Privacy Policy

Effective date: 2026-05-20 Last updated: 2026-05-20

ShipStampede (“ShipStampede“, “we“, “us“, “our“) provides a shipping management platform that helps merchants and partners rate, generate, and manage shipments across multiple carriers and e-commerce sources. This Privacy Policy explains what personal information we collect when you use app.shipstampede.com and the related ShipStampede services (the “Service“), how we use it, who we share it with, and the choices you have.

This policy covers two distinct groups of people whose data flows through the Service:

  • Account users — the merchants, partners, customers, and their team members who sign up for and log into the Service.

  • Shipment recipients / order customers — the end-buyers whose names, addresses, and contact details our account users upload, import from connected stores, or enter into the Service for the purpose of shipping goods to them.

We act as a data controller for account users (the people we have a direct relationship with) and as a data processor on behalf of our account users for the shipment-recipient information they bring into the Service.

1. Information We Collect

1.1 Information you give us when you create or use an account

When you sign up, accept an invitation, or use the Service we collect:

  • Identity & contact: first name, last name, email address, phone number, and the company name of the organization you belong to.

  • Authentication data: a hashed (never plain-text) password, and — if you sign in through an external identity provider — the provider name and the identifier that provider gives us. We also store timestamps for email verification, last login, and password-reset requests.

  • Role and organization context: your role inside your organization (e.g. super admin, admin, service user, basic user) and the account type (tenant, partner, or customer) you belong to.

  • Invitations: when an existing user invites you, we store the inviter’s user ID, your email, the invitation token, and the invitation’s expiry, acceptance, and revocation timestamps.

  • Consent marker: when you complete signup we record an identifier for the version of the terms you accepted at the time. (We do not today persist a separate timestamped consent audit row — see Section 9 “Gaps and limitations”.)

1.2 Information generated automatically while you use the Service

  • Session and device data: for each authenticated session we store a hashed refresh token and metadata that may include user agent, IP address, and basic device information, plus the session’s last-active, expiry, and revocation timestamps.

  • Impersonation sessions: if a ShipStampede operator uses our admin impersonation feature to access your account for support, we record who impersonated whom, when it started, when it ended, and any associated metadata.

  • Error and performance data: we use Sentry to capture unhandled errors and a small sample of performance traces (10% of transactions). For browser errors, Sentry records a session replay, but all text is masked and all media is blocked in those replays, and replays are only captured on error (no random session sampling). Sentry receives your user ID, email, and name as error context so we can correlate reports.

1.3 Information about your shipments, orders, and address book

  • Address book entries: street address lines, city, state, postal code, country, timezone, contact name, phone, and the label you give the address (“Warehouse”, “Office”, etc.).

  • Orders: an external order ID from the source (Shopify, WooCommerce, CartRover, API, or “other”), customer email, shipping and billing addresses (as structured snapshots), line items (SKU, name, weight, dimensions), totals, and the raw payload received from the marketplace.

  • Shipments: carrier, tracking number, carrier charge, status, and failure reason if any.

  • Rate quotes: a snapshot of the origin and destination addresses, the parcel’s weight and dimensions, and a hash used to deduplicate identical requests.

1.4 Information about shipment recipients

When you import orders from connected stores, enter addresses, or buy a label, we store information about the end recipient: name, email, phone, company name, shipping address, and any tags or metadata that came with the record from the source platform. We hold this information on your behalf so the Service can rate, label, and ship to that recipient.

1.5 Payment and billing information

  • Cards are tokenized by our payment processors; we never receive or store full card numbers, CVV, or full expiration dates. What we keep in our database is a token reference from the processor plus the card brand, last 4 digits, expiration month and year, a display label, and the card’s status.

  • Payment intents: the amount, currency, status, purpose (wallet top-up, invoice payment, or one-off purchase), a 3DS/SCA client secret or action URL if the processor requires customer authentication, and a structured failure reason if it fails.

  • Wallet activity: your wallet’s available and pending balances and the ledger of transactions (top-ups, refunds, adjustments, debits, and holds), each linked to the shipment, order, or invoice it relates to.

1.6 Connected accounts and credentials

To rate and ship on your behalf, the Service stores carrier and marketplace credentials that you connect:

  • Carrier accounts (UPS, FedEx, USPS, and others): account number, API credentials (stored encrypted at rest in our database), test-mode flag, and connection status.

  • Marketplace integrations (Shopify and others): provider name, provider account ID, OAuth tokens or API keys (stored encrypted at rest), connection status, and store metadata such as store name, currency, and plan tier.

1.7 Local browser storage

Our web app stores the following in your browser, not as HTTP cookies but as localStorage and sessionStorage:

Key Purpose Storage
authToken JWT access token localStorage
refreshToken JWT refresh token localStorage
impersonation_context, impersonation_original_user Active admin impersonation context sessionStorage
shipmentsListFilterSnapshot, ordersListFilterSnapshot UI list filter state sessionStorage
printnode:default-scale:<accountId> Your selected PrintNode scale localStorage

The Service does not set persistent HTTP cookies for tracking, advertising, or analytics.

