Privacy Policy

1) Who we are and how to reach us

SecreTag is a product of ShipperSecrets LLC, 868 Cardiff Rd, Naperville, IL 60565. In this policy, "we", "us" and "our" mean ShipperSecrets.

Questions about your information go to sales@secretag.co or 708.275.8418.

2) Scope

This policy covers the website at secretag.co, the API documentation at docs.secretag.co and the SecreTag API at api.secretag.co.

It does not cover other companies' websites or services, even when we link to them.

3) What we collect

3.1 Visitors to our websites

Our server writes a log line for each request it answers. The line holds the IP address the request came from, the page asked for and the time. Passwords and email addresses are filtered out of those logs.

We set the cookies described in section 6 and nothing else. We run no analytics, advertising or tracking code.

3.2 Account holders and business contacts

When you have a SecreTag account, we keep your name, your email address and a bcrypt digest of your password. We never store the password itself.

Each time you sign in, we record the IP address and the browser (its user agent) that signed in, so you and we can see which sessions are open.

When you send a form on secretag.co (support, partners, retail distribution, an integration request, the ROI calculator or the white paper waitlist), we receive your name, your email address, your company, what you wrote to us and the page you sent it from; the ROI calculator also sends us the industry, the monthly orders, the average order value and the estimate you worked out. We also record the IP address and the browser (its user agent) the form was sent from.

3.3 Recipients and tracking subjects

Our customers use the SecreTag API to send us data about their shipments. That data can include organization and API key names, tag identifiers, shipment details, the recipient's name, email address, phone number and addresses, the GPS location reports from a tag, disputes about a delivery and the webhook addresses where the customer wants updates sent.

We hold this data on our customer's behalf. Section 13 explains what that means.

4) How we use it

• To run the service: sign you in, show tags and shipments, answer API requests and send webhook updates.
• To keep the service safe: spot abuse, limit repeated requests and investigate problems.
• To answer you when you write to us or send a form.
• To send the emails the service needs, such as a password reset link.

We do not sell personal information, and we do not use it for advertising.

5) Legal bases for visitors in the EEA and the UK

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the service to a customer who signed up for it.
• Legitimate interests: to keep the service secure and to answer inquiries you send us.
• Legal obligation: when a law requires us to keep or disclose information.

6) Cookies

We set only the cookies the site needs to work: one that keeps the page secure and remembers short messages between pages, and one that keeps you signed in. There are no analytics, advertising or third-party cookies. The Cookie Policy lists both.

7) Who we share it with

We share personal information only with the companies that help us run the service, only for that purpose, and when a law requires it.

7.1 The services we use now

• Hetzner Online GmbH hosts our servers and database, in the United States.
• Cloudflare answers the DNS lookups for our domain. It does not see the pages you load.
• GitHub hosts our source code. It does not hold customer data.

When we turn on an email delivery provider or an error monitoring provider, we will name it here before it receives any information.

8) International transfers

Our servers are in the United States. If you use the service from another country, your information is sent to and kept in the United States.

9) Security

Every connection to our websites and the API is encrypted with TLS. Passwords are stored only as bcrypt digests. Access to our servers and database is limited to ShipperSecrets staff.

10) How long we keep it

• Sign-in sessions: deleted after 14 days without use, or when you sign out.
• Server logs: rotated, so older lines are overwritten as new ones arrive.
• Account data: kept while the account exists.
• Data our customers send through the API: kept while the customer's organization exists, and deleted when the customer asks us to delete it.
• Form submissions: kept so we can answer you and follow up. Write to us and we delete yours.

11) Your rights

11.1 Access, correction and deletion

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Write to sales@secretag.co. We may ask you to confirm who you are first.

11.2 U.S. state privacy rights

Residents of California and other states with privacy laws may have the right to know what we collect, to correct it, to delete it and to opt out of its sale or use for targeted advertising. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of. We will not treat you differently for using any of these rights.

11.3 EEA and UK rights

If you are in the EEA or the UK, you may also object to our use of your information, ask us to restrict it, and ask for a copy in a portable format. You may complain to your local data protection authority.

12) Children

SecreTag is a business service and is not meant for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.

13) Customer responsibilities as controller

When a customer sends us recipient data through the API, the customer decides why and how that data is used, and we process it on the customer's instructions. The customer is responsible for having the right to share it and for telling its recipients how it is used.

If you were a recipient of a tagged shipment and have a question about your information, contact the company that shipped to you.

14) Changes to this policy

When we change this policy, we will post the new version here and update the date at the top.

15) Contact

Write to us at sales@secretag.co, call 708.275.8418, or send mail to the address in section 1.