Privacy Policy
Effective 13 December 2026. Last updated 13 December 2026.
This Privacy Policy explains how Shipzobuy Global Brands represented by YUANHUBUY TECHNOLOGY LIMITED ("Shipzobuy", "we", "us" or "our") collects, uses, discloses and protects personal data when you visit our website, use the Shipzobuy shipping platform, the Shipzobuy Shopify app or the Shipzobuy WooCommerce plugin (together, the "Service"), or otherwise interact with us.
It is written to meet the transparency requirements of, among others, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations ("PECR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other US state privacy laws, Brazil's Lei Geral de Proteção de Dados ("LGPD"), Canada's PIPEDA and Québec's Law 25, and the data protection laws of the Asia-Pacific region listed in Section 14.
1. Who we are and how to contact us
The controller responsible for the personal data described in this policy is Shipzobuy Global Brands represented by YUANHUBUY TECHNOLOGY LIMITED, Partnership, tax identification number (NIF) 46434463Q, with its registered office at Passeig de Manuel Girona 66, 08034 Barcelona, Spain.
- Privacy requests and questions: dpo@shipzobuy.com
- Data Protection Officer: Antonio Autonell Vicioso, dpo@shipzobuy.com
- Representative in the European Union (GDPR Art. 27): not required, as Shipzobuy is established in the European Union (Spain)
- Representative in the United Kingdom (UK GDPR Art. 27): not appointed
- Postal address: Passeig de Manuel Girona 66, 08034 Barcelona, Spain
2. Scope of this policy and our role
Shipzobuy as controller. We act as a controller for personal data about website visitors, people who contact our sales or support teams, our customers' account users (for example, the name, email address and sign-in details of the people who use a Shipzobuy account), and for billing, security, fraud prevention and legal compliance.
Shipzobuy as processor. When a merchant connects a store (for example, Shopify, WooCommerce or Wix) and uses the Service to fulfil orders, we process the personal data of that merchant's own customers ("End Customers"), such as names, shipping addresses, telephone numbers, email addresses and order contents, on the merchant's behalf and on its documented instructions. For that data the merchant is the controller and our Data Processing Addendum applies. If you are an End Customer and want to exercise your rights, please contact the merchant you bought from; we will assist the merchant as required by law.
Carriers. When a label is purchased, the shipping data needed to transport the parcel is passed to the shipping label provider and the carrier selected. Carriers process that data as independent controllers under their own privacy notices.
3. Personal data we collect
We collect only the personal data that is necessary for the purposes described in Section 4.
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, business email address, telephone number, company name, job role | You; your organisation; sign-in providers such as Google |
| Account and authentication data | User id, hashed password, sign-in and two-step verification events, organisation membership and role | You; generated by the Service |
| Billing and transaction data | Plan, wallet balance and transactions, top-up amounts, invoices, VAT number, billing address. Card details are collected and stored by Stripe, not by us | You; Stripe; Shopify Billing |
| Store and order data (processed for merchants) | Orders, line items, End Customer names, shipping and billing addresses, telephone numbers, email addresses, parcel weights and dimensions, tracking numbers | Your connected Shopify or WooCommerce store; you |
| Shipping data | Sender and recipient addresses, rates, labels, tracking events, carrier surcharges | You; Shippo and other label providers; carriers |
| Support, sales and chat data | Messages to our support or sales team, PostAI chat messages, attachments, support ticket details, satisfaction ratings, the name and email you give to our sales team | You; our support system (Support Board) |
| Technical and usage data | Device and browser type, pages visited within the Service, error reports, security logs, approximate time zone. For the visitor sales chat we store a one-way hash of the IP address, used only to prevent abuse | Your device; our systems |
| Consent records | A random consent identifier, your cookie choices, the date and the policy version. No IP address is stored | Your device |
| Integration credentials | Access tokens for the stores and services you connect, stored encrypted or with restricted access | You; the connected platform |
We do not intentionally collect special categories of personal data (such as health data or data revealing racial or ethnic origin) or "sensitive personal information" as defined in the CCPA, other than account log-in credentials. Please do not include such data in orders, notes or chat messages.
4. How we use personal data and our legal bases
Where the GDPR, UK GDPR, FADP, LGPD or a similar law applies, we rely on the legal bases set out below.
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Creating and administering accounts; providing the Service, including order import, rate comparison, label purchase, tracking write-back, packing slips and automation rules | (b) Performance of a contract; for End Customer data, processing on the merchant's instructions under the DPA |
| Processing wallet top-ups, subscriptions, label charges, carrier adjustments and refunds; issuing invoices | (b) Contract; (c) legal obligation (accounting and tax law) |
| Providing customer support, live chat and support tickets, including routing your message to the right team | (b) Contract; (f) legitimate interest in answering enquiries efficiently |
| Answering questions from website visitors through the sales chat, and following up if you leave contact details | (f) Legitimate interest in responding to business enquiries; (b) steps taken at your request before entering into a contract |
| PostAI answers based on your account data, and proactive service messages about failed labels, low wallet balance or stalled synchronisation | (b) Contract; (f) legitimate interest in helping customers use the Service |
| Securing the Service, preventing fraud and abuse, enforcing our Terms, keeping security logs and rate limits | (f) Legitimate interests in security and fraud prevention; (c) legal obligation where applicable |
| Improving and developing the Service using aggregated or de-identified information | (f) Legitimate interest in improving our products |
| Optional analytics and advertising cookies | (a) Consent, which you may withdraw at any time |
| Sending marketing emails about Shipzobuy | (a) Consent, or (f) legitimate interest for existing business customers where the law permits (soft opt-in); you can opt out at any time |
| Complying with legal obligations, responding to lawful requests from authorities, and establishing, exercising or defending legal claims | (c) Legal obligation; (f) legitimate interest in protecting our rights |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may request information about that assessment using the contact details in Section 1.
5. Artificial intelligence features
The Service includes PostAI, an AI assistant that answers questions in the dashboard and on our website, and AI-generated first replies to support tickets. In accordance with the transparency obligations of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, Article 50), messages written by AI are labelled as such, and you can ask to talk to a person at any time.
- Signed-in users. To answer, PostAI uses the question you ask and relevant data from your organisation's account (for example, order status, shipments, rules and wallet balance).
- Website visitors. The sales assistant uses only your messages and public information about Shipzobuy. It cannot see any account until you sign in and choose Allow to link the conversation to your account.
- Your messages are sent to the large language model services made available through our hosting provider, solely to generate the response. We do not use your content to train AI models.
- AI answers may be inaccurate. They are not legal, tax or customs advice, and no decision that produces legal or similarly significant effects for you is taken solely by automated means.
8. International transfers
Our service providers are located in several countries, including the United States, and personal data may therefore be processed outside your country of residence. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on:
- the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914);
- the UK International Data Transfer Addendum to those clauses, issued under section 119A of the Data Protection Act 2018, and the equivalent Swiss safeguards;
- the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. framework, where the recipient is certified; or
- another transfer mechanism permitted by applicable law, together with supplementary measures where required.
For transfers subject to other laws (for example, China's PIPL, Japan's APPI, South Korea's PIPA, Brazil's LGPD or India's DPDP Act), we comply with the applicable transfer requirements, including providing the information required and obtaining consent where the law requires it. You may obtain a copy of the relevant safeguards by contacting dpo@shipzobuy.com.
9. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, and then delete or anonymise it. The following periods apply unless a longer period is required by law or needed to establish, exercise or defend legal claims:
| Data | Retention period |
|---|---|
| Account data | For the life of the account, and deleted within 90 days after account closure, except as below |
| Orders, shipments and End Customer data processed for merchants | For the life of the merchant's account or as instructed by the merchant; deleted within 90 days after account closure or earlier deletion |
| Invoices, payment and wallet transaction records | As required by accounting and tax law, typically between 6 and 10 years |
| Support tickets and chats | Up to 3 years after the last message |
| Website sales chats not linked to an account | Up to 12 months after the last message |
| Security and access logs | Up to 12 months |
| One-way hash (SHA-256) of the email address of a deleted account or of an account that started a free trial | Kept after the account is closed, on the basis of our legitimate interest in preventing misuse: it lets us show that an account was deleted when someone signs in with that address again, and limits each email address to one free trial. We keep only the hash, the date and, for trials, the plan, not the address itself |
| Consent records | For as long as the consent is valid plus up to 3 years, to demonstrate compliance |
| Marketing preferences and suppression lists | For as long as needed to respect your opt-out |
10. How we protect personal data
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. They include encryption in transit (TLS), access controls based on organisation and role, row-level access rules in our database, optional two-step verification, signed and time-limited requests between Shipzobuy and connected stores, hashed one-time codes and tokens, restricted access to credentials, logging and monitoring, and staff confidentiality obligations. A description of these measures is in Annex II of our Data Processing Addendum.
No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, within the time limits set by applicable law.
11. Your rights
Depending on where you live, you may have some or all of the following rights:
- to be informed about and to access the personal data we hold about you;
- to have inaccurate data corrected and incomplete data completed;
- to have your data deleted ("right to be forgotten");
- to restrict or object to processing, including processing based on legitimate interests and direct marketing;
- to data portability, receiving your data in a structured, commonly used and machine-readable format;
- to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
- to opt out of the sale or sharing of personal data, targeted advertising and profiling (US state laws);
- to appoint an authorised agent or to nominate a person to exercise your rights after your death where the law provides for it;
- to lodge a complaint with a supervisory authority.
You can delete your account yourself under Settings. To exercise any other right, email dpo@shipzobuy.com. We will respond within the time required by law (for example, one month under the GDPR, extendable by two further months for complex requests; 45 days under the CCPA, extendable once by 45 days). We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.
12. Additional information for the EEA, United Kingdom and Switzerland
Our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You also have the right to lodge a complaint with the supervisory authority in your country of habitual residence, place of work or place of the alleged infringement. A list of EEA authorities is available from the European Data Protection Board . In the United Kingdom, the authority is the Information Commissioner's Office . In Switzerland, it is the Federal Data Protection and Information Commissioner .
Providing personal data is generally voluntary. However, if you do not provide the data required to create an account or purchase a label, we cannot provide the Service.
13. Additional information for residents of the United States
Notice at collection. This section supplements this policy for residents of California and other US states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, as those laws come into effect.
| Category (CCPA) | Collected | Disclosed for a business purpose to |
|---|---|---|
| Identifiers (name, email, account id) | Yes | Service providers; carriers; connected platforms |
| Customer records (address, telephone, payment records) | Yes | Service providers; payment providers; carriers |
| Commercial information (plans, purchases, labels) | Yes | Service providers; payment providers |
| Internet or network activity (usage within the Service, security logs) | Yes | Service providers |
| Geolocation data | Only addresses you provide; no precise device location | Carriers |
| Professional information (company, role) | Yes | Service providers |
| Inferences | No | - |
| Sensitive personal information | Account log-in credentials only, used solely to provide the Service | - |
No sale or sharing. We have not sold or shared personal information, as those terms are defined in the CCPA, in the preceding 12 months, and we do not knowingly sell or share the personal information of consumers under 16. If we enable advertising cookies in future, they will only be used with your consent and you can opt out at any time through Cookie settings or the "Your privacy choices" link. We honour Global Privacy Control (GPC) browser signals as a valid request to opt out of sale, sharing and targeted advertising.
Your rights and appeals. Subject to the law of your state, you may request to know, access, correct, delete and port your personal information and to opt out of sale, sharing, targeted advertising and profiling. You may use an authorised agent, who must provide proof of authorisation. If we decline your request, you may appeal by replying to our decision or emailing dpo@shipzobuy.com with the subject "Privacy appeal"; we will respond within the period required by your state's law, and if the appeal is denied you may contact your state Attorney General.
Retention and purposes are described in Sections 4 and 9. California "Shine the Light" (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing purposes. Nevada: we do not sell covered information as defined in NRS 603A.
