Shipper: Privacy Policy

This Privacy Policy explains how CH Group International SRL (“Shipper“, “we“, “our“) collects, uses and safeguards personal data when you visit https://shipper.now (the “Website“) or access our AI‑powered application‑building platform (the “Platform” and, together with the Website, the “Services“). It should be read alongside our Terms of Service.

1 Who We Are

Company: CH Group International SRL
Address: Str. Ing. Dimitrie Tacu 28, Bucharest 050184, Sector 5, Romania
Email: [email protected]

2 Scope & Updates

This policy applies to all visitors, customers and end‑users of the Services. We may amend this policy from time to time whenever needed.

3 Data We Collect

Category	Examples
Account Data	Name, email, password hash, billing address, VAT number, subscription tier, payment tokens (handled by Stripe)
Service Usage Data	Prompts, Generated Output, project metadata, feature clicks, API logs, error traces
Device & Log Data	IP address, browser type, operating system, time‑stamp, referring URLs, language settings
Marketing & Prospect Data	Public professional data (name, business email, role) obtained from networking sites or partners

We do not intentionally collect sensitive personal data (e.g., health, race, political beliefs). Please refrain from uploading such data to the Platform.

4 Legal Bases for Processing (GDPR)

We rely on:

Contractual necessity – to provide and support the Services you request.
Legitimate interests – e.g., to secure the Services, prevent fraud, and improve performance.
Legal obligations – compliance with tax, accounting and regulatory duties.
Consent – for email marketing where required; you may withdraw at any time.

5 How We Use Data

Operate & maintain the Platform (create accounts, authenticate users, process payments).
Provide support and investigate bugs or abuse.
Analyse aggregate usage to improve features and user experience.
Detect and prevent fraud, spam, or security incidents.
Send service messages (transactional emails, policy updates).
Marketing (newsletters, product announcements) – opt‑out anytime.

6 Cookies & Tracking

We use cookies, local storage and similar technologies to:

maintain sessions and remember preferences;
measure Website traffic (Google Analytics);
run product analytics (PostHog) to understand feature adoption.

You can block or delete cookies in your browser settings; some features may break if you do.

7 Data Sharing

We do not sell personal data. We share it only with:

Service providers – hosting (AWS, GCP), analytics (Google, PostHog), email (Postmark), payment (Stripe); all under confidentiality agreements.
Affiliates & subcontractors – only as needed to run the Services.
Authorities – if required by law, court order or to protect rights, safety or property.

In a business transaction (merger, acquisition, financing), data may be transferred to the acquiring entity under continued protection.

8 International Transfers

Servers and service providers may be located outside your country. Where we transfer data internationally we rely on:

Standard Contractual Clauses approved by the European Commission, or
Adequacy decisions, or
Other lawful transfer mechanisms under GDPR.

9 Retention

We keep data only as long as necessary for the purposes above and to comply with legal obligations. Account data is retained for the life of the account plus up to twelve (12) months. Back‑ups may persist for the same period.

10 Security

We employ industry‑standard safeguards, including:

TLS encryption in transit;
Encryption‑at‑rest for stored project data;
Role‑based access controls;
Regular vulnerability scanning and third‑party penetration testing;
Mandatory security training for staff.

No system is 100 % secure; users are responsible for keeping passwords safe.

11 Your Rights

Depending on your jurisdiction, you may have rights to:

Access personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase data (“right to be forgotten”);
Restrict or object to certain processing;
Port data to another provider;
Withdraw consent for marketing at any time.

Submit requests via [email protected]. We will respond within 30 days. We may require proof of identity.

You also have the right to lodge a complaint with your local supervisory authority; in Romania this is the ANSPDCP (www.dataprotection.ro).

12 Children

The Services are not directed to children under 13. We do not knowingly collect data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.

13 Contact

Questions or concerns? Email [email protected] or write to the address above. Urgent security issues: include “URGENT – Privacy” in the subject line for fastest routing.