Privacy Policy

Shipmah (“we”, “us”, “our”) is operated by Shipmah Technologies Pvt Ltd, a company incorporated under the Companies Act, 2013 (CIN U62099PN2026PTC255914), with its registered office at Office No. 17 & 18, 4th Floor, Wing C1, Kasarwadi, Pune City, Pune - 411034, Maharashtra, India.

This policy covers the Shipmah platform: the websites shipmah.in, app.shipmah.in and portal.shipmah.in and their sub-domains, the installable app, the public shipment-tracking page, our APIs, and the emails and WhatsApp messages we send. It explains what personal data we collect, why we collect it, who we share it with, where it is kept, how long we keep it, and the rights you have.

It applies to everyone whose personal data reaches Shipmah: the logistics businesses that use the platform (“organisations”) and their owners, admins and staff; the organisations' customers; the senders and receivers of shipments; customer-portal users; delivery riders; and visitors to our websites.

This is the Privacy Policy referred to in our Terms of Service. It is published in English; on request we will provide it in any language listed in the Eighth Schedule to the Constitution of India.

Shipmah is a business tool used by logistics operators. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we act in two different roles, and it matters which one applies to you:

• We decide (Data Fiduciary). For the account holders who register and use Shipmah — organisation owners, admins and staff — and for portal account details, website visitors and anyone who contacts us, Shipmah decides how and why the data is used. Sections 3 to 12 describe this in full.
• The organisation decides (we are its Data Processor). Everything an organisation enters about its own customers, shipment senders and receivers, and riders is processed on that organisation's instructions, only to deliver the service it asked for. The organisation is responsible for having the consent or other lawful basis to collect that data and to send notifications to those people. If you are one of those people, Section 13 explains what to do.

3.1 Organisation owners, admins and staff.

• Name, mobile number, email address, role and branch, and an optional profile photo.
• Your password — held only as a one-way hash by our login provider; we never see or store it in readable form.
• Business identity provided at registration: legal name, PAN, GSTIN, registered address, copies of the PAN card and GST certificate, and the result of a check of those details against government records (whether the names match).
• Activity records: bookings you create or edit, cash shifts you open and close, records you delete (with your name), and notes you add to support cases.
• Technical data described in 3.7.

3.2 An organisation's customers (address book and billing customers). Name, company, phone, email, address, GSTIN or PAN, and billing settings — entered by the organisation.

3.3 Senders and receivers of shipments.

• Name, company, phone, email, pickup and delivery address, and pincode.
• Package details, declared value, payment mode and cash-on-delivery amount.
• For international shipments: customs paperwork (invoice details and goods descriptions) and, where customs rules require it, one identity document of the sender chosen by the sender (for example PAN, passport, Aadhaar, voter ID or driving licence).
• Shipment photos, address-scan images (Section 6), proof-of-delivery images and signatures.
• Tracking events received from carriers, and notes recorded when a delivery problem is handled.
• Walk-in senders at a counter: name, phone, address and the amount paid.

3.4 Customer-portal users. Name, email address or username, phone, password hash, login history, and an audit log of the actions taken in the portal together with the IP address and browser type used.

3.5 Delivery riders (MyDelivery). Name, mobile number, rider code and profile photo; and for each delivery, the location recorded at completion, the proof-of-delivery photo, the receiver's signature, name and relation, and any cash collected.

3.6 Website and public-tracking visitors. The tracking numbers you enter; your IP address, used only to limit request rates and not stored; the result of the bot-protection check on public pages; and privacy-friendly, cookieless page analytics (page views, device type, page speed) that cannot identify you.

3.7 Technical data (all users). IP address, browser and device type, the pages and features used, timestamps, error reports (technical details only; account data is excluded by design) and the delivery status of notifications we send.

• Directly from you — when you register, fill in a form, upload a document, book a shipment or contact support.
• From your organisation — when it invites you as staff, records you as a customer, or books a shipment to or from you.
• From carriers and delivery partners — scan events, delivery status, proof of delivery and pickup confirmations for shipments booked through Shipmah.
• From a KYC verification service — the match result when we check an organisation's PAN and GST details against government records at registration.
• Automatically — through logs, cookies and device storage (Section 9).

We use personal data only for the purposes below. For account holders, our legal basis is the consent you give when you register (the checkbox that links to this policy and the Terms) and the contract you enter with us; for shipment data, we act on the organisation's instructions. Where a law requires us to keep or share data, that legal obligation is the basis.

