Privacy Policy

1.Who we are

ShipLane is a shipping rate marketplace and point-of-sale platform operated by BoxHero Logistics Corp, a New York corporation with offices at 905 Remsen Avenue, Brooklyn, NY 11236 ("BoxHero," "we," "us," or "our"). In this policy, the "Services" means our websites (including ship.boxhero.com and boxhero.com), our web and mobile applications, our Partner Hub counter software, our application programming interfaces, and the customer support channels we operate.

This Privacy Policy explains what personal information we collect through the Services, why we collect it, who we give it to, and what control you have over it. It applies to individual shippers who buy labels directly from us, to owners and staff of Partner Hub locations, to people who visit our sites, and to people whose information reaches us because someone shipped a package to them.

Our Terms of Service and, for Partner Hub locations, our Partner Hub Agreement govern your use of the Services. This policy is incorporated into both.

2.Our two roles

We handle personal information in two different capacities, and the difference matters for how you exercise your rights.

2.1 When we act for ourselves

When you create a ShipLane account, fund a wallet, buy a label directly from us, contact support, or browse our sites, we decide how and why your information is used. In privacy law terms we are the "business" or "controller" for that information, and the rights described in Sections 12 and 13 apply to us directly.

2.2 When we act for a Partner Hub

Partner Hubs are independently owned retail pack-and-ship stores that use our counter software to serve walk-in customers. When a Hub enters a walk-in customer's information into our system, the Hub decides what to collect and why. We process that information on the Hub's behalf as a "service provider" or "processor," under contract, and we do not use it for our own marketing.

If you are a walk-in customer of a Partner Hub and you want to exercise a privacy right over your record, contact the Hub first. If you contact us instead, we will forward your request to the Hub and help them respond.

3.Information we collect

We collect the categories below. Not every category applies to every user, and how much we collect depends on how you use the Services.

3.1 Information you give us

3.2 Information generated by your use of the Services

• Transaction records. Labels purchased and voided, wallet top-ups, balances, refunds, carrier billing adjustments, invoices, and the pricing applied to each shipment.
• Tracking and delivery data. Scan events, transit status, exception codes, delivery date and time, signature records where applicable, and proof-of-delivery photographs captured by the carrier. Some carriers photograph a doorstep, porch, mailroom, or building entrance as proof of delivery; those images may show property, and occasionally a person who happens to be present.
• Device and usage data. IP address, browser type and version, operating system, device identifiers, screen size, referring page, pages viewed, features used, search terms entered in our app, timestamps, and crash and error logs.
• Approximate location. Derived from your IP address, and from origin and destination postal codes you enter. We do not collect precise GPS location from consumers. Partner Hub counter devices may report a fixed store location for fraud and support purposes.
• Security and fraud signals. Login history, failed login attempts, session identifiers, device fingerprints, and patterns we use to detect account takeover, stolen cards, and label fraud.

3.3 Information from third parties

• Carriers and our rating partners send us rates, service availability, tracking events, delivery confirmations, billing adjustments after a package is reweighed or remeasured, and claim outcomes.
• Address validation services return standardized and corrected addresses, residential or commercial classification, and deliverability flags.
• Our payment processor sends us payment status, dispute and chargeback notices, payout status, and verification results.
• E-commerce and marketplace integrations you connect, such as a store platform or order management system, send us order and address data so we can create labels.
• Partner Hubs send us shipment records for their walk-in customers, as described in Section 2.2.
• Advertising and analytics providers send us aggregate campaign performance and, where you have consented, information about how you arrived at our site.

4.Information about recipients and other people

Shipping is unusual among online services: most of the personal information in a shipment record belongs to someone who is not our user. When you buy a label, you give us the recipient's name, address, and often their email address and phone number.

You are responsible for having the right to give us that information. By submitting recipient details you confirm that you obtained them lawfully and that you are permitted to disclose them to us and to the carrier for the purpose of delivering the shipment. This is a promise you make to us under Section 9 of the Terms of Service.

We use recipient information only to produce the label, complete the delivery, send delivery notifications the sender requested, respond to recipient inquiries, process claims, and meet legal obligations. We do not build marketing profiles of recipients and we do not market to a recipient because a package was sent to them.

If you are a recipient and you want to know what we hold about a delivery to you, contact us using Section 18. We may need to verify your identity and address, and we may direct you to the sender or the carrier where they hold the underlying record.

5.How we use information

We use personal information for the following purposes:

• Providing the Services. Creating and maintaining your account, returning rate quotes, purchasing and printing labels, transmitting shipment data to carriers, tracking packages, handling returns, and operating the Partner Hub counter software.
• Payments and accounting. Processing wallet top-ups, charging for labels and carrier adjustments, issuing refunds, settling funds to Partner Hubs, preventing negative balances, invoicing, and maintaining books and records.
• Support and claims. Answering questions, investigating lost, delayed, or damaged shipments, filing and pursuing carrier claims on your behalf, and resolving disputes.
• Safety, fraud, and security. Verifying identity, detecting stolen payment credentials and fraudulent labels, enforcing our prohibited items rules, protecting our systems, and investigating suspected violations of our terms.
• Improving the Services. Understanding which features are used, diagnosing errors, testing changes, measuring performance, and developing new features. Where practical we use aggregated or de-identified data for this purpose.
• Rate and network analysis. Analyzing shipment patterns in aggregate to negotiate better carrier rates, decide which carriers to add, and plan consolidation and injection routes. Outputs of this analysis are aggregated and do not identify individuals.
• Communications. Sending transactional messages such as receipts, label confirmations, tracking updates, and account and security notices, and, subject to Section 9, sending marketing messages.
• Legal compliance. Meeting tax, customs, export control, sanctions screening, transportation safety, and record-retention obligations, and responding to lawful requests from government authorities.

