Privacy Policy

This Privacy Policy explains how Shipr LLC ("Shipr," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the Shipr platform, including our driver mobile application, our organization (business) portal, our websites, and related services (together, the "Platform").

Shipr is a technology platform that connects businesses ("Shippers") with independent third-party drivers ("Drivers") to arrange local deliveries. This Policy applies to Shippers and their authorized users, to Drivers, and to other individuals whose information we process in connection with a delivery (such as a recipient at a drop-off address).

By using the Platform, you acknowledge the practices described in this Policy. If you do not agree, please do not use the Platform. Some features (for example, real-time delivery tracking) depend on information described below; declining to provide that information may limit your ability to use those features.

We collect information that you provide directly, information generated as you use the Platform, and information from third parties such as our payment and verification providers. The categories below describe what we collect and why.

Information about delivery recipients

Shippers provide information about the people and places involved in a delivery, which may include a recipient’s name, address, and phone number. Shippers are responsible for having a lawful basis to share that information with us so we can complete the delivery on their behalf.

Sensitive information

Precise geolocation and government-identification data are treated as sensitive. We use them only as needed to provide and secure the Platform — for example, to verify a driver’s identity and eligibility and to support live tracking, navigation, safety, and dispute resolution — and not to infer characteristics about you for advertising.

Driver verification evidence is collected in provider-hosted flows, not through a Shipr document-upload flow. Checkr currently handles background and motor-vehicle screening. Persona is the planned identity and license provider, and MeasureOne is the planned vehicle and insurance provider; those two integrations are not yet connected. If enabled, their own notices will describe the evidence they collect, and Shipr expects to receive normalized statuses, provider references, and limited result information needed for eligibility decisions rather than raw verification files.

Shipr may retain historical application documents and legacy identity-verification records created under earlier product flows. Those records are read-only historical evidence: Shipr does not accept new verification-document uploads or start new legacy identity sessions, and those historical records are not treated as Persona or MeasureOne verification.

Stripe-hosted Connect payout onboarding is a separate flow. Its identity, KYC, and risk requirements can vary by account and circumstance, and Stripe may conditionally require a live selfie and use biometric matching to compare it with a government-issued photo ID. For that Connect flow, Shipr stores the connected-account identifier, onboarding/readiness status, and outstanding requirement identifiers; Shipr does not store Stripe’s selfie image or biometric template.

We use personal information to:

• Provide, operate, and maintain the Platform, including creating routes, matching offers to drivers, navigation, and live delivery tracking;
• Process payments to Shippers and payouts to Drivers, and detect and prevent fraud, abuse, and unauthorized transactions;
• Verify identity and confirm driver eligibility through provider-owned background, identity, license, insurance, and vehicle checks when those services are enabled;
• Promote safety and security — investigating incidents, supporting drivers and recipients, and protecting the integrity of the Platform;
• Provide customer support and respond to your requests, incident reports, claims, and disputes;
• Send you transactional and service communications (including SMS where you have consented — see our SMS Consent Policy);
• Comply with legal, tax, and regulatory obligations, and enforce our agreements; and
• Analyze usage and improve, develop, and test Platform features and reliability.

Where required by law, we rely on an appropriate legal basis for each use — typically performance of our contract with you, our legitimate interests in operating a safe and reliable Platform, your consent (for example, SMS messaging), or compliance with a legal obligation.

Location data is central to how the Platform works. With a Driver’s permission, the driver app collects precise location when Precise Location is enabled, or approximate/reduced-accuracy location when that is the device setting. Collection may continue in the background as described below so that we can provide the core delivery service.

Why we collect background location

• Showing a Driver nearby delivery offers and routing them to pickup and drop-off points;
• Providing live, in-transit tracking and accurate arrival estimates to Shippers and recipients;
• Confirming arrival at stops and documenting completed deliveries; and
• Supporting safety and resolving disputes or claims (for example, confirming a route was followed).