• Providing the service — creating and securing accounts, booking shipments, printing labels, handing shipments to carriers, tracking, sending delivery notifications, producing proof of delivery, billing and support.
• Verifying identity and preventing fraud — KYC checks at registration, government-records matching, one-time passcode login, rate limiting and bot protection.
• Payments and accounting — keeping the wallet ledger, issuing GST invoices and credit or debit notes, and reconciling carrier charges, as required by tax law.
• Customer support — answering questions and resolving delivery problems raised by organisations or their customers.
• Security and abuse prevention — monitoring for unauthorised access, investigating incidents and protecting the platform and its users.
• Improving the service — aggregate usage statistics and accuracy audits of the Address Scanner (Section 6). We do not build marketing profiles.
• Legal compliance — responding to lawful requests from courts, regulators and law enforcement, and meeting record-keeping duties.

We do not use personal data for advertising, we do not profile people for marketing, and we never sell personal data to anyone.

The Address Scanner lets an organisation photograph a handwritten or printed address and have the receiver's details (name, phone, address lines, city, state, pincode) filled in automatically.

• The photo is sent to a specialised third-party document-reading (OCR) service. Our contract with that provider prohibits it from using the images or extracted text to train its models and limits its retention to brief operational logs kept only to detect abuse. The provider may process the image outside India (Section 8).
• We keep the photo and the extracted text in private storage as part of the organisation's scan history for as long as the organisation's account is active, so the organisation can review past scans and so we can audit accuracy and evaluate replacement OCR services using de-identified samples.
• The organisation confirms it has a lawful basis to submit these images. If your address appears in one and you are not a Shipmah user, Section 13 applies.

We share personal data only with the categories of recipients below, and only what each needs:

• Carriers and delivery partners — the carrier shown on your label or tracking page receives the sender and receiver details needed to pick up, transport and deliver the shipment. For international shipments this includes our forwarding partner, the destination-country carrier and customs authorities.
• Payment gateway (Cashfree Payments) — when an organisation adds money to its wallet, the gateway receives the organisation's identity and the amount. Card, UPI and bank details are entered directly with the gateway and never reach us.
• KYC verification service — receives an organisation's PAN, GSTIN and owner name to confirm them against government records at registration.
• Messaging providers — deliver our WhatsApp and email messages and therefore receive the recipient's phone number or email address and the message content.
• Document-reading (OCR) provider — as described in Section 6.
• Cloud infrastructure providers — hosting, database, file storage, login, bot protection and security, rate limiting, error monitoring and analytics. Each is bound by contract to use data only to provide its service to us.
• Professional advisers — auditors, accountants and lawyers, under confidentiality.
• Authorities — courts, regulators, tax and customs authorities and law enforcement, when the law requires it or to protect the rights and safety of users or the public.
• A successor business — if Shipmah is merged, acquired or sells its assets, with notice to you and under this policy.

We do not sell personal data and we do not share it with advertising networks. Organisation customers may request our current list of sub-processors under a confidentiality agreement.

Our database, application servers and automation servers are located in India, and that is where your data is primarily stored and processed.

A small number of the service providers in Section 7 process limited data outside India:

• our login provider holds account credentials (mobile number, email, password hash) on infrastructure that may be located outside India;
• the document-reading (OCR) provider may process address-scan images outside India;
• error-monitoring reports (technical details only) are stored outside India;
• our file-storage provider is a global service and may hold shipment photos and documents in a region it selects;
• international shipments necessarily send sender, receiver and customs details to the foreign carriers and customs authorities involved.

Section 16 of the DPDP Act permits transfers outside India except to countries the Central Government restricts. We do not transfer personal data to any restricted country or territory, and we require our providers to protect data to the standard set by Indian law.

Shipmah uses cookies and browser storage only to make the platform work. Nothing here is used for advertising or cross-site tracking.

• One cookie that remembers which organisation you are working in (kept for one year, removed when you leave the organisation).
• Login session kept in your browser's local database until you log out or it expires.
• Preferences in local storage: theme, table density, printer and camera settings, recently tracked numbers and install-prompt choices.
• Offline cache when you install the app: pages, pincode data, fonts, carrier logos and images you have already viewed, so the app keeps working on a weak connection. It stays on your device until you clear it.
• Security challenge — our bot-protection provider may set a cookie on public pages to tell real visitors from automated traffic.
• Analytics — cookieless and aggregated (page views, device type, performance); it cannot identify you.
• Fonts are loaded from a third-party font service, which receives your IP address as part of the request.

