1. Roles: controller vs processor

Shipora acts as a data controller for information about account owners, billing contacts, website visitors, and individuals who contact us directly.

When a business uses Shipora to manage deliveries, we generally act as a data processor for personal data about that customer's drivers, dispatchers, and delivery recipients. The customer determines purposes and means of that processing and must provide appropriate notices to individuals.

2. Lawful bases (summary)

Where GDPR applies, we rely on:

• Contract — to provide the Service you or your organization requested;
• Legitimate interests — security, fraud prevention, product improvement, and B2B communications, balanced against your rights;
• Consent — where required for non-essential cookies, certain marketing, or optional features;
• Legal obligation — tax, accounting, and regulatory compliance.

3. Data subject rights

Depending on your location, you may have rights to access, rectify, erase, restrict, object to processing, data portability, and withdraw consent (without affecting prior lawful processing).

Submit requests to privacy@shipora.com. We may verify your identity. We respond within timeframes required by law (generally one month under GDPR, extendable where permitted).

You may lodge a complaint with your local supervisory authority. We encourage you to contact us first so we can address your concern.

4. International transfers

We may process and store information in the United States and other countries where we or our subprocessors operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum.

Request copies of relevant transfer mechanisms by emailing privacy@shipora.com.

5. Subprocessors

We use vetted service providers for hosting, payments, email, SMS, maps, analytics, and support. They process data only on our instructions under contractual data-protection terms.

Categories include authentication, cloud infrastructure, payment processors, push notifications, mapping and routing, messaging (email/SMS), and customer support tools. Details are in our Privacy Policy at /privacy-policy.

6. Data Processing Agreement (DPA)

Business customers who require a GDPR-compliant data processing agreement may request our standard DPA at privacy@shipora.com or as referenced in an Order Form. The DPA governs processor obligations for Customer Data.

7. Security & breach notification

We implement administrative, technical, and organizational measures designed to protect personal data. No system is perfectly secure.

Where we are processor, we notify customers of personal data breaches affecting Customer Data in accordance with our DPA and applicable law. Where we are controller, we notify individuals and authorities as required.

8. Retention

We retain personal data only as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. See the Privacy Policy for account deletion and backup retention timelines.

9. Contact

GDPR and privacy requests: privacy@shipora.com

5th & Melody LLC, doing business as Shipora

Shipora is a brand of 5th & Melody LLC.

North Carolina and Delaware, United States

Email: privacy@shipora.com

Support: support@shipora.com

Phone: +1 (919) 241-8852