Privacy Policy

Last updated: May 2026

1. Who We Are

ShipSherlock is a shipping invoice auditing service operated out of Ontario, Canada. We help Canadian e-commerce businesses recover overcharges from carriers like UPS, FedEx, and Canada Post. This policy explains how we collect, use, and protect your personal information in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Information We Collect

We collect the following types of information when you use our service:

  • Account information: Your name, email address, and business name when you sign up.
  • Payment information: Credit or debit card details collected via Stripe at signup. We do not store your full card number on our servers — Stripe handles all payment data securely.
  • Carrier account credentials: API keys or account credentials you provide so we can access your shipping invoices from UPS, FedEx, and/or Canada Post.
  • Shipping data: Invoice details, tracking numbers, shipment weights, dimensions, surcharges, and delivery timestamps pulled from your carrier accounts.
  • Usage data: How you interact with our platform, including pages visited and features used.

3. How We Use Your Information

We use the information we collect to:

  • Audit your shipping invoices for billing errors and overcharges.
  • File refund claims with carriers on your behalf.
  • Calculate and bill our fee (50% of recovered credits).
  • Communicate with you about your account, claims, and recovered credits.
  • Improve and maintain our service.

4. Carrier Account Access

When you connect a carrier account, you authorize ShipSherlock to access your shipping invoices and shipment data through the carrier's API. We use this access solely to audit invoices and file refund claims. We do not modify your shipping settings, create shipments, or make any changes to your carrier account beyond filing claims for billing errors.

5. Payment Processing

All payment processing is handled by Stripe, a PCI-DSS compliant payment processor. Your card information is transmitted directly to Stripe and is never stored on our servers. We only receive a tokenized reference to your payment method. Your card is charged only when we successfully recover credits on your carrier account.

6. Third-Party Services

We use the following third-party services to operate ShipSherlock:

  • Supabase: Database and authentication infrastructure. Your account data and audit records are stored securely in Supabase.
  • Stripe: Payment processing. Handles all credit card data and billing.
  • Carrier APIs (UPS, FedEx, Canada Post): Used to retrieve your shipping invoices and file refund claims.
  • Vercel: Web hosting and application deployment.

Each of these providers has their own privacy policy and security practices. We select providers that maintain strong data protection standards.

7. Cookies

We use essential cookies to keep you logged in and maintain your session. We may also use analytics cookies to understand how our service is used. We do not use cookies for advertising or sell cookie data to third parties.

8. Data Retention

We retain your account and shipping data for as long as your account is active. If you close your account or disconnect all carrier accounts, we will delete your personal data within 30 days of account closure. Aggregated, anonymized data that cannot identify you may be retained for analytical purposes.

9. Data Security

We take reasonable technical and organizational measures to protect your information, including encryption in transit (TLS/SSL), encrypted storage of sensitive credentials, and access controls limiting who can view your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Your Rights Under PIPEDA

As a Canadian user, you have the right to:

  • Access the personal information we hold about you.
  • Correct any inaccurate or incomplete information.
  • Withdraw consent for us to use your data by closing your account or disconnecting your carrier accounts.
  • Request deletion of your personal information, which we will process within 30 days.
  • File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice on our website. Your continued use of ShipSherlock after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Email: support@shipsherlock.com