1. Your Data and Shipto
Shipto is operated by UJU Pty Ltd t/a Metorik (ABN 76 616 391 925) ("we," "us," or "our"). We are committed to protecting your privacy and keeping your personal information secure. This Privacy Policy explains how we collect, use, disclose, and safeguard information across the Shipto post-purchase tracking platform, the branded tracking experience we serve to your customers, and our associated websites (together, the "Service"). We handle personal information in accordance with the Australian Privacy Act 1988 and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Who This Policy Is Addressed To
This policy distinguishes between merchants — the customers who hold a direct relationship with us by creating a Shipto account — and Contacts, the end customers of those merchants' stores. We process Contact data solely to provide the Service to merchants and have no independent relationship with Contacts. If you are an end customer and have a question about how your data is handled, please contact the merchant whose store you ordered from.
3. Information We May Collect From You
Account Information
When you register for a Shipto account, we collect your name, email address, business name, Shopify store URL, password, IP address, and store settings. We use your IP address to help detect and prevent fraud.
Shipment & Store Data
We collect tracking numbers, carrier data, shipment status updates, delivery timestamps, and the order and customer details necessary to match a shipment to its recipient. This data is tied to your store and used to provide tracking and notifications.
Customer (Contact) Data
On behalf of merchants, we process end-customer information (name, email, phone, and shipping address) only as necessary to deliver tracking notifications and display the branded tracking experience.
Payment Information
App subscription charges are processed through Shopify's billing system when you install Shipto from the Shopify App Store. We do not store payment card details on our servers; Shopify bills your store account according to the plan you select and approve in Shopify admin.
Usage Analytics
We collect aggregated analytics about how your store uses Shipto, including page views, click-through rates, and notification delivery metrics. Any analysis is performed on an aggregated, anonymised basis to improve the Service.
4. How We Use Your Personal Information
We use the information we collect to:
- Provide, maintain, and improve the Service and fulfil our contractual obligations
- Send transactional messages and service announcements
- Respond to your inquiries and support requests
- Administer the Service and optimise its performance
- Detect, prevent, and address fraud and security issues
- Comply with our legal obligations
5. Where We Store Your Personal Data
Account data, store data, and IP addresses are stored on secure cloud infrastructure operated by our hosting and database providers (including Supabase and Amazon Web Services). A number of service providers may process personal data on our behalf, including our hosting, database, email, billing (Shopify), and analytics partners. Your data may be transferred to and stored in countries outside of where you live; where it is, we take steps to ensure it remains protected in line with this policy.
6. Your Store Data
Data connected from your store (orders, customers, shipments, products, and settings) is stored on the secure infrastructure described above. We never sell or rent your store data. Only you and authorised Shipto staff acting for support purposes may access it, and you may export or request deletion of your data at any time.
7. Cookies and Tracking
We use required cookies to maintain your login session and personalise the Service, along with similar technologies to understand how the Service is used. The Shipto tracking experience may set cookies in a customer's browser to recognise a returning visitor and associate a session with an order. You can control cookies through your browser settings.
8. Security
All data is stored on secure servers, and sensitive transfers use encrypted SSL connections. We follow "privacy by design" principles, encrypt data in transit and at rest, and offer secure authentication. You are responsible for keeping your password and API keys confidential. No method of transmission or storage is completely immune from unauthorised access, so we cannot guarantee absolute security.
9. Disclosure of Your Information
We do not sell or rent your personal information. We may disclose information to affiliated companies, to a prospective buyer in the event of a merger or sale of the business, to the service providers that help us operate the Service, to carrier networks as needed to fetch tracking information on your behalf, and to law enforcement or other authorities when required by law or to protect our rights.
10. Integrations with Third Parties
You can connect Shipto to external services through your account settings. Where you do, those third parties may receive data through the integration you enable, and their own privacy policies govern how they handle it. Please review the terms and policies of any service you connect.
11. Retention of Your Personal Information
We retain your account information for as long as your account is active. Store and shipment data is removed within three months of the Service ceasing (where there is no active trial or subscription). Customer email data used for notifications is purged shortly after delivery completes. Invoices are retained as required for tax and accounting purposes.
12. Legal Basis for Processing
Where the GDPR applies, we process personal data on the basis of your consent, to perform the contract we have with you, and on the basis of our legitimate interests in providing and improving the Service. Where we rely on consent, you may withdraw it at any time by contacting us.
13. Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your data (subject to legal obligations)
- Restrict or object to certain processing
- Request a copy of your data in a portable format
- Withdraw consent and opt out of marketing communications
To exercise these rights, please contact us through the contact page.
14. Changes to This Policy
We review this policy regularly and may update it from time to time. We will post any changes on this page with a new "Last updated" date and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
15. Complaints
If you are not satisfied with how we have handled a privacy concern, please contact us first so we can try to resolve it. If your complaint remains unresolved, you may escalate it to the relevant data protection authority or information commissioner in your jurisdiction.
16. Contact Us
Shipto is operated by UJU Pty Ltd t/a Metorik (ABN 76 616 391 925). If you have questions about this Privacy Policy or our privacy practices, please reach us through the contact page.