Privacy Policy

• Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked with an individual.
• Customer Data means information, which may include personal information, that a customer or its authorized users submit to the Services or otherwise make available for processing through the Services.
• Customer means the entity that enters into an agreement with Shipflow for the Services.

For website visitors and prospects, Shipflow is generally the controller of personal information we collect directly, for example through demo requests.

For Customer Data processed through the Services, Shipflow generally acts as a processor or service provider on behalf of the Customer. In that context:

• We process Customer Data only on the Customer’s documented instructions.
• We assist Customers, as reasonably necessary, with requests from data subjects and with security and breach obligations, consistent with applicable law and our agreements.
• We use Customer Data only to provide, secure and improve the Services, and not for our own independent marketing.
• We will delete or return Customer Data at the end of the Services, consistent with the Customer agreement and applicable law.

A separate Data Processing Addendum (“DPA”) is available for enterprise customers upon request or may be incorporated into the Customer agreement.

In short: We collect information you provide, information we process for Customers and information collected automatically when you use the Services.

3.1 Information you provide to us

We may collect personal information you choose to provide, such as:

• Name, email address and company or role.
• Account credentials and authentication information.
• Billing or contact information, if applicable.
• Communications with us, including support requests, feedback and sales discussions.

3.2 Customer Data

Our Services may process Customer Data that Customers and their users submit or connect to the Services. Customer Data can include business communications, documents and operational information necessary to perform the Services.

3.3 Information collected automatically

When you use the Services, we may automatically collect:

• IP address and approximate location.
• Device, browser and operating system information.
• Usage and interaction data, such as pages viewed and features used.
• Log data, performance data and diagnostic information.

3.4 Cookies and similar technologies

We use cookies and similar technologies to operate the Services, remember preferences and understand usage. You can manage cookies through your browser settings.

In short: We use information to provide and improve the Services, communicate with you and keep the Services secure.

We may use information to:

• Provide, operate and maintain the Services.
• Process Customer Data to perform requested workflows.
• Respond to inquiries and provide customer support.
• Send administrative messages, including service updates and security notices.
• Improve product performance, reliability and user experience.
• Protect against fraud, abuse and security incidents.
• Comply with legal obligations.

We do not sell personal information.

In short: The Services may use automated systems, including AI, to perform tasks requested by Customers.

Where the Services use AI or automated processing:

• Processing may involve analyzing content submitted to the Services to perform requested tasks.
• We implement safeguards designed to protect Customer Data.
• We do not use Customer Data to train publicly available models.

In short: We share information only when needed to run the Services, comply with the law or in connection with business transfers.

We may share information:

• With service providers that help us operate the Services, for example hosting, security, analytics and customer support. They are required to protect information and use it only to provide services to us.
• With affiliates, if any, consistent with this Privacy Policy.
• For legal reasons, for example to comply with law, enforce agreements or protect rights and safety.
• In connection with a business transfer, for example a merger, acquisition, financing or sale of assets.

In short: We keep information only as long as needed for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• We retain account information while your account is active.
• Customer Data retention is primarily determined by Customer agreements and configuration.
• We may retain information to comply with legal obligations, resolve disputes and enforce agreements.

In short: We use reasonable technical and organizational safeguards designed to protect information.

No method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your credentials and for using strong passwords.

In short: No. The Services are not intended for individuals under 18, and we do not knowingly collect personal information from children.

In short: Depending on where you live, you may have rights to access, correct, delete or object to certain processing.

Depending on your jurisdiction, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Object to or restrict certain processing.
• Request portability, where applicable.

To exercise these rights, contact us at admin@shipflow.ai. We may need to verify your identity before responding.

The Services may process information in the United States and other jurisdictions. Where required, we take steps designed to provide appropriate safeguards for cross-border transfers.

Some browsers offer a “Do Not Track” (“DNT”) setting. At this time, we do not respond to DNT signals.

This section applies to California residents to the extent Shipflow processes personal information as a business under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

13.1 Categories of personal information

In the past 12 months, we may have collected the following categories of personal information, depending on how you interact with us:

• Identifiers, such as name, email address and IP address.
• Internet or network activity, such as interactions with our website or Services.
• Professional or employment-related information, such as company and title.
• Customer Data submitted to the Services by Customers and processed on behalf of Customers.

13.2 Purposes for collection and use

We collect and use personal information for the business purposes described in this Privacy Policy, including providing the Services, security and improving performance.

13.3 Disclosures

We may disclose personal information to service providers and contractors for business purposes, and to other parties as described in Section 6.

13.4 No sale or sharing

Shipflow does not sell personal information. Shipflow also does not share personal information for cross-context behavioral advertising.

13.5 Sensitive personal information

Shipflow does not use or disclose sensitive personal information for purposes that require an opt-out right under CPRA.

13.6 Your California rights

California residents may have the right to:

• Know or access personal information collected, used or disclosed.
• Delete personal information.
• Correct inaccurate personal information.
• Opt out of sale or sharing, if applicable.
• Limit certain uses of sensitive personal information, if applicable.
• Not be discriminated against for exercising privacy rights.

13.7 How to submit a request

Email us at admin@shipflow.ai with the subject line “California Privacy Request.” We will verify your request and respond as required by law.

Authorized agents: You may designate an authorized agent to submit a request on your behalf, subject to verification requirements.

We may update this Privacy Policy from time to time. We will post the updated version and revise the effective date.