2. How We Use Information

We use the information described above to:

  • Create and operate your account, including verifying your email, resetting passwords, issuing and revoking authentication sessions, and processing invitations from teammates.

  • Rate shipments, generate labels, manage tracking, and synchronize orders with your connected stores.

  • Charge your wallet, process top-ups, settle invoices, and produce reconciliation invoices.

  • Send you transactional notifications (see Section 4).

  • Provide support, including — only when justified and recorded — temporarily impersonating your account to reproduce an issue you’ve reported.

  • Monitor service health, fix bugs, and improve reliability using error tracking (Sentry) and CloudWatch logs.

  • Comply with our legal obligations and enforce our terms.

We do not sell personal information, and we do not use it for cross-context behavioral advertising. We do not run advertising or marketing pixels of any kind in the Service (no Google Analytics, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, Mixpanel, Segment, Amplitude, PostHog, Hotjar, FullStory, Intercom, or similar — none of these are integrated as of the date of this policy).

3. Who We Share Information With

We share personal information only with the categories of recipients listed below, and only to the extent needed for the purposes described.

3.1 Shipping carriers

To rate and ship on your behalf, the Service transmits the relevant origin and destination addresses, contact names, phone numbers, parcel weight and dimensions, and your carrier account credentials to the carrier you select:

  • UPS (OAuth2-authenticated rating and label generation)

  • FedEx (OAuth2-authenticated rating and label generation)

  • USPS (rating and label generation)

  • EPS/CTT (multi-carrier rating, label generation, and order placement)

DHL, Amazon, Purolator, and Canada Post are referenced in our internal carrier list but are not currently active integrations at the date of this policy.

3.2 Payment processors

  • Nexio — payment processor used to tokenize cards and process card-present and card-not-present transactions. Card data is collected through Nexio’s hosted fields or hosted checkout, so we receive only tokenized references.

  • FloPay — alternative payment processor, used with hosted checkout or browser-based encryption so that we likewise receive only tokenized references.

We share customer identifiers, transaction amounts, and tokenized payment methods with these providers as required to charge your wallet or capture one-off payments.

3.3 E-commerce platforms

  • Shopify — when you connect a Shopify store, we exchange order, customer, and fulfillment data with Shopify over the GraphQL Admin API and webhooks (orders/create, orders/updated, orders/cancelled, and app/uninstalled). We also receive Shopify’s GDPR-mandated webhooks (customers/data_request, customers/redact, shop/redact); see Section 8.

3.4 Notification providers

Transactional emails and SMS are sent through:

  • Amazon Simple Email Service (SES) — our primary email provider, with our shipstampede.co domain identity, DKIM signing, and a configuration set that records bounces and deliveries.

  • Resend — supported as an alternate email provider.

  • Amazon Simple Notification Service (SNS) — for SMS messages.

These providers receive the recipient’s email address or phone number and the message contents (subject and body) needed to deliver the notification. We do not add open-tracking pixels or click-rewriting to our emails.

3.5 Printing

  • PrintNode — when you print a shipping label, the label image and print job metadata are sent to PrintNode so that your local or networked printer can receive it.

3.6 Error tracking

  • Sentry — receives error reports, stack traces, masked session replays (errors only), and the authenticated user’s ID, email, and name as context.

3.7 Cloud infrastructure

The Service runs on Amazon Web Services (AWS). Our production environment is hosted in the us-west-1 (Northern California) AWS region. AWS processes data on our behalf in services including RDS (managed PostgreSQL), S3 (object storage), Lambda (compute), SQS/SNS (queuing and messaging), Secrets Manager, KMS, and CloudFront/ACM (CDN and TLS).

3.8 Legal and safety

We may disclose information when required by law, valid legal process, or to protect the rights, property, or safety of ShipStampede, our users, or others.

3.9 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

4. Communications We Send You

The Service sends only transactional messages. As of the date of this policy, there is no marketing newsletter or promotional email program in the Service. Transactional messages include:

  • Email verification and password-reset emails

  • User invitation emails

  • Sign-in and impersonation start/end notifications

  • Top-up succeeded / top-up failed

  • Payment-intent succeeded / payment-intent failed

  • Payment card added

  • Wallet debited, wallet credited, low-balance warnings

  • Print-allowance exhausted

Each delivery is logged in our database with the notification type, the channel (email, SMS, or in-app), the recipient’s address, send and delivery timestamps, and the provider message ID, so we can support you if something doesn’t arrive.

Because these messages are necessary to operate the Service, we do not currently offer a one-click unsubscribe link in them. If you no longer want to receive a particular type of message, please contact support (Section 11) and we will work with you on it. We do not today send marketing emails, push notifications, or text messages, and we do not today email shipment recipients directly — only account users receive notifications from the Service.

5. Where Your Data Is Stored

Production customer data is stored in the United States, in AWS region us-west-1 (Northern California). Backups, secrets, and S3 objects are stored in the same region. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States.

6. How We Protect Your Information

We use the following technical and organizational measures, all of which are configured in our infrastructure today:

  • Encryption in transit. All traffic to app.shipstampede.com and api.shipstampede.com is served over HTTPS via Amazon CloudFront with AWS Certificate Manager (ACM) certificates; the CloudFront-to-origin path is set to https-only.