14. Additional information for other countries and regions
Where the following laws apply to our processing of your personal data, you have the rights they grant in addition to those described above. Requests can be made to dpo@shipzobuy.com, and the contact person below serves as the officer or representative each law requires.
| Jurisdiction | Law | Notes |
|---|---|---|
| Brazil | Lei Geral de Proteção de Dados (Law 13.709/2018) | Our data protection officer (encarregado) is Antonio Autonell Vicioso, dpo@shipzobuy.com. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD). |
| Canada | PIPEDA; Québec Act respecting the protection of personal information in the private sector (Law 25); Alberta and British Columbia PIPA | The person in charge of the protection of personal information is Antonio Autonell Vicioso, dpo@shipzobuy.com. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec. |
| China (mainland) | Personal Information Protection Law (PIPL) | Where PIPL applies, we obtain separate consent for cross-border transfers where required and comply with the applicable transfer mechanism. |
| Japan | Act on the Protection of Personal Information (APPI) | Personal data may be provided to third parties in foreign countries as described in Sections 7 and 8; on request we will provide information about the foreign country's privacy regime and the recipient's safeguards. |
| South Korea | Personal Information Protection Act (PIPA) | Details of overseas transfers (recipient, country, items, purpose and retention) are given in our Sub-processor list. You may refuse transfers, although this may prevent use of the Service. |
| Singapore | Personal Data Protection Act 2012 (PDPA) | Our Data Protection Officer can be reached at dpo@shipzobuy.com. |
| India | Digital Personal Data Protection Act 2023 and its Rules | You may withdraw consent, request correction and erasure, and nominate another person to exercise your rights. Our grievance officer can be reached at dpo@shipzobuy.com; you may escalate to the Data Protection Board of India. |
| Thailand | Personal Data Protection Act B.E. 2562 (2019) | You may complain to the Personal Data Protection Committee. |
| Philippines | Data Privacy Act of 2012 (Republic Act 10173) | You may complain to the National Privacy Commission. |
| Hong Kong SAR | Personal Data (Privacy) Ordinance (Cap. 486) | You may request access to and correction of your personal data. |
| Vietnam | Law on Personal Data Protection and its implementing decrees | We provide the required notices and obtain consent where required for processing and cross-border transfers. |
| Indonesia | Personal Data Protection Law (Law No. 27 of 2022) | You may withdraw consent and request deletion or restriction. |
| Malaysia | Personal Data Protection Act 2010 (as amended in 2024) | You may request access and correction and withdraw consent. |
| Taiwan | Personal Data Protection Act | You may request access, correction, cessation of processing and deletion. |
| Australia | Privacy Act 1988 and Australian Privacy Principles | You may complain to the Office of the Australian Information Commissioner (OAIC). |
| New Zealand | Privacy Act 2020 | You may complain to the Office of the Privacy Commissioner. |
| South Africa | Protection of Personal Information Act 2013 (POPIA) | Our Information Officer can be reached at dpo@shipzobuy.com; you may complain to the Information Regulator. |
| United Arab Emirates, Saudi Arabia, Türkiye and others | Federal Decree-Law 45/2021 (UAE PDPL); Saudi PDPL; Turkish Law 6698 (KVKK) | You have the rights granted by those laws, which can be exercised as described in Section 11. |
15. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16 (or the higher age of digital consent in your country), and we comply with the US Children's Online Privacy Protection Act (COPPA). If you believe a child has provided us with personal data, contact dpo@shipzobuy.com and we will delete it.
16. Service and marketing communications
We send service messages that are necessary to operate your account, such as security alerts, receipts, label failures, low wallet balance warnings and changes to our terms. These are not marketing and cannot be switched off while you have an account.
We send marketing communications only where permitted by law, including the ePrivacy Directive, PECR, the US CAN-SPAM Act and Canada's Anti-Spam Legislation (CASL). Every marketing email contains an unsubscribe link, and you may also opt out by contacting dpo@shipzobuy.com.
17. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new effective date and, if the changes are material, notify account holders by email or in the Service before they take effect. Where the law requires your consent to a change, we will ask for it.
18. Contact
Questions or complaints about this policy or our handling of personal data can be sent to dpo@shipzobuy.com or by post to Shipzobuy Global Brands represented by YUANHUBUY TECHNOLOGY LIMITED, Passeig de Manuel Girona 66, 08034 Barcelona, Spain. We will try to resolve any concern directly; this does not affect your right to complain to a supervisory authority.