Background location is collected during an active location session while a Driver is On Shift (online) or completing an active delivery, including while the driver uses another app such as a navigation app. On iOS, While Using permission is sufficient to go On Shift and begin that indicator-visible session; the system may offer an optional Always upgrade for added continuity. Declining the upgrade does not block offers, work, earnings, or account access. Collection stops when the Driver is Off Shift and has no active delivery. Shippers and recipients do not have their phones tracked in the background; they see the driver’s progress for an active delivery.

Your control

You can grant or revoke location and background-location permission at any time in your device settings. Denying all location access may limit nearby matching, navigation, and live progress tracking, but Always permission is optional and location permission is not required to view existing earnings, manage payout settings, use account controls, or contact support. We do not sell location data, and we do not use it for advertising.

We share personal information only as described below.

• To complete a delivery: relevant details are shared between the Shipper, the assigned Driver, and (as needed) the recipient — for example, a Driver receives pickup/drop-off addresses and recipient contact details; a Shipper sees the Driver’s first name, vehicle, live location for the active delivery, and proof of delivery.
• Service providers (processors) who perform services on our behalf under contract, including: authentication and account management (Clerk, including supported sign-in providers); payment processing and payouts (Stripe, including Stripe Connect); driver background and motor-vehicle checks (Checkr); identity and license verification if enabled (Persona, planned and not yet connected); vehicle and insurance verification if enabled (MeasureOne, planned and not yet connected); mapping and navigation (Mapbox); cloud hosting and access-restricted file storage; transactional email delivery (Resend); push-notification delivery (Expo and the applicable device-platform service); and error monitoring and analytics (Sentry).
• For legal, safety, and compliance reasons: to comply with law, legal process, or lawful government requests; to enforce our terms; and to protect the rights, property, or safety of users, the public, or Shipr (including fraud prevention and insurance/claims administration).
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent or at your direction; and as aggregated or de-identified information that does not reasonably identify you.

Service providers that process personal information for Shipr must protect it to at least the same standard described in this Policy and required by applicable platform rules, use it only for the contracted services and permitted purposes, and delete or return it when it is no longer needed, subject to applicable legal-retention requirements.

We keep personal information for as long as needed to provide the Platform and for legitimate business and legal purposes. General guidelines:

• Profile and account-access information: while your account is active. After an account-deletion request, removable profile and contact data is normally deleted or de-identified within approximately 30 days. Limited account identifiers may be retained longer only where needed for fraud prevention, compliance, a claim or dispute, a legal hold, or another legal obligation.
• Transaction and tax records: for the period required by financial and tax law.
• Raw location history: typically retained for 30–90 days for operational, safety, and dispute purposes, and longer only when tied to an open claim, dispute, investigation, or legal hold. Stop arrival/completion coordinates that document a completed delivery may follow the completed-delivery evidence schedule below.
• Completed-delivery evidence: proof-of-delivery photos or signatures and relevant stop timestamps or coordinates are retained only as needed to document the transaction, address safety matters, resolve claims or disputes, and meet legal, insurance, or accounting obligations.
• Verification data: provider-controlled evidence follows the provider’s retention terms. Shipr retains normalized statuses, provider references, and limited result information only as needed for eligibility, compliance, fraud prevention, claims, disputes, or law. Historical files from earlier Shipr verification flows are deleted or de-identified when no longer required or permitted.

When information is no longer needed, we delete or de-identify it. We may retain limited information as necessary to comply with law, prevent fraud, or enforce our agreements.

Depending on where you live, you may have rights regarding your personal information, including the right to access or know, correct, delete, and receive a portable copy of your information, and to opt out of any "sale" or "sharing" of personal information or targeted advertising. You also have the right not to be discriminated against for exercising these rights.

