location-based features | Location, device, account, and requested-service information | Consent, Article 6(1)(a), or contract, Article 6(1)(b), only when strictly necessary for a feature you request |
| Share information within our corporate group or evaluate a financing, acquisition, reorganization, or sale | Relevant account, business, transaction, service, and due-diligence information | Legitimate interests in internal administration and corporate transactions, Article 6(1)(f), or legal obligation, Article 6(1)(c) |
| Record consent, withdrawal, unsubscribe, suppression, objections, and privacy requests | Contact, preference, consent, communications, and request-verification information | Legal obligation, Article 6(1)(c), and legitimate interests in demonstrating compliance and honoring choices, Article 6(1)(f) |
Our legitimate interests include operating a secure and reliable service; administering customer and partner relationships; improving support and products; preventing fraud and misuse; protecting rights and evidence; and conducting ordinary B2B operations. You may object to processing based on Article 6(1)(f) as described in Section 11.
5. Klaviyo Marketing and Onsite Engagement
We use Klaviyo, Inc. as a service provider for signup forms, marketing automation, subscriber and consent management, email or SMS communications, campaign personalization and segmentation, onsite engagement, and engagement or attribution measurement.
Depending on how you interact with us, the options enabled in our Shopify and Klaviyo integration, and your consent choices, Shopify and Klaviyo may process:
- name, email address, phone number, postal or locale information;
- subscription, consent, preference, unsubscribe, and suppression status;
- cookie or device identifiers and approximate location;
- browsing, search, product, cart, checkout, and onsite engagement activity;
- customer, order, fulfillment, refund, return, or related transaction events; and
- message delivery, open, selection, conversion, and campaign-attribution information.
Not every field is collected from every person, and configured data may vary by feature and consent choice. We rely on consent under Article 6(1)(a) for promotional communications and non-essential marketing or analytics tracking where required. We use Article 6(1)(b) only for strictly transactional communications necessary to provide a Service you request.
You may withdraw marketing consent by selecting the unsubscribe mechanism in a marketing message and may change non-essential cookie choices through our cookie-preference controls. An unsubscribe applies prospectively; we retain the minimum suppression information needed to honor the choice and demonstrate compliance.
Active Klaviyo marketing profiles and campaign-event data are retained until consent is withdrawn or for 24 months after the last meaningful engagement, whichever comes first. We delete or anonymize that information from active marketing use within 30 days, subject to legal holds and the minimum suppression record. If our Klaviyo agreement ends, Klaviyo states that customer personal data is deleted within 90 days, subject to documented legal exceptions.
Klaviyo currently hosts customer data in the United States. International transfers are protected as described in Section 9.
6. Cookies and Similar Technologies
We and our service providers use cookies, pixels, scripts, local storage, software development kits, and similar technologies to:
- provide requested features, maintain sessions, remember settings, and protect the Services;
- understand performance and usage;
- measure and improve campaigns and communications;
- personalize content; and
- support interest-based advertising and business-visitor identification where permitted.
Where law requires consent, non-essential analytics, marketing, advertising, Klaviyo onsite, RB2B, Retention.com, and similar technologies are used only after the required choice. You can manage choices through our cookie-preference controls and browser settings. Blocking essential technologies may prevent parts of the Services from functioning.
Our cookie notice or preference center identifies individual technologies and their actual duration. Non-essential cookie or device identifiers are not retained beyond 13 months unless the preference center states a shorter verified duration or renewed consent lawfully permits a new period.
7. How We Disclose Personal Information
We may disclose personal information to:
- service providers and subprocessors that provide cloud hosting, ecommerce and Shopify functionality, shipping or carrier services, returns and fulfillment, payment processing, authentication, customer support, communications, Klaviyo marketing automation, analytics, advertising, fraud prevention, security, professional services, and data management;
- merchants and their authorized users when needed to provide the merchant's requested Services or respond to its customer's request;
- customer-selected integrations and partners when a user or merchant enables the connection;
- corporate affiliates for administration, security, support, and the purposes in this Privacy Policy;
- professional advisers, auditors, insurers, and financing parties under appropriate confidentiality obligations;
- courts, regulators, law enforcement, and public authorities when a binding request or applicable law requires disclosure, or when disclosure is permitted and necessary to protect rights, safety, security, or the Services; and
- transaction parties in connection with a proposed or completed merger, financing, reorganization, acquisition, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.
Service providers may process personal information only for the contracted service and under applicable confidentiality, security, and data-protection obligations. We do not sell personal information for money. Some advertising or cross-context disclosures may be considered a "sale," "sharing," or targeted advertising under certain U.S. state laws; Section 12 explains the available opt-out rights.
We may use and disclose aggregate or anonymous information that cannot reasonably identify an individual. We do not attempt to reidentify anonymous information.
