Privacy Policy

At Navexa, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our e-commerce fulfillment and shipping management platform. Please read this privacy policy carefully. By using our Service, you consent to the practices described in this policy.

1. Information We Collect

We collect information that you provide directly to us, information we obtain automatically when you use our Service, and information from third-party sources.

1.1 Account Information

When you create an account, we collect:

• Name and email address
• Business name and contact information
• Phone number
• Sign-in credentials (passwords are held by Firebase Authentication, not by Navexa)
• Account preferences and settings

1.2 Billing Information

To process payments for shipping labels, we collect:

• Billing name and address
• Payment method details (processed securely; we do not store full card numbers)
• Transaction history and invoices
• Tax identification information where required

1.3 Shipping Data

To provide our shipping services, we collect:

• Sender and recipient names and addresses
• Package dimensions, weight, and contents descriptions
• Shipping preferences and carrier selections
• Tracking numbers and shipment status
• Signature confirmation and delivery receipts
• Return shipping information

1.4 Integration Data

When you connect third-party platforms, we may collect:

• Order information from Shopify, TikTok Shop, WooCommerce, Amazon, and other e-commerce platforms and marketplaces
• Product and inventory data
• Customer information necessary to fulfill orders
• API tokens and authentication credentials (encrypted with AES-256-GCM before storage)

1.4.1 Marketplace Buyer Data

When a seller connects a marketplace such as TikTok Shop, we receive their buyers' names, email addresses, phone numbers, shipping addresses and order contents. We use this data only to fulfil that seller's orders: syncing the order, buying the shipping label and sending tracking back to the marketplace. We never sell it or use it for advertising or marketing. Buyer names, email addresses, phone numbers and street address lines are encrypted before storage. When the seller disconnects the marketplace, we delete this data 30 days later, as described in section 5 and in our Personal Data Protection Policy.

1.5 Automatically Collected Information

When you use our Service, we automatically collect:

• IP address and device identifiers
• Browser type and operating system
• Pages viewed and features used
• Access times and referring URLs
• Error logs and performance data

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing Our Services

• Processing and fulfilling shipping label requests
• Calculating shipping rates from multiple carriers
• Optimizing package dimensions and carrier selection
• Managing inventory and forecasting needs
• Tracking shipments and providing delivery updates
• Processing payments and refunds

2.2 Communication

• Sending transactional emails (order confirmations, shipping notifications)
• Responding to customer support inquiries
• Providing product updates and service announcements
• Sending marketing communications (with your consent)

2.3 Improving Our Services

• Analyzing usage patterns to improve user experience
• Developing new features and functionality
• Improving our optimization algorithms (using anonymized data)
• Conducting research and analytics

2.4 Security and Compliance

• Detecting and preventing fraud and abuse
• Enforcing our Terms of Service
• Complying with legal obligations
• Protecting the rights and safety of users

3. Third-Party Services

We work with trusted third-party service providers to operate our platform. These providers are bound by confidentiality obligations and are only permitted to use your information as necessary to provide services to us.

3.1 Payment Processing

We use Stripe, a PCI DSS Level 1 certified payment processor. When you make a payment, your card details go directly to Stripe and are not stored on our servers.

3.2 EasyPost (Carrier Integration)

We use EasyPost to connect with shipping carriers and provide rate quotes. When you purchase a shipping label, your shipping information is shared with EasyPost to generate the label and facilitate tracking. For more information, please review EasyPost's Privacy Policy.

3.3 Hosting and Infrastructure

Our platform is hosted by DigitalOcean in the United States (SFO3 region, San Francisco, California). Our database, file storage and application servers all run there. Our web app's static files are served by Cloudflare.

3.4 Sign-in

Account sign-in is provided by Google Firebase Authentication, which stores your login email and password on our behalf. For more information, please review Firebase's Privacy and Security page.

3.5 Monitoring and Analytics

We use Sentry to report application errors to us, and PostHog to understand how sellers use the Navexa app. Error reports can include details of the record being processed when the error occurred.

4. Data Sharing with Shipping Carriers

To fulfill your shipping requests, we must share certain information with shipping carriers. This includes:

• Sender and recipient names and addresses
• Package details (weight, dimensions, contents declarations)
• Phone numbers (for delivery notifications)
• Email addresses (for shipping notifications, if opted in)
• Customs information for international shipments

Carriers we work with include but are not limited to: USPS, UPS, FedEx, DHL, and regional carriers. Each carrier has its own privacy policy governing their use of this information.

We share only the minimum information necessary to complete shipments. Carriers may retain shipping data according to their own policies and legal requirements.

5. Data Retention

We retain your information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal obligations (such as tax and financial records)
• Resolve disputes and enforce our agreements
• Improve our services through anonymized analytics

Retention Periods

• Account data: Retained while your account is active and for 30 days after deletion request
• Marketplace buyer data: Deleted 30 days after the seller disconnects the store or marketplace it came from (for example, deauthorizing Navexa in TikTok Shop), including buyer names, contact details, addresses, orders and shipping label files. Database backups containing it expire within 7 days after that
• Shipping records: Label charges and invoices are retained for 7 years for tax and legal compliance, without the buyer data described above
• Payment records: Retained for 7 years as required by financial regulations
• Usage logs: Retained for 90 days for security and debugging purposes
• Marketing preferences: Retained until you update or delete them

6. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 Access

You have the right to request a copy of the personal information we hold about you. You can access much of your data directly through your account settings.

6.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You can update most account information directly in your settings.

6.3 Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (such as data we must retain for legal or regulatory purposes). To request deletion, please contact us at [email protected].

6.4 Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format. You can export your data through your account settings.

6.5 Opt-Out of Marketing

You can opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by updating your preferences in your account settings.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and use personal information about you. Cookies are small data files stored on your device that help us improve your experience.

7.1 Types of Cookies We Use

• Essential cookies: Required for the Service to function properly (authentication, security, session management)
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Help us understand how you use our Service to improve it
• Marketing cookies: Used to deliver relevant advertisements (only with your consent)

7.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Service. Most browsers allow you to refuse cookies or alert you when cookies are being sent.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Navexa is based in the United States, and our servers are located in the United States.

When we transfer personal information outside of the European Economic Area (EEA) or other regions with data protection laws, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

9. GDPR Compliance

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to object to processing of your personal data
• Right to restrict processing in certain circumstances
• Right to withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint with your local data protection authority

We process personal data under various legal bases including: performance of a contract, legitimate business interests, compliance with legal obligations, and your consent.

10. Children's Privacy

Our Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected], and we will take steps to delete such information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last updated" date at the top of this page
• For material changes, we will notify you via email or a prominent notice on our Service
• We encourage you to review this Privacy Policy periodically

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

12. Contact for Privacy Inquiries

If you have any questions about this Privacy Policy or our privacy practices, please contact us: