FShipp — Privacy Information (Privacy & Cookies)

Last updated: 18 September 2025

1. Personal identification information

Contents

Personal-Data Controller
What Personal Data We Collect
Why We Process Your Data
Legal Bases (EEA/UK)
Cookies & Similar Technologies
Who Else Receives Your Data
Your Privacy Rights & How to Exercise Them
Age Limitation
International Data Transfers
U.S. State Privacy Notice
Data Security
Data Retention
Changes to this Policy
Contact Us

1) Personal-Data Controller

The Service is provided by APH Services LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA (“FShipp”, “we”, “our”, “us”).

2) What Personal Data We Collect

Category	Examples	How we obtain it
Identifiers	Name, email, account ID, country/region	You provide when creating an account, filing a claim, or contacting support
Payment & Subscription	Last 4 digits & expiry, billing address, payment token, plan, 7-day trial start/end, charges, credits/refunds	Via our payment processors — we never store full card numbers
Claims Documentation	Order confirmations, receipts/invoices, retailer details, delivery charges, purchase date, uploaded screenshots/PDFs	You upload via the claim portal or by email/chat
Device / Usage	IP, time-zone, language, browser/OS, referral URL, pages visited, event & error logs, crash reports	Automatically via cookies, SDKs and server logs
Marketing & Preferences	Newsletter/SMS opt-in, ad-campaign source/medium, in-app events	Your choices; analytics & marketing partners
Support/Feedback	Emails, chat transcripts, satisfaction signals	You provide during interactions with our team

We do not knowingly collect: children’s data (<18), biometric templates, or full credit-card numbers.

3) Why We Process Your Data

Purpose	Typical processing activities	Main data used
Provide & operate the Service	Account creation/login; claims workflow; apply Subscription Credits and refunds; troubleshoot	Identifiers, Claims, Device/Usage
Billing & subscriptions	Start 7-day free trial; bill introductory month; renewals; credits/refunds; chargebacks	Identifiers, Payment
Customer support	Respond to email/chat; investigate issues; service notices	Identifiers, Support, Claims
Improve & secure	Analytics, A/B tests, crash reports, fraud detection	Device/Usage, Marketing
Marketing	Product updates/offers; (with consent) personalised ads/retargeting	Hashed identifiers, Device/Usage, Marketing
Legal & compliance	Tax/accounting records; lawful requests; enforce Terms	All as relevant

4) Legal Bases (EEA / UK)

Contract (GDPR Art. 6(1)(b)) — run your account, process claims/credits/refunds, billing, support.
Legitimate interests (Art. 6(1)(f)) — analytics, security/anti-fraud, direct marketing of similar services.
Consent (Art. 6(1)(a)) — non-essential cookies, personalised ads, newsletters/SMS.
Legal obligation (Art. 6(1)(c)) — tax/accounting retention, lawful requests.

You may withdraw consent or object to legitimate-interest processing at any time (see §7).

5) Cookies & Similar Technologies (Cookie Policy inside)

We use first-party and third-party cookies, pixels, local storage and SDKs to:

keep you logged in and remember preferences,
measure traffic, performance and conversions,
personalise advertising (only with consent).

Categories & legal bases (EEA/UK):

Strictly necessary — login, security, checkout, cookie banner (Contract / Legitimate interest).
Analytics / Performance — e.g., Google Analytics 4, Hotjar (Consent).
Functional — language, claim-form progress, chat status (Consent).
Marketing / Ads — e.g., Google Ads, Meta Pixel, Microsoft Advertising (Consent; Legitimate interest for comparable product marketing where permitted).