  • Encryption at rest. Our production PostgreSQL database has storage encryption enabled. The S3 buckets that hold cached and original shipping labels and reconciliation invoices are configured with AES-256 server-side encryption.

  • Secrets management. Carrier API credentials, payment-processor secrets, JWT signing keys, and similar values are stored in AWS Secrets Manager and AWS Systems Manager Parameter Store, encrypted with a dedicated AWS KMS key with a 30-day deletion window. Carrier credentials and marketplace OAuth tokens are additionally stored as encrypted columns in our database.

  • Network isolation. Our RDS database is not publicly accessible; it accepts connections only from the application VPC’s security groups.

  • Multi-tenancy isolation. Every authenticated request is scoped to an account (tenant, partner, or customer), and our domain queries are scoped by account ID so that resources do not cross that boundary.

  • Role-based access control. Inside an account, permissions are enforced based on four roles — super_admin, admin, service_user, and basic_user.

  • Backups and resilience. Production RDS has a 30-day automated backup retention window, Multi-AZ failover, deletion protection, and a final-snapshot policy on cluster deletion.

  • Application security. The API uses HTTP security headers (Helmet) including a Content-Security-Policy default of 'self'. JWTs are signed and short-lived (default 1 hour access token, 7-day refresh token).

  • Sensitive-field redaction in logs. Our application logger automatically obfuscates fields whose names match a denylist (password, secret, apiKey, accessToken, refreshToken, authorization, carrier and processor key names, JWT secret, webhook secret, etc.).

  • Authentication tokens are stored in browser localStorage, not in HTTP cookies. This means tokens are accessible to JavaScript running on the page, which is why we enforce the Content-Security-Policy above.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We do not today hold a SOC 2, ISO 27001, HIPAA, or PCI DSS certification. Card data does not flow through our servers; PCI scope is reduced because tokenization happens with our payment processor.

7. How Long We Keep Information

Category Retention
Cached shipping labels in S3 30 days, then auto-deleted
Original shipping labels in S3 90 days, then auto-deleted
Reconciliation invoices in S3 365 days; non-current versions 30 days
Production database backups 30 days
Active account, order, shipment, address, and wallet records Kept for the life of the account; soft-deleted records remain in the database
Authentication sessions Until expiry or revocation
Notification delivery logs Kept for operational and support purposes

We do not today have an automated hard-delete or purge policy for soft-deleted application records. If you need data fully removed, please contact support and we will handle the request manually.

8. Your Rights and Choices

Depending on where you live, you may have rights under laws such as the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), or similar regimes, including the right to:

  • Access the personal information we hold about you.

  • Correct information that is inaccurate or incomplete.

  • Delete your information (subject to legal-retention and operational exceptions).

  • Port your information in a structured, machine-readable format.

  • Object to or restrict certain processing.

  • Withdraw consent where processing is based on consent.

  • Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at the address in Section 11. We will respond within the time required by applicable law. For shipment-recipient data (where we act as a processor on your account user’s behalf), please direct your request to the account user — typically the merchant or store that shipped to you — and we will support them in fulfilling it.

Shopify-forwarded requests. When a buyer submits a data-request or deletion request through a Shopify-connected store, Shopify forwards it to us via its GDPR webhooks (customers/data_request, customers/redact, and shop/redact). We authenticate each webhook (HMAC verification and shop recognition) and record it. Today the redaction itself is performed manually by our support team rather than automatically — see Section 9.

We will not retaliate against you for exercising any of these rights.

9. Gaps and Limitations We Want to Be Honest About

Because we’d rather be straightforward than overpromise, this is the current state of self-service privacy controls in the Service today:

  • No self-service data export. The Service does not currently expose a one-click “download my data” button. Data-portability requests are handled manually by support.

  • No self-service account deletion. Account deletion is not yet exposed in the UI. To delete an account, please contact support and we will process the request.

  • No persisted consent audit log. We record the version identifier of the terms you accepted at signup, but we do not yet store a separate timestamped consent-history record. We rely on the signup record’s creation time and your terms version for evidence of acceptance.

  • No granular per-notification preferences. Notifications are operational and cannot be individually toggled today; contact support if you need a change.

  • No user-facing activity log. Our system records domain events internally for engineering and support use, but there is no end-user-facing audit log UI today.

  • GDPR webhook redaction is manual. When Shopify forwards a customers/data_request, customers/redact, or shop/redact webhook to us, we verify and audit-log it, but the actual data export or deletion is then performed manually by support rather than automatically.

We are tracking these gaps and intend to close them; this policy will be updated when we do.

10. Children

The Service is intended for use by businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it.

11. How to Contact Us

For privacy questions, data-rights requests, or to report a concern:

  • Email: privacy@shipstampede.com or support@shipstampede.com

  • Postal address: 1570 East Edinger Ave. Unit 7 Santa Ana, CA 92705

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top, and — if the change is material — we will notify account users through an in-app message or email before the change takes effect. The current version of this policy is always available at https://app.shipstampede.com/legal/privacy-policy.