1. Who we are

5th & Melody LLC, doing business as Shipora (North Carolina and Delaware, United States) is the data controller for account holders, website visitors, and people who contact us directly.

When a business uses Shipora for deliveries, we usually process driver, dispatcher, and recipient data as a processor on that customer's instructions. The customer's privacy notice governs those individuals.

Privacy contact: privacy@shipora.com. GDPR summary: /gdpr.

2. App privacy labels (what the mobile app collects)

The Shipora Driver app collects data needed to run deliveries—not for third-party advertising or "tracking" as Apple defines it (linking data with third-party ad networks or data brokers).

The categories below match Apple's App Privacy "data types." We collect each type only for the purposes listed. Data is generally linked to your account or device.

• Contact info — Name and email address (account sign-in via our authentication provider); phone number when your employer or profile includes it; physical addresses shown on assigned orders (pickup and delivery stops). Used for app functionality, account management, and customer support.
• Location — Precise location (GPS latitude/longitude) while you are on duty, including in the background when enabled, so dispatch and customers can see delivery progress. Coarse location may be inferred from IP address on network requests. Used for app functionality only.
• User content — Photos you take for proof of delivery; signatures captured on screen; delivery notes; in-app messages you send to dispatch or about an order. Used for app functionality and customer support.
• Identifiers — User or account IDs (for example Clerk user ID, driver ID, business ID) and push-notification device tokens so we can deliver alerts. Used for app functionality and security.
• Usage data — Product interaction such as feature usage, taps, session activity, and security logs. Used to operate, secure, and improve the app—not for third-party advertising.
• Diagnostics — Crash logs and performance data when available (from the app, our infrastructure, or platform crash reports). Used to fix bugs and maintain reliability.

Optional in-app feedback or support messages you choose to send may include additional contact details. That data is used only to respond to you.

3. Web console, website & billing

In addition to the mobile categories above, the Shipora dispatch web console and marketing website may process:

• Account & billing — Company name, role, plan, and payment metadata. Card numbers are entered with our payment processor; we do not store full payment card numbers.
• Operational data — Orders, routes, assignments, integration payloads from POS systems you connect (for example Square), and configuration you enter.
• Website cookies & analytics — Cookie identifiers and similar technologies on shipora.com for basic site operation and, where enabled, aggregated analytics. See cookie controls on our marketing site for California opt-out choices.

4. What we do not collect

Unless you voluntarily provide it in a support request, the Shipora Driver app does not collect:

• Health, fitness, or medical data;
• Contacts from your phone address book;
• Browsing or search history outside the app;
• Advertising data for cross-app tracking;
• Sensitive categories (race, religion, sexual orientation, etc.);
• Biometric data, hand/head movement, or environment scanning;
• Audio recordings of your voice (the app may play alert sounds but does not record conversations);
• Your device's email or SMS inbox—only messages you send inside Shipora;
• Credit scores or detailed financial profiles.

Age-restricted delivery workflows may require confirming legal age or scanning an ID when your employer enables those steps. That information is stored as part of the delivery record for compliance, not for advertising.

5. Mobile app permissions

The driver app requests OS permissions that match the data above:

• Location (while in use and, when you go on duty, background/Always) — required for live tracking and ETAs;
• Camera — required for proof-of-delivery photos when your business requires them;
• Notifications — optional but recommended for new orders and messages when the app is closed.

You can change permissions in iOS or Android settings. Disabling location or camera may prevent you from going on duty or completing deliveries that require proof of delivery.

6. How we use information

We use personal information to provide and secure the Service, authenticate users, enable dispatch and proof of delivery, send operational notifications, bill business accounts, support customers, improve performance, prevent fraud, and comply with law.

We do not use app data for third-party advertising, and we do not sell personal information.

7. Legal bases (EEA, UK & Switzerland)

Where GDPR applies, we rely on contract (providing the Service), legitimate interests (security, improvement, balanced against your rights), consent where required (for example optional marketing cookies), and legal obligation. Organizations using Shipora for end-user data must establish their own legal basis for their drivers and customers.

8. When we share information

We share data with service providers under contract, including:

• Authentication (Clerk) — sign-in and account management;
• Cloud hosting and databases — storing operational data;
• Maps and routing (for example Google Maps) — addresses, geocoding, and ETAs;
• Push notification delivery — Apple Push Notification service, Firebase/Google on Android;
• Email, SMS, and voice partners when enabled (for example customer or driver notifications);
• Payment processors — subscription and billing for business accounts;
• Integration partners you authorize (for example Square for order sync);
• Professional advisers and authorities when required by law;
• Successors in a merger or acquisition, subject to this policy or notice.

We do not share data with data brokers for advertising.

9. When we access your information

Staff access is limited to support you request, fixing rare automated errors with minimum necessary data, security investigations, and legal compliance—as described in our Terms of Service.

10. International transfers

We may process data in the United States and other countries. Where required, we use Standard Contractual Clauses and related safeguards. Contact privacy@shipora.com for transfer details.

11. Retention & deletion

We retain data while your account is active and as needed for legal and business purposes. After cancellation, operational data is removed from active systems within about thirty (30) days and backups within about sixty (60) days, unless law requires longer retention.

Drivers and dispatch users may delete their account in the app or web console where available, or email privacy@shipora.com. Drivers can request deletion at /delete-account. Business administrators may request organization deletion per /cancellation-policy.

12. Your privacy rights

Depending on location, you may have rights to access, correct, delete, restrict, object, or port data. Contact privacy@shipora.com. We verify identity and respond within legal timeframes.

California residents have additional rights under CCPA/CPRA, including opt-out of certain "sharing" for cross-context behavioral advertising on our marketing site via cookie controls.

If you subscribed through the Apple App Store or Google Play, subscription management and some deletion flows may also be available through those platforms.

13. Security & children

We use administrative, technical, and organizational safeguards. No method is 100% secure. Report suspected compromise to privacy@shipora.com.

The Service is not directed to children under 16. Contact us if you believe we collected a child's data without appropriate consent.

14. Subprocessors & changes

A current subprocessor list is available on request at privacy@shipora.com.

We may update this policy at /privacy-policy with a new "Last updated" date. Material changes include additional notice where required. If we change what the mobile app collects, we will update Apple and Google privacy labels to match.

15. Contact

Privacy requests: privacy@shipora.com

5th & Melody LLC, doing business as Shipora

Shipora is a brand of 5th & Melody LLC.

North Carolina and Delaware, United States

Email: privacy@shipora.com

Support: support@shipora.com

Phone: +1 (919) 241-8852