Illustrative cookie table (examples):

Name	Provider	Type	Purpose	Expiry
__Secure-session	fshipp.com	First-party, necessary	Maintains account session	30 min idle / 7 days max
fshipp_cookie_consent	fshipp.com	First-party, necessary	Stores your cookie choices	6 months
_ga	Google	Third-party, analytics	Distinguishes users for site analytics	13 months
hjSessionUser#######	Hotjar	Third-party, analytics	Heatmap/session analysis	12 months
_fbp	Meta	Third-party, marketing	Retargeting on FB/IG	3 months
_uetvid	Microsoft Ads	Third-party, marketing	Remarketing audience	13 months
stripe_sid	Stripe	Third-party, necessary	Secure payments & fraud prevention	Session

Managing your choices:

Open Cookie Preferences (footer) to grant/withdraw consent by category and view the live vendor list. You can also use browser settings to delete/block cookies. GA opt-out: https://tools.google.com/dlpage/gaoptout.

Do-Not-Track: no industry standard yet; please use Cookie Preferences.

6) Who Else Receives Your Data

Partner type	Examples	Why
Payments	Stripe, Adyen	Card tokenisation, charges, credits/refunds, anti-fraud
Cloud/hosting	AWS, Google Cloud	Infrastructure & backups
Analytics/product	Google Analytics/Tag Manager, Amplitude, Hotjar	Product analytics & UX
Comms	HubSpot/Helpdesk, Customer.io (email), Twilio (SMS), chat widget	Support & service messages
Marketing/ads	Google Ads, Meta, Microsoft Advertising	Ads/retargeting (with consent)
Advisors/authorities	External counsel, auditors; courts/tax authorities	Compliance and lawful requests

We do not sell your personal data for money. Some ad-tech “sharing” may be deemed a “sale”/“sharing” in certain U.S. states — see §10 for opt-out.

7) Your Privacy Rights & How to Exercise Them

EEA/UK	Certain U.S. states	How to exercise
Access; Rectify; Erase; Restrict; Portability; Object; Withdraw consent; lodge a complaint with a DPA	Access/Know; Correct; Delete; Portability; Opt-out of Sale/Sharing/Targeted Ads; Limit Sensitive PI; Appeal	Email privacy@fshipp.com (or help@fshipp.com). We verify identity before acting.

We aim to respond within 30 days (or 45 days where allowed).

8) Age Limitation

The Service is intended for adults 18+. If you believe a minor provided data, contact us for deletion.

9) International Data Transfers

As a U.S. company, we may process/store data in the United States or other countries where our processors operate. For transfers from the UK/EEA to countries without an adequacy decision, we use Standard Contractual Clauses (plus the UK Addendum) and additional safeguards as required.

10) U.S. State Privacy Notice (California + others)

Residents of California, Colorado, Connecticut, Utah, Virginia, and similar jurisdictions have additional rights, including to:

Opt out of “sale”/“sharing” for targeted ads (use the “Do Not Sell / Share” link in the footer),
request category disclosures for the last 12 months, and
appeal a denial of a privacy request. A dedicated U.S. States Privacy Notice is available on request.

11) Data Security

TLS 1.2+ in transit; encryption at rest for sensitive artefacts (e.g., claims uploads).
Access to production systems restricted to authorised staff with MFA.
Regular reviews, logging/monitoring, and an incident-response plan.

12) Data Retention

We keep personal data only as long as necessary for §3 purposes or to meet legal/accounting duties:

Account & billing records: 6 years (UK tax rules)
Claims documentation: 7 years after case closure
Marketing opt-out lists: kept to honour your request
Analytics raw logs: 13 months, then aggregated or deleted

On expiry, data is deleted or anonymised.

13) Changes to this Policy

We may update this Policy. Material changes will be announced by:

updating the “Last updated” date above, and
emailing active members or showing an in-app notice.

Your continued use after changes take effect means you accept them.

14) Contact Us

FShipp — APH Services LLC

16192 Coastal Highway, Lewes, DE 19958, USA

✉ privacy@fshipp.com · help@fshipp.com

📞 +44 330 822 0973 (Mon–Fri 9am–6pm UK time)

Footer links to include: Privacy & Cookies (this page) • Terms of Service • Cancel subscription • Cookie Preferences • Do Not Sell / Share (for U.S. visitors)