Privacy policy

• Merchants: businesses that use CurShip to ship their orders.
• Customers: people receiving a parcel from a merchant that uses CurShip.

For customers' delivery details, the merchant decides why and how the information is used, and CurShip handles it on the merchant's behalf. If you are a customer, the shop you bought from is your first contact; we will help them answer you.

• Merchant account: name, email, phone, business and billing details, and the people invited to the account.
• Deliveries: the receiver's name, phone number, email if given, delivery address or pickup point, delivery instructions, what is in the parcel, and the courier's tracking updates and proof of delivery.
• Returns, claims and disputes: the reason given and any photos or invoices uploaded as evidence.
• Payments: wallet top-ups, charges and refunds. Card details go straight to our payment provider; we never see or store card numbers.
• Tracking page visits: how many times a tracking page is opened and which promotions on it are clicked. These are counted in total, not tied to a person.
• Technical records: sign-in times and basic logs we need to keep the service secure and working.

• To book, collect, deliver and track parcels, and to tell the people involved what is happening.
• To handle returns, claims and courier billing disputes.
• To charge for labels and keep the accounting records the law requires.
• To keep accounts secure and to fix problems.

We do not sell personal information, and we do not use customers' delivery details to market to them.

• Couriers and pickup-point networks, who need the name, phone number and address to deliver the parcel.
• Our payment provider, to process wallet top-ups.
• Messaging and email providers, to send tracking updates.
• Shopify, when your store is connected, to read orders and write back tracking details.
• Hosting and security providers that run the service for us.
• Authorities, when the law requires it.

Some providers may store information outside South Africa. Where that happens we require them to protect it to the standard POPIA expects.

Anyone who has a tracking link can see that parcel's progress. The customer's link shows their delivery only. The sender's link also shows the label, because the sender has to print it. Links are long random codes that cannot be guessed, and tracking pages are hidden from search engines. Treat a tracking link like the parcel itself: share it only with people who should see it.

We keep information only as long as it is needed for the delivery, for claims and disputes that may follow, and for the financial records the law requires. After that it is deleted or made anonymous. When a merchant closes their account, we delete their data unless the law requires us to keep it.

CurShip uses only the cookies needed to run: one to keep you signed in and one to remember a delivery you are busy creating. We do not use advertising cookies.

Under POPIA you can ask to see the personal information held about you, ask for it to be corrected or deleted, and object to how it is used. Email support@curship.example and we will answer within a reasonable time. If you are a customer of a merchant, we may need to involve that merchant.

If you are not satisfied with our answer, you can complain to the Information Regulator of South Africa.

Information is encrypted in transit, access is limited to people who need it, and courier account details that merchants connect are stored encrypted. If a security problem puts your information at risk, we will tell the people affected and the Information Regulator as the law requires.

If this policy changes in a way that matters, we will say so here and tell merchants by email. See also our Terms of service.