8. Retention Schedule
We assign retention by data category and purpose rather than using an indefinite "as long as necessary" standard. At the end of a period below, we delete or irreversibly anonymize information unless a documented legal hold, binding customer instruction, or specific legal requirement applies. We review retained data at least annually.
| Category | Retention period or criterion |
|---|---|
| Merchant account and core Service data for which SHIPAID is controller | For the active account term; delete or anonymize active copies within 90 days after account closure, except for records listed below |
| Merchant customer data processed on instructions | For the term and purpose set by the merchant agreement and Data Processing Addendum; return or delete after termination or instruction, subject to legal exceptions and backup rotation |
| Contracts, invoices, payment, tax, accounting, and transaction records | 7 years after the transaction or contract ends, or longer only when a specific law or legal hold requires it |
| Demo requests, sales leads, and general business inquiries | 24 months after the last substantive interaction |
| Support tickets, chats, and troubleshooting records | 3 years after closure |
| Klaviyo marketing profiles and campaign-event data | Until withdrawal or unsubscribe, or 24 months after last meaningful engagement; delete or anonymize from active marketing use within 30 days |
| Unsubscribe and suppression records | The minimum identifier or hash for as long as needed to honor the opt-out and demonstrate compliance; reviewed annually |
| Consent records | 6 years after withdrawal or last reliance |
| Cookie, device, and onsite analytics identifiers | The duration shown in the cookie preference center and no more than 13 months for non-essential identifiers without a lawfully renewed basis |
| Security and access logs | 12 months, unless escalated into an investigation or a longer period is contractually required |
| Confirmed security-incident records | 7 years after incident closure |
| Fraud, abuse, and chargeback records | 5 years after the relevant transaction or most recent incident |
| Privacy and data-subject request records | 3 years after request closure |
| Backup copies | Isolated from ordinary use and overwritten within 90 days through the backup-rotation cycle; deletion restrictions are reapplied if a backup is restored |
| Legal holds, investigations, and disputes | Until the hold is released or the claim and appeal periods expire, then deletion under the normal schedule |
Service providers are instructed to delete or return corresponding information when their services end or when we direct deletion, subject to documented legal exceptions.
9. International Data Transfers
SHIPAID is located in the United States, and we and our service providers may process information in the United States and other countries that may not provide the same level of data protection as your home jurisdiction.
Where required for transfers from the European Economic Area, United Kingdom, or Switzerland, we use an applicable adequacy decision, the EU-U.S. Data Privacy Framework or corresponding extension when valid and applicable to the recipient, Standard Contractual Clauses, the United Kingdom Addendum or International Data Transfer Agreement, or another lawful safeguard. You may contact us for information about the relevant safeguard.
10. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. Measures include access controls, encryption in transit and at rest where appropriate, security logging, incident response, vulnerability management, workforce obligations, vendor controls, and business continuity and backup safeguards. No transmission, storage system, or security program can guarantee absolute security.
11. European and United Kingdom Privacy Rights
Subject to applicable conditions and exceptions, you may have the right to:
- request access to and a copy of personal information;
- correct inaccurate or incomplete information;
- request deletion;
- restrict processing;
- receive information you provided in a portable format and transmit it to another controller;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent at any time;
- request meaningful information about applicable automated decision-making; and
- complain to your local data-protection supervisory authority.
You may exercise a right by contacting us under Section 15. We may request information reasonably necessary to verify identity and authority. If SHIPAID processes the information solely for a merchant, we may direct the request to that merchant and assist it as required by our agreement.
12. U.S. State Privacy Rights
Residents of California and other states with applicable comprehensive privacy laws may have rights to know or access categories and specific pieces of personal information; correct inaccuracies; delete information; receive a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; and receive nondiscriminatory service for exercising a right.
We do not sell personal information for monetary compensation. Our use of advertising, business-identification, or cross-context technologies may constitute "selling," "sharing," or targeted advertising under some laws. You may opt out through our cookie-preference controls or by contacting us. We will process a legally recognized browser-based opt-out preference signal where required and technically recognized by our Services.
To submit a request, use the contact methods in Section 15. We will verify the request as required by law. An authorized agent may submit a request when it provides proof of authority and we can verify the request. If we deny a request, residents of states providing an appeal right may appeal by replying to the decision or contacting us with "Privacy Appeal" in the subject line.
13. Communications Choices
You may unsubscribe from promotional email by using the unsubscribe mechanism in the message. Where offered, you may manage topic or channel preferences. You may opt out of promotional SMS by following the instructions in the message. We may continue to send non-promotional communications required to provide, secure, administer, or complete a requested Service.
14. Children's Privacy
The Services are intended for businesses and adults and are not directed to children under 16. We do not knowingly collect personal information directly from a child under 16 without legally valid authorization. If you believe a child provided personal information contrary to this section, contact us so we can investigate and delete it where required.
15. Contact Us
Questions, complaints, objections, and privacy-rights requests may be sent to:
ShipAid, LLC
Attn: Privacy
8 The Green, Suite 6085
Dover, DE 19901
United States
Email: support@shipaid.com
Phone: (844) 939-1359
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in law, technology, vendors, integrations, or our Services. We will post the updated version and revise the "Last Updated" date. When required, we will provide additional notice or obtain consent before a materially different use. Continued use does not replace consent where applicable law requires an affirmative choice.