U.S. state privacy rights

Residents of California (CCPA/CPRA) and of other states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Indiana (Indiana’s Consumer Data Protection Act takes effect January 1, 2026), among others — may exercise the rights above to the extent the applicable law provides. As stated, we do not sell personal information or share it for cross-context behavioral advertising, and we use sensitive information (such as precise geolocation and identification data) only to provide and secure the Platform.

How to exercise your rights

You can exercise many choices directly in the app — including deleting your account (see Section 8) and managing notification and location permissions. To make a privacy request, contact us at privacy@shiprsolutions.com. We will verify your request as required by law and respond within the applicable timeframe. You may use an authorized agent where permitted, and you may appeal a decision by replying to our response; if you have concerns, you may also contact your state attorney general.

You can request deletion of your account and associated personal information at any time. Drivers can delete their account directly in the app (Account → Delete account); Shippers and other users may request deletion through their account settings or by contacting us.

When you delete your account, we begin deletion immediately — your account is closed and can no longer be used — and we remove or de-identify removable personal information (including your profile, any historical application files held by Shipr, and raw location history) within approximately 30 days, except information we are required or permitted to retain. Limited retained information may include completed-delivery evidence, transaction, payment, payout, and tax records, fraud-prevention, safety, and compliance data, and information subject to a legal hold or tied to an open claim or dispute. Verification providers handle information in their systems under their own retention duties and applicable law. Deletion does not forfeit earnings already recorded: a valid payout attempt may continue to the payout destination already on file, but timing and successful delivery depend on the payment provider and a valid destination. If a recorded payout remains unresolved after deletion, contact support@shiprsolutions.com for help. To use Shipr again after deletion, you would need to create a new account.

We use administrative, technical, and physical safeguards designed to protect personal information — including encryption in transit, access controls, and private, access-restricted storage for sensitive files (historical application files and proof-of-delivery media are served only through short-lived, signed links). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Platform is intended for adults and is not directed to children. Drivers must be adults eligible to work and drive. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

The Platform is operated in the United States and intended for use there. If you access it from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those of your location.

The Platform may link to independent third-party sites or services that you choose to visit outside Shipr. Those independent services are governed by their own privacy policies, not this one, and we encourage you to review them. Service providers processing personal information on Shipr’s behalf remain subject to the protections described in Section 5.

On our websites and the organization portal, we use cookies and similar technologies that are strictly necessary to operate the service — for example, to keep you signed in, maintain your session, remember your preferences (such as light/dark theme), and protect against fraud and abuse. These are set by us or by our service providers (such as our authentication provider) to deliver the features you request.

We do not use cookies for cross-context behavioral advertising, and we do not sell information collected through cookies. Where we use any analytics to understand and improve performance, we limit it to operating and improving the Platform. You can control cookies through your browser settings, though disabling strictly necessary cookies may prevent you from signing in or using parts of the service.

Where required by law, we honor recognized opt-out preference signals (such as the Global Privacy Control) as a request to opt out of any “sale” or “sharing” of personal information.

Shipr does not currently provide a user-facing generative-AI assistant, use generative AI to communicate with users, or use generative AI to make driver eligibility, suspension, or deactivation decisions. AI-assisted dispatch shown on our public roadmap is a planned capability, not a current Platform feature.

Current matching and dispatch behavior uses defined product rules together with Driver choices and, where applicable, authorized staff actions. Final adverse eligibility and account decisions are subject to human review and the notice and appeal processes described in our Driver Eligibility and Deactivation & Appeals policies.

Before introducing a user-facing generative-AI feature or materially changing automated decision-making, we will review its privacy and safety risks, update this Policy and other notices as appropriate, and implement safeguards suitable for the feature before making it available.

We may update this Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice (for example, in the app). Your continued use of the Platform after an update means you acknowledge the revised Policy.

If you have questions or requests about this Policy or your personal information, contact us:

• Privacy: privacy@shiprsolutions.com
• Support: support@shiprsolutions.com
• Shipr LLC