Privacy Policy
Last updated: 30 July 2026 · ShipSense (Muhammad Arsh Khan, sole proprietor, Mumbai, India)
What we collect
When you request an audit: your work email, brand name, shipment volume, and optional WhatsApp number. When you send a shipment CSV: order references, AWBs, courier names, pincodes, addresses, order values, statuses, dates, and — if you include them — customer phone numbers, names, and email addresses. If you'd rather not send phone numbers, leave the column out: risk scoring still works, and WhatsApp and voice outreach simply switch off. Sending pre-hashed numbers has the same effect, not a neutral one — our ingest hashes again, so nothing can be dialled. Names and email addresses, if you include them, are stored as sent and are not hashed.
What we use it for
One purpose: producing your RTO/NDR audit and, if you become a customer, running ShipSense on your shipments. We do not sell data, share it with couriers or aggregators, or use one merchant's raw data to benefit another. Cross-brand risk signals, when active, use only irreversible hashed tokens — never readable identifiers.
What we never ask for
Bank details, card numbers, UPI IDs, passwords, courier or store login credentials, GST/PAN. If these appear in your export, delete those columns before sending.
Storage
Data is stored on Supabase infrastructure in the Mumbai (India) region, access-controlled per merchant with row-level security. Phone numbers are handled in two parts: on ingest we one-way hash the number for risk matching, and we move the raw number out of your shipment record into a separate locked vault. That vault exists for one reason — you cannot dial a hash, so WhatsApp nudges and voice evidence calls need the real number. It is denied to every logged-in account, ours included, and is readable only by the backend service that places the send. It is covered by the deletion commitment below.
Retention and deletion
Audit data for non-customers is deleted within 60 days of audit delivery. Customers' data is retained while the account is active. Email arsh9khan@gmail.com for deletion at any time — completed within 7 days, confirmed in writing.
Your rights
Under India's Digital Personal Data Protection Act you may request access, correction, or erasure of personal data we hold. Same email; same 7-day commitment.
Questions / grievances
arsh9khan@gmail.com