§01
Who We Are
- Shipify ("Shipify", "we", "us") operates the Shipify platform, website and apps (the "Platform"), a technology service that connects independent suppliers, dropshippers and delivery riders and processes orders, deliveries and wallet entries between them.
- For any question about this policy or your information, contact us through the Contact page or Shipify's official WhatsApp support number.
§02
Information We Collect
- Account information: your mobile number (your permanent login identity) and your password (stored only in encrypted, hashed form).
- Profile information you add after sign-up: your full name, city, alternate mobile number, and, depending on your account type, your store name, store page link and store contact number (dropshippers), your shop name, address, map location, store front or products stock photographs (suppliers), and your payout account details.
- Order information: product, quantity and prices, and the end customer's name, mobile numbers, delivery address, city and location link, which a dropshipper enters to have an order delivered.
- Payment information: deposit and top-up amounts, transaction references and proof screenshots, payouts, and every wallet ledger entry together with its source.
- Delivery information: rider location while on duty or on an active delivery, delivery confirmations, cash collected, delivery photographs and proofs.
- Usage and technical information: login sessions, device and browser details, IP address, activity and audit logs, notifications and support messages.
- Identity check: a live selfie, photographs of both sides of your Computerised National Identity Card (CNIC) and your CNIC number, kept in private storage that only the Shipify team members who check identities can open, through short-lived links.
- Error reports: when a page fails, the error message, the page address, your account (if signed in) and your browser type, so the problem can be fixed.
- Website visit information: on the public pages of the website (home page, guides, contact, legal and status pages, the order tracking search page and the sign-up page) we use Google Analytics to count visits. It receives the page address without any search parameters, the page title, the page or site you came from, the type of device, browser and language, and an approximate location (country or city) worked out from your IP address. It is not used on signed-in pages, on order tracking links or in the apps, and it never receives what you type into a form. Google Analytics is not used for advertising, and we do not turn on its advertising or audience features.
- Advertising measurement (only when Shipify runs its own ads on Meta, which includes Facebook and Instagram, or on TikTok): on the public pages and the sign-up page, a Meta Pixel and a TikTok Pixel tell those companies that a visit came from one of our ads and what action followed, such as viewing a page, pressing a sign-up button or submitting the sign-up form. They receive the page address (these pages carry no personal details in it, only campaign tags), which buttons were pressed, the type of device and browser, and an identifier from their own cookie if you have one, and they may connect it to your account with them under their own policies. They do not receive your name, mobile number, password, order or wallet information, and they are not used in the apps or on signed-in pages or order tracking links.
§03
How We Use Information
- To create and run your account, verify your mobile number and confirm your identity and eligibility.
- To process orders, arrange pickup and delivery, calculate prices, Platform Fees, delivery charges, earnings and profits, and keep every wallet balance correct.
- To check every wallet entry against its source, detect errors, fraud, abuse and misuse of the Platform, and protect users and Shipify.
- To send you service notifications, reminders and support replies in the app, by push notification or by WhatsApp link.
- To keep financial, tax and audit records, resolve disputes under the Terms and Conditions, and comply with the law.
- To improve the Platform, for example by measuring delivery times, return rates and product demand in a form that does not identify you.
- To understand which public pages and guides visitors find useful and how they reach us, using the website visit information above in combined form.
§05
Storage and Security
- Information is stored in encrypted databases with row-level access controls. Passwords are never stored in readable form.
- Financial records (wallet ledger entries, deposits, payouts) are never edited or deleted: corrections are made by new entries with a reason, so the history stays complete.
- No system is completely secure. You are responsible for keeping your password secret and for everything done with your account. Tell us at once if you suspect misuse.
- Every action of the Shipify team is recorded in an audit log, and a read-only copy of that log is kept that cannot be changed or deleted by anyone, including the team.
- Security incidents: if personal information is lost or accessed without permission, we act at once to contain it, and we tell affected users within 72 hours of finding out, together with what was affected and what they should do, as required under the Prevention of Electronic Crimes Act 2016 and other applicable law.
§06
How Long We Keep Information
- We keep account, order and financial records for as long as your account is active and afterwards for as long as needed for tax, accounting, audit, dispute and legal purposes (at least the period required by the Income Tax Ordinance 2001 and the Sales Tax Act 1990).
- Business records are marked inactive instead of being erased, so that orders, wallets and disputes can always be traced.
- Data retention periods. Read notifications are deleted automatically after 180 days and all notifications after 365 days; error reports after 90 days; password-reset attempts after 30 days; backup records after 365 days; archived to-do items after 180 days. Wallet ledger entries, orders, agreements, Terms acceptances and the audit log copy are kept permanently, because they are financial and legal records. Identity-check photographs are kept while the account exists and for as long as needed afterwards to resolve fraud, disputes or legal claims.
- Website visit information is kept in Google Analytics only for the retention period set in our Analytics account and is then deleted automatically.
- Backups of the database are kept on Shipify's own computer (the newest three daily copies only) and checked every four weeks by a restore drill.
§07
Your Choices and Rights
- You can view and update your profile information at any time, except your login mobile number, which is your permanent identity.
- You can turn phone notifications on or off from your account.
- Analytics choices: Google Analytics uses a small cookie or similar identifier to tell one visit from another. We do not measure visitors, with Google Analytics or the advertising tags, whose browser sends a "Do Not Track" or Global Privacy Control signal. You can also block or delete cookies in your browser settings, use Google's opt-out browser add-on, or change your ad settings in your Facebook, Instagram or TikTok account to limit ads based on your visits to other sites; the Platform keeps working. The cookies and storage you need to stay signed in and keep the site secure are separate and are not used for analytics.
- You can ask to close your account through support. Closing an account does not erase records we must keep, and any balance is settled under the Terms and Conditions.
§08
Children
- The Platform is only for people aged 18 or over who can enter into a binding contract. We do not knowingly collect information from children.
§09
Changes to This Policy
- We may update this policy. When we make a material change, we update the version shown above and ask you to accept the new version before you continue using the Platform.
Other documents