Privacy Policy
This Privacy Policy explains how Reliable International, the operator of ShipyBox (shipybox.in), collects, uses, stores, shares and protects your personal information. It is intended to comply with the Information Technology Act 2000 and the Digital Personal Data Protection (DPDP) Act 2023.
Last updated: 24 September 2026 · Operator: Reliable International · Brand: ShipyBox
1. About this Policy
This Privacy Policy describes the practices of Reliable International (the “Data Fiduciary” under the DPDP Act 2023), operator of the ShipyBox brand, regarding personal information collected through shipybox.in and the ShipyBox merchant panel.
It applies to website visitors, merchants who register an account, and any individual whose data is shared with us by a merchant in the course of fulfilling a shipment (“Data Principals”).
2. Information We Collect
(a) Lead & enquiry information
When you fill any form on the website (contact, demo, pricing, calculator email-capture, lead magnet download): full name, business email, mobile or WhatsApp number, company name, monthly shipment volume, free-text message, and any other field you choose to provide.
(b) CRM & attribution information
Lead source, source page, UTM parameters (utm_source, medium, campaign, term, content), first landing page, first referrer, click path, session ID, calculator inputs and timestamp of first touch.
(c) Quote Engine information
Customer pricing profile (company name, contact person, GSTIN, pickup PIN, monthly shipment volume), margin preferences, quote requests, generated quotations, accepted or rejected statuses and revision history.
(d) Account & merchant data (post-onboarding)
KYC documents, business address, pickup addresses, registered email and phone, signatory details, GSTIN, PAN, bank-account details for COD remittance and refunds.
(e) Shipment metadata
Where you tender shipments through ShipyBox: AWB or order numbers, consignee name and address, product description, declared value and weight, COD amount, courier selection, scan events, NDR feedback and dispute history.
(f) Technical information
IP address (truncated for analytics), browser, operating system, device type, referring URL, cookies and similar identifiