Privacy Policy

At Ship Captain, protecting your privacy is fundamental to how we operate. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our multi-carrier shipping platform, including our Carrier Connect, WMS, OMS, and Online applications.

By using Ship Captain's services, you acknowledge that you have read and understood this Privacy Policy. We encourage you to review this policy periodically, as we may update it to reflect changes in our practices or applicable laws.

This policy applies to all users of Ship Captain services, including individuals, businesses, and organizations. It does not cover third-party services, websites, or applications that may be linked from our platform, each of which operates under its own privacy policy.

Information You Provide Directly

• Account Information: Name, email address, phone number, company name, and password when you create an account
• Billing Information: Payment card details, billing address, and transaction history for processing payments
• Shipping Information: Sender and recipient names, addresses, phone numbers, and package details required for label creation and shipment tracking
• Carrier Account Credentials: API keys and account numbers for carrier integrations you choose to connect
• Communication Records: Messages and correspondence when you contact our support team

Information Collected Automatically

• Device Information: Browser type, operating system, device identifiers, and screen resolution
• Usage Data: Pages visited, features used, timestamps, and interactions with our platform
• Network Information: IP address, internet service provider, and general geographic location
• Cookies and Tracking: Session cookies, authentication tokens, and analytics data to improve your experience

Information from Third Parties

• Connected Platforms: Order and customer data from Shopify, TikTok Shop, Amazon, and other e-commerce platforms you integrate
• Shipping Carriers: Tracking updates, delivery confirmations, and service notifications from UPS, FedEx, USPS, DHL, UniUni, and other carriers
• Payment Processors: Transaction confirmations and fraud prevention data from Stripe and other payment partners

Core Service Delivery

• Creating shipping labels and processing shipments across multiple carriers
• Managing your organization, team members, and access permissions
• Processing payments and maintaining wallet balances
• Providing real-time tracking and delivery notifications
• Synchronizing orders from connected e-commerce platforms
• Managing warehouse inventory, orders, and fulfillment workflows

Platform Improvement

• Analyzing usage patterns to enhance features and user experience
• Identifying and resolving technical issues and bugs
• Developing new services and functionality based on user needs
• Conducting research to improve shipping rate comparisons and recommendations

Communication

• Sending transactional emails about shipments, billing, and account activity
• Providing customer support and responding to inquiries
• Notifying you about service updates, security alerts, and policy changes
• Sending marketing communications with your consent (you can opt out anytime)

Security and Compliance

• Detecting and preventing fraud, unauthorized access, and abuse
• Maintaining audit logs for security and compliance purposes
• Enforcing our Terms of Service and other policies
• Complying with legal obligations and responding to lawful requests

We share information only in the following circumstances:

Service Providers

We work with trusted third-party service providers who assist in operating our platform. These include shipping carriers (UPS, FedEx, USPS, DHL, UniUni), payment processors (Stripe), cloud infrastructure providers, and customer support tools. These providers are contractually obligated to protect your information and use it only for the specific services they provide to us.

Business Integrations

When you connect third-party platforms (Shopify, TikTok Shop, Amazon), we share necessary data to enable order synchronization and fulfillment updates. This sharing is governed by your authorization and the respective platform's privacy policies.

Legal Requirements

We may disclose information when required by law, court order, or government request, or when we believe disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of our users.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

We use cookies and similar tracking technologies to provide, protect, and improve our services. This section explains what cookies we use and how you can control them.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, understand how you use the site, and provide personalized experiences.

Types of Cookies We Use

Third-Party Cookies

We may allow certain third-party services to place cookies on your device for analytics and advertising purposes. These third parties include:

• Google Analytics: Website analytics and usage tracking
• Stripe: Payment processing and fraud prevention

Managing Cookies

You can control and manage cookies in several ways:

• Browser Settings: Most browsers allow you to refuse or delete cookies through settings. Note that blocking cookies may affect platform functionality
• Cookie Preferences: Use our cookie consent banner to customize your preferences when you first visit
• Opt-Out Links: Google Analytics opt-out browser add-on is available at tools.google.com/dlpage/gaoptout

Cookie Duration

• Session Cookies: Deleted when you close your browser
• Persistent Cookies: Remain on your device for a set period (authentication: up to 30 days; preferences: up to 1 year; analytics: up to 2 years)

We implement comprehensive security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

Technical Safeguards

• TLS/SSL encryption for all data transmitted between your device and our servers
• Encryption of sensitive data at rest in our databases
• Ongoing internal security assessments and automated vulnerability scanning in our CI pipeline; third-party penetration testing program in development
• AWS WAF rules applied at our application load balancer to filter common web exploits
• AWS Shield Standard DDoS protection; rate limiting and abuse prevention at the application layer

Access Controls

• Role-based access control limiting data access to authorized personnel
• Two-factor authentication available for all user accounts
• API key authentication with granular permission scopes
• Comprehensive audit logging of all significant actions

Support Access to Your Account

To resolve technical issues, assist with onboarding, or respond to support requests, authorized members of our support and engineering teams may temporarily access your account on your behalf ("impersonation"). This access is:

• Restricted to authorized personnel through role-based access controls
• Protected by mandatory multi-factor authentication
• Time-limited and automatically expires
• Recorded in our audit logs, including the staff member's identity, the account accessed, and the time of access

Support personnel will never ask for your password, and we limit this access to what is necessary to assist you. When an account is being accessed in this way, a visible indicator is displayed within the application.

Infrastructure Security

• Hosted on Amazon Web Services, whose infrastructure services are SOC 2 Type II compliant. Ship Captain's own SOC 2 certification is on our roadmap
• Production PostgreSQL (Amazon RDS) uses automated daily backups with 7-day retention and point-in-time recovery, encrypted at rest with AWS KMS. Backups are stored redundantly within our AWS environment, and we maintain defined recovery point and recovery time objectives documented in our restore runbook. We continue to strengthen our backup and disaster-recovery capabilities, including planned cross-Region resilience, as the platform grows
• Network segmentation and intrusion detection systems
• Continuous automated infrastructure monitoring, with documented incident response procedures and defined response targets

While we strive to protect your information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we continuously work to improve our security practices.

We retain different categories of information for different periods, based on why we hold it:

• Buyer Personal Information from Sales Channels: Buyer personal information we receive from connected sales channels and marketplaces — for example Amazon, Shopify, TikTok, Etsy, and BigCommerce — including recipient name, shipping address, phone number, and email, is retained only as long as needed for order fulfillment and carrier operations, and in no case longer than 30 calendar days after order fulfillment (shipment). After that period, this information is automatically redacted from active records.
• Non-Personal Operational Data: Non-personal operational data (such as order identifiers, SKUs, totals, tracking numbers, and timestamps) may be retained after redaction for accounting, tax, and operational purposes.
• Account Data: Retained while your account is active and for a reasonable period thereafter for legal and business purposes
• Transaction Records: Retained for 7 years to comply with financial and tax regulations
• Shipping Records: Buyer personal information in shipping records (recipient name, address, phone, and email) is redacted no later than 30 calendar days after order fulfillment (shipment). Only non-personal shipment metadata (such as tracking number, carrier, cost, and status) is retained for up to 3 years to support claims, disputes, and audit requirements.
• Audit Logs: Retained for 2 years for security and compliance monitoring
• Marketing Preferences: Retained until you update your preferences or request deletion
• Legal & Regulatory Retention: Where a specific law requires longer retention of certain records, we keep only the minimum information necessary for that compliance purpose.

When data is no longer needed, we securely delete or anonymize it in accordance with our data retention policies and applicable legal requirements.

Depending on your location, you may have certain rights regarding your personal information. We are committed to honoring these rights regardless of where you reside.

Your Rights Include

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request a copy of your data in a structured, machine-readable format
• Opt-Out: Unsubscribe from marketing communications at any time
• Restriction: Request that we limit how we process your information in certain circumstances

Exercising Your Rights

You can exercise many of these rights directly through your Ship Captain account settings. For requests that cannot be handled through the platform, please contact our Privacy Team using the information below. We will respond to your request within 30 days and may require identity verification to protect your privacy.

Children's Privacy

Ship Captain is designed for business use and is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information. This section describes your rights and how to exercise them.

Categories of Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers: Name, email address, phone number, postal address, account credentials, IP address
• Commercial Information: Transaction records, shipping history, purchase details, billing information
• Internet Activity: Browsing history, search history, interaction data with our platform
• Geolocation Data: General location derived from IP address
• Professional Information: Company name, job title, business address
• Inferences: Preferences and characteristics derived from collected information

Your California Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, business purposes, and third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions (legal obligations, fraud detection, completing transactions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Information: Request that we limit use of sensitive personal information to what is necessary for providing services
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

How to Submit a Request

You may submit a verifiable consumer request by emailing [email protected] with the subject line "California Privacy Request" or through your account settings. We will verify your identity before processing your request and respond within 45 days. You may designate an authorized agent to make a request on your behalf.

Global Privacy Control

We recognize and honor Global Privacy Control (GPC) signals. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of your personal information under the CCPA/CPRA. Learn more about GPC at globalprivacycontrol.org.

Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and similar laws.

Legal Bases for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our shipping and warehouse management services
• Legitimate Interests: Processing for fraud prevention, security, platform improvement, and customer support
• Legal Obligation: Processing required to comply with applicable laws and regulations
• Consent: Processing based on your explicit consent (e.g., marketing communications)

Your GDPR Rights

• Right of Access: Obtain confirmation of processing and a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request that we restrict processing of your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another controller
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Lodge a Complaint: File a complaint with your local supervisory authority

Data Controller

Ship Captain, Inc. is the data controller responsible for your personal data. For privacy inquiries from the EEA, UK, or Switzerland, please contact our Privacy Team at [email protected].

Response Timeline

We will respond to your request within one month. This period may be extended by two additional months for complex requests, in which case we will inform you within the first month.

Ship Captain operates globally and may transfer your personal information to countries other than where you reside. This section explains how we protect your data during international transfers.

Where We Process Data

Our primary data processing facilities are located in the United States. We may also process data in other countries where our service providers operate, including for cloud hosting, customer support, and carrier integrations.

Transfer Safeguards

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not received an adequacy decision, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms with our service providers ensuring equivalent data protection
• Data Privacy Framework: We rely on certified service providers who participate in the EU-U.S. Data Privacy Framework
• Supplementary Measures: Additional technical and organizational safeguards including encryption and access controls

Your Consent

By using our services, you acknowledge that your information may be transferred to and processed in the United States and other countries. We ensure that all international transfers comply with applicable data protection laws and that your information receives the same level of protection regardless of where it is processed.

Requesting Transfer Information

You may request a copy of the safeguards we use for international transfers by contacting [email protected].

We are committed to transparency about how we respond to legal requests for user data. This section describes our approach to government and law enforcement requests.

Our Principles

• Legal Validity: We carefully review each request to ensure it has a valid legal basis and complies with applicable laws
• Narrow Scope: We object to requests that are overly broad, vague, or seek more data than reasonably necessary
• User Notice: When legally permitted, we notify affected users of requests for their data so they may seek legal protection
• Minimal Disclosure: We provide only the specific information legally required, nothing more

Types of Requests We May Receive

• Subpoenas: Court-issued orders requiring production of certain records
• Court Orders: Judicial orders requiring disclosure of user information
• Search Warrants: Court-approved warrants for specific user data
• National Security Requests: Orders issued under national security laws (rare)
• Emergency Requests: Requests citing imminent threat to life or serious injury

How to Submit a Request

Law enforcement and government agencies should direct legal requests to [email protected]. We require all requests to be in writing and include proper legal documentation. We do not respond to requests via phone or informal channels.

Preservation Requests

Law enforcement may request that we preserve user data pending the issuance of formal legal process. We honor valid preservation requests for 90 days, renewable upon request.