Privacy Policy

1. Who this policy covers

Shipped Inc. operates Shipped. This policy describes the personal information we handle when you visit our website, create or manage an account, connect a development tool, deploy an application, pay for services, or contact us.

Applications hosted on Shipped belong to our customers. Their operators decide what personal information their applications collect and how to use it. When Shipped hosts that information on a customer’s instructions, the customer’s privacy notice and the applicable data-processing agreement govern that relationship. Contact the application operator about its data practices; this policy does not replace its notice.

2. Information we handle

• Account and organization information: contact details, authentication identifiers, organization membership, roles, and account settings.
• Deployment and service information: uploaded source and files, build instructions, configuration, secret values you submit, deployment history, domain settings, application data, and backups for enabled services.
• Operational information: request and access logs, IP addresses, timestamps, errors, health events, resource usage, and security or audit events. Application logs can include personal information if your code writes it there.
• Billing information: purchase and invoice details, payment status, billing contact information, credit activity, and authorized spending limits. Payment providers process the payment details submitted through their payment interfaces.
• Communications: information you provide in support requests, feedback, or reports of abuse.

When you connect a repository, identity provider, coding agent, or another service, we receive the information that the integration and your permissions make available. A direct workspace deployment sends the files included in its upload; connecting a coding agent does not itself give Shipped access to every file or conversation in that agent.

3. How we use information

We use information to authenticate users, enforce access permissions, build and run applications, connect resources, operate backups, provide support, measure usage, process billing, and show deployment and account activity. We also use it to investigate errors, detect abuse, protect the platform, meet legal obligations, and resolve disputes.

Where applicable law requires a legal basis, this processing may be necessary to perform our agreement with you, meet legal obligations, pursue legitimate interests such as operating and securing the Services, or carry out a choice for which you have given consent. Where consent is required for an optional purpose, we request it separately and explain how to withdraw it.

4. When information is shared

Information is available to authorized members of your organization according to their permissions. Deploying a public application makes its public content accessible to visitors. Integration providers receive the data required for the connections and actions you authorize.

We use service providers for functions such as infrastructure, authentication, payment processing, and service communications. They may handle information needed for those functions under the applicable agreements. The provider list, processing locations, and transfer arrangements must be confirmed for the services offered at launch.

We may disclose information when required by law, to protect rights and safety, or to investigate fraud or abuse. A business transfer may involve relevant records, subject to applicable confidentiality and privacy obligations. We limit disclosures to what is appropriate for the purpose.

5. Cookies and browser storage

Authentication and security features may use cookies or browser storage to maintain a session and protect access. The marketing site does not currently include third-party advertising or analytics scripts. Customer applications can use their own cookies and tracking technologies, which their operators must describe.

Your browser can clear or block cookies and stored data. Doing so may sign you out or prevent account features from working. If optional tracking is introduced, its purpose and available controls must be disclosed before it is enabled, with consent where required.

6. Retention, deletion, and security

We retain information for the purpose for which it was collected, including operating active services, maintaining requested recovery options, keeping required financial records, and resolving security incidents or disputes. Different categories need different retention periods. Source archives, logs, live data, and backups have separate lifecycles; deleting a resource does not necessarily remove every backup or legally required record immediately.

Resource-specific retention and recovery terms must be available before purchase. When information is no longer needed, it is deleted or de-identified according to the applicable process. Access controls and other safeguards are used to protect information, but no system can guarantee absolute security. You can help by limiting collaborator access and keeping credentials out of source code and logs.

7. Your choices and privacy requests

You can update account information, manage authorized access, revoke integrations, and use available data-export and deletion controls. Depending on the laws that apply, you may also have rights to access or correct personal information, request deletion or portability, object to or restrict processing, withdraw consent, or complain to a privacy regulator.

Send a privacy request to contact details will be added before publication. We may need to verify your identity and authority before disclosing or changing information. Some requests are subject to exceptions, such as a legal obligation to retain a record. If your request concerns an application hosted for a customer, contact that application’s operator first; we assist customers as required by our agreements and applicable law.

8. Updates and questions

Shipped’s account services are intended for people who can enter a binding agreement. If you believe a child has provided account information without appropriate authorization, contact us so we can review it.

We update this policy to reflect changes in the Services and data practices, with an updated effective date and notice of material changes where required. For privacy questions, contact contact details will be added before publication.