We do not use your shipment contents descriptions to target advertising to you.

6.Automated features and AI

Parts of the Services use automated processing, including machine learning models:

• Package size estimation. When you describe what you are sending, an automated model suggests a likely box size and weight range to speed up quoting. The suggestion is an estimate. You are responsible for confirming actual dimensions and weight, and carriers will adjust billing if the actual package differs.
• Address correction. Automated validation standardizes and corrects addresses and flags likely undeliverable entries.
• Rate ranking. Automated logic ranks and filters carrier options by price, estimated transit time, and service availability for the origin and destination.
• Fraud detection. Automated rules and models score transactions for fraud risk and may decline a transaction, hold a wallet top-up, or require additional verification.
• Support triage. Automated tools categorize and route support requests and may draft suggested replies for our team to review.

We do not use these systems to make decisions that produce legal or similarly significant effects about you without a way to reach a person. If an automated decision blocks a transaction or restricts your account, you can contact us under Section 18 and ask a member of our team to review it.

We do not sell your data to train third-party models, and we do not permit our vendors to use your personal information to train their general-purpose models.

7.How we share information

We share personal information in the following circumstances and no others.

7.1 Carriers

To move a package we must transmit the shipment record to the carrier you select. That record includes sender and recipient names, addresses, contact details, package characteristics, declared value, and any customs data. Carriers we work with include national carriers such as UPS, FedEx, DHL, and the United States Postal Service, and regional and alternative last-mile carriers such as OnTrac, Veho, UniUni, Better Trucks, SpeedX, GOFO, DoorDash, and others we add over time. Each carrier handles that data under its own privacy policy, which we do not control. Once a shipment is tendered, the carrier is an independent controller of the delivery record.

7.2 Rating and label service providers

We use multi-carrier rating and label platforms, including EasyPost and ShipStation, to obtain rates, generate labels, and receive tracking events. These providers process shipment data on our instructions.

7.3 Payment and financial providers

Stripe processes card payments, wallet funding, and payouts to Partner Hubs, including Stripe Connect accounts. Stripe collects payment credentials directly and acts as an independent controller for fraud prevention and regulatory compliance. We also share limited data with our bank, accounting systems, and tax reporting providers.

7.4 Operational service providers

We use vendors for cloud hosting and databases, email and SMS delivery, customer support tooling, customer relationship management, analytics, error monitoring, address validation, document storage, and security services. They receive only the data needed for their function and are bound by contract to use it only for us.

7.5 Partner Hubs and account members

If you ship at a Partner Hub, that Hub sees your shipment record. If you belong to a business account with multiple users, other authorized users on that account can see shipments, wallet activity, and settings for the account.

7.6 Integrations you connect

If you connect a store platform, marketplace, or other application, we exchange data with it as needed to perform the integration you enabled. You control that connection and can disconnect it at any time.

7.7 Legal and safety

We disclose information when we believe in good faith it is required by law, subpoena, warrant, court order, or other legal process; when required by customs, export control, or sanctions authorities; when necessary to investigate suspected fraud, hazardous or prohibited shipments, or threats to anyone's safety; and to establish, exercise, or defend legal claims.

7.8 Business transfers

If BoxHero is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to reasonable confidentiality protections. We will notify you of any such transfer that materially changes how your information is handled.

7.9 Aggregated and de-identified information

We may create and share aggregated or de-identified information, such as regional shipping cost benchmarks or carrier performance statistics, that cannot reasonably be used to identify you. We do not attempt to re-identify such information and we require recipients not to do so.

8.Cookies and analytics

We use cookies, local storage, pixels, and similar technologies for four purposes: keeping you signed in and your session secure; remembering preferences such as saved addresses and default package sizes; measuring how our sites and app are used; and measuring the performance of our own marketing campaigns.

Strictly necessary cookies cannot be turned off without breaking the Services. You can control other cookies through your browser settings and, where required by law, through the consent banner on our sites. Rejecting non-essential cookies does not affect your ability to buy labels.

Some browsers transmit a Global Privacy Control signal. We treat a GPC signal from your browser as a valid request to opt out of any sale or sharing of personal information for that browser, even though we do not sell or share personal information.

We honor Do Not Track only through the GPC mechanism described above; we do not respond to other Do Not Track headers, because there is no common standard for them.

9.Communications

Transactional messages. We send receipts, label confirmations, tracking updates, wallet balance alerts, claim status, security notices, and changes to our terms. These are part of the Services and you cannot opt out of them while you hold an active account, though you can choose which tracking notifications you receive.

Marketing messages. We send product news, offers, and educational content only where permitted. Every marketing email includes an unsubscribe link, and you can also change your preferences in your account settings.

Text messages. If you provide a mobile number and consent, we may send transactional SMS such as tracking updates and one-time security codes. Message and data rates may apply. Reply STOP to stop and HELP for help. Consent to marketing texts is not a condition of purchase.

Recipient notifications. If you supply a recipient's email or phone number, we or the carrier may send that recipient delivery notifications for that shipment only.

10.How long we keep data

When a retention period ends we delete the data or de-identify it so that it can no longer reasonably be linked to you. We may keep data longer where a legal hold, investigation, claim, or dispute requires it.

11.Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit using TLS, encryption at rest for stored data, hashed password storage, role-based access controls, scoped access so that each Partner Hub can see only its own records, logging and monitoring, and vendor security review. Card data is handled by a PCI-DSS certified payment processor and does not touch our servers.

No system is completely secure. You are responsible for keeping your password confidential, enabling available account security features, and telling us promptly if you believe your account has been accessed without authorization. If we become aware of a breach affecting your personal information, we will notify you and any required regulator as the law requires.

12.Your choices

Regardless of where you live, you can:

• View and edit your account details, saved addresses, and communication preferences in your account settings.
• Request a copy of your account and shipment data in a portable format.
• Ask us to correct information that is inaccurate.
• Ask us to delete your account. We will delete or de-identify what we can, and retain what we are required to keep under Section 10.
• Unsubscribe from marketing email and text messages at any time.
• Disconnect any store or platform integration you have connected.

To make a request, email privacy@boxhero.com or write to the address in Section 18. We will verify your identity, usually by confirming control of the email address on the account and details of a recent shipment. We respond within the period the applicable law requires, generally 45 days, and we will tell you if we need an extension.

We will not discriminate against you for exercising a privacy right. We do not offer financial incentives in exchange for personal information.

You may use an authorized agent to submit a request. We will ask the agent for written proof of authorization and may ask you to confirm it directly.

13.U.S. state privacy rights

13.1 States with comprehensive privacy laws

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, or another state with a comprehensive consumer privacy law in force, you have the rights to know, access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising, and certain profiling. As stated in Section 7, we do not sell personal information or share it for targeted advertising. Exercise these rights through Section 12.

Where the law provides an appeal, you may appeal a denial by replying to our response with the word "appeal" and your reasons. We will respond within the statutory period and, if we deny the appeal, tell you how to contact your state attorney general.

13.2 California specifics

In the twelve months before the effective date of this policy we collected the following categories of personal information under the California Consumer Privacy Act, as amended: identifiers; personal information listed in the California customer records statute; commercial information; internet and network activity; approximate geolocation; audio and visual information, limited to support call recordings where notified and delivery photographs; professional and employment information for business accounts; and inferences drawn from the above, limited to fraud risk scoring and product usage segmentation. Sources, purposes, and disclosure recipients for each category are described in Sections 3, 5, and 7.

We collect certain information that California treats as sensitive personal information, specifically account log-in credentials in combination with a password. We use it only to perform the Services, secure accounts, and prevent fraud. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use.

Under California's "Shine the Light" law you may request information about disclosures to third parties for their own direct marketing purposes. We do not make such disclosures.

13.3 Nevada

Nevada residents may submit a request that we not sell covered information. We do not sell covered information, but you may submit a request to privacy@boxhero.com.

14.Children

The Services are for business and personal shipping by adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a child under 16 other than as a recipient address supplied by a sender, we will delete it. A parent or guardian who believes we hold such information should contact us under Section 18.

15.International users and data transfers

We operate in the United States and store data on servers located in the United States. If you access the Services or ship from or to another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

International shipments necessarily require transmitting shipment and customs data to carriers, customs brokers, and government authorities in the origin, transit, and destination countries. That transfer is required to perform the shipping contract you asked us to arrange.

Where the General Data Protection Regulation or United Kingdom data protection law applies to our processing, our lawful bases are performance of a contract with you, compliance with legal obligations, our legitimate interests in operating and securing the Services and preventing fraud, and consent where we ask for it. Transfers out of the European Economic Area or the United Kingdom rely on Standard Contractual Clauses or another approved mechanism. You may lodge a complaint with your supervisory authority.

16.Third-party sites and carrier tracking pages

The Services link to carrier tracking pages, payment pages, and other third-party sites. Those sites have their own privacy policies and we are not responsible for their practices. Reviewing a carrier's privacy policy is worthwhile before you enter additional information on its site.

17.Changes to this policy

We may update this policy as the Services change or the law changes. We will post the updated policy with a new effective date. If a change materially reduces your rights or materially expands how we use your information, we will give notice by email or through the Services at least 15 days before it takes effect, unless a shorter period is required by law. Continuing to use the Services after the effective date means you accept the updated policy.

Prior versions are available on request.

18.Contact us

Questions, requests, and complaints about privacy should go to our privacy team. We read every message and aim to answer within five business days, and always within the period the law requires.