You can clear cookies and site data at any time in your browser settings. Logging in requires browser storage to work.

We keep personal data only as long as it is needed for the purpose it was collected for, or for as long as the law requires. Current periods:

• Account and business identity (including PAN and GST documents and the KYC match result) — while the account is active, and up to eight years after closure under company and tax record-keeping law.
• Shipment, wallet and billing records — the same period; they are financial records.
• Customer and address-book records — until the organisation deletes them or its account closes.
• Shipment photos, proof-of-delivery images, signatures and support notes — kept with the shipment record.
• Address-scan images and extracted text — while the organisation's account is active (Section 6).
• Sender identity documents for international shipments — kept with the shipment record for customs purposes.
• Customer-portal accounts and their audit log — while the portal account exists.
• Rider profiles and delivery proofs — while the rider record exists, and with the delivery record.
• One-time passcodes — valid for five minutes and unusable afterwards.
• Customer-facing proof-of-delivery share links — seven days, after which the file is removed.
• Print jobs — 24 hours.
• Technical logs and error reports — up to 90 days on a rolling basis.
• Encrypted backups — rolling 30 days, with offsite copies kept up to 45 days. A small number of one-time migration snapshots are kept longer to guarantee the integrity of historical records.

After these periods, data is deleted or anonymised. Where a legal hold, dispute or investigation applies, we keep the relevant data until it is resolved.

• Encryption in transit (HTTPS everywhere) and at rest for our database, file storage and backups.
• Tenant isolation: each organisation's data is separated, and every request is checked against the organisation and role making it.
• Role-based permissions: owners control what each staff member can see and do.
• One-time passcode login, rate limiting and bot protection on public and authentication pages.
• Identity documents and address-scan images are held in private storage reachable only through short-lived signed links.
• Access to production systems is restricted to authorised personnel and monitored; backups are kept offsite in tamper-proof storage.
• Periodic security reviews of the platform, with findings tracked to closure.

No system is completely secure. If you discover a vulnerability, please report it to support@shipmah.in and do not exploit it.

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you and how it is processed.
• Correction and completion — of inaccurate or incomplete data. Account holders can edit most details directly in the app.
• Erasure — of data that is no longer needed, unless a law requires us to keep it (Section 10).
• Withdraw consent — at any time, as easily as you gave it, by writing to us. We will then stop the processing that relied on consent; some services may become unavailable as a result.
• Nominate — another person to exercise these rights for you in the event of death or incapacity.
• Grievance redressal — through our Grievance Officer (Section 18), and if you are not satisfied, a complaint to the Data Protection Board of India.

How to make a request. Email privacy@shipmah.in from your registered email address or with your registered mobile number, and tell us which right you wish to exercise. We may ask you to confirm your identity. We acknowledge requests within seven days and aim to resolve them within thirty days.

The DPDP Act also asks you not to impersonate anyone, not to suppress material information when providing data for identity documents, and not to file false or frivolous grievances.

You may be reading this because a business used Shipmah to send you a shipment, a delivery notification or a proof of delivery. In that case:

• The sender business decided to collect your details and is responsible for them; we process them on its instructions. Its name is on your shipment label or in the message you received, so please contact it first to access, correct or delete your data or to stop notifications.
• You can also write to privacy@shipmah.in. We will forward your request to the sender business within seven days and help it respond.
• Our public tracking page shows only shipment status, city-level locations and a masked version of the receiver's name — never phone numbers or full addresses.

• We send service messages only: one-time passcodes, booking confirmations, delivery updates, proof of delivery, invoices and security alerts, by WhatsApp and email.
• Security notices are essential and cannot be switched off while you hold an account.
• Notifications to shipment senders and receivers are sent on behalf of the sender business, which chooses whether to send them; contact that business to stop them.
• We do not send marketing messages without your separate consent, and you can withdraw that consent at any time.

Shipmah is a business service for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child's data has reached us, write to privacy@shipmah.in and we will delete it.

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected individuals in the manner and timelines required by the DPDP Act and its Rules, report the incident to the Indian Computer Emergency Response Team where the Information Technology Act requires it, and promptly inform any organisation whose shipment data is affected so that it can meet its own obligations.

We may update this policy as the platform or the law changes. The date at the top shows the latest version. Material changes will be announced by email or in-app notice at least thirty days before they take effect; minor clarifications take effect when posted.

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Section 8(9) of the DPDP Act, our Grievance Officer answers questions about the processing of personal data and resolves grievances, which we aim to close within thirty days of receipt: