Privacy Policy

1. Scope and roles

This policy applies to information processed through the Services. It does not replace the privacy policies of shipping carriers, payment networks, Apple, or other third parties when they independently determine how to use information.

When applicable under data protection law, ShipWiz acts as the controller or business for information used to operate the Services. Vendors that process information on our instructions generally act as service providers or processors. Some providers, including payment networks, carriers, and fraud-prevention services, may also act as independent controllers for their own legal, security, or operational purposes.

2. Information we collect

Information about other people

Shipping requires information about recipients and other contacts. If you provide another person's information, you are responsible for having authority to provide it and for using it only for legitimate shipping purposes. We use that information to provide the shipment and related support.

Contacts, camera, and biometrics

• Contact import: ShipWiz uses Apple's system contact picker. You choose a single contact to import. ShipWiz does not upload or scan your complete address book. Information you choose is placed into the address form and is handled like other shipping address information if you save or use it.
• Camera: If you use card scanning during checkout, the camera helps Stripe's payment interface read card details. ShipWiz does not retain a photograph of the card.
• Face ID: Face ID can lock access to the app. Authentication is performed by iOS; ShipWiz does not receive or store your biometric template.

3. How information is collected

• From you: when you sign in, create or save an address, describe a package, request rates, purchase a label or insurance, contact support, complete a survey, or otherwise use the Services.
• Automatically: through app, website, analytics, crash-reporting, notification, security, and payment technologies.
• From service providers and carriers: including address corrections, rates, label and transaction status, payment outcome, tracking events, surcharges, insurance status, and claim information.

4. How we use information

• Provide, personalize, maintain, and secure the Services.
• Create accounts, authenticate users, and prevent unauthorized or fraudulent use.
• Verify addresses; calculate rates; create, purchase, format, print, and share labels; provide tracking; process customs and supported hazardous-material declarations; and facilitate insurance or claims.
• Process payments, refunds, adjustments, and carrier surcharges and maintain transaction records.
• Send transactional messages, shipping updates, service notices, and push notifications. You can control push notifications through iOS settings.
• Respond to support requests and investigate failed purchases, refunds, missing records, or service errors.
• Measure feature use, understand service performance, improve the product, and diagnose crashes or errors.
• Comply with law, enforce agreements, protect users and the public, and establish or defend legal claims.

5. How information is disclosed

We disclose information only as reasonably necessary for the purposes described in this policy:

• Shipping and insurance: EasyPost, USPS, UPS, FedEx, other selected carriers, address-verification providers, and insurance or claims partners receive shipment information needed to quote, create, deliver, track, insure, or support a shipment.
• Payments: Stripe, Apple Pay, card networks, banks, and fraud-prevention partners process payment and transaction information. ShipWiz does not receive or store full card numbers or card security codes.
• Cloud and account services: Google Firebase and Google Cloud support authentication, databases, hosting, analytics, crash reporting, security, and backend operations.
• Notifications: OneSignal and Apple Push Notification service process push tokens, device and subscription information, sessions, and notification interactions to deliver and measure notifications.
• Phone services: Firebase Authentication and Twilio may process telephone numbers and technical information for SMS authentication, number validation, and abuse prevention.
• Website and support: Google Analytics, Google reCAPTCHA, Formspree, Slack, and Atlassian Statuspage may process limited website, contact, operational-alert, or service-status information.
• Legal and safety: we may disclose information when reasonably necessary to comply with law, legal process, valid government requests, protect rights or safety, investigate fraud, or enforce agreements.
• Business transfers: information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.

6. Legal bases for processing

Where the GDPR, UK GDPR, or similar laws apply, our legal bases depend on the context and may include:

• Contract: processing needed to provide requested shipping, account, payment, tracking, insurance, and support services.
• Legitimate interests: securing and improving the Services, preventing fraud, maintaining records, communicating about the Services, and operating our business, balanced against your rights.
• Legal obligations: tax, accounting, sanctions, law-enforcement, consumer-protection, and other compliance requirements.
• Consent: when law requires consent for optional communications, permissions, or technologies. You may withdraw consent where applicable, without affecting prior lawful processing.

A required policy acknowledgment confirms that notice was presented; it does not waive privacy rights or replace separate consent where consent is legally required.

7. Retention

We retain information for as long as reasonably necessary to provide the Services, maintain accounts and shipment history, complete transactions, resolve disputes, prevent fraud, meet carrier and insurance requirements, comply with legal obligations, and establish or defend claims.

• Saved account settings, addresses, package presets, and policy acknowledgment records are generally retained while your account remains active, unless a longer period is required for legal or operational reasons.
• Transaction, label, tracking, insurance, refund, and surcharge records may be retained after account deletion when required for payment, tax, accounting, fraud-prevention, carrier, insurance, or legal obligations.
• Analytics, notification, support, and diagnostic providers retain information according to our configurations and their applicable retention policies.
• Backups and logs may persist for a limited period after deletion before being overwritten or isolated from ordinary use.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated access, encrypted network transport, restricted production access, provider security controls, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your choices and rights

• Account information: you can update saved addresses and certain settings in the app.
• Notifications: change notification permissions in iOS Settings or opt out through available app controls.
• Account deletion: use the Delete Account control in ShipWiz Settings. Deletion is subject to records we must retain for legal, transaction, fraud-prevention, carrier, or dispute purposes.
• Privacy requests: depending on where you live, you may request access, correction, deletion, restriction, objection, portability, or information about disclosures. You may also appeal a denied request where applicable.

Submit a request to support@shipwiz.app. We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law.

10. California privacy notice

California residents may have rights to know, access, correct, delete, and obtain information about the collection and disclosure of personal information, and to receive equal service when exercising privacy rights. Because ShipWiz does not sell personal information or share it for cross-context behavioral advertising, we do not offer a sale/sharing opt-out mechanism.

We disclose these categories to the service-provider categories described above for business purposes, including service delivery, payments, shipping, analytics, security, support, and legal compliance. ShipWiz has not sold these categories or shared them for cross-context behavioral advertising in the preceding 12 months.

Some payment and account-security information may qualify as sensitive personal information under California law. We use it only for permitted purposes such as providing requested services, processing payments, authentication, security, and fraud prevention—not to infer characteristics about you.

11. International users and transfers

ShipWiz is based in the United States, and our providers may process information in the United States and other countries. Where required, transfers are supported by recognized legal mechanisms and contractual safeguards. Residents of the EEA, United Kingdom, or Switzerland may also lodge a complaint with their local supervisory authority.

12. Children's privacy

The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

13. Changes and notices

We may update this policy as our Services or legal obligations change. We will post the updated policy here and revise its effective date and version. For material changes, we may provide an additional notice through the app, website, email, or another appropriate channel.

When the app presents a versioned privacy notice, we may require acknowledgment before continued use and retain the policy version, server-recorded time, app version, and app build associated with the acknowledgment. If we make changes that require consent rather than notice, we will request that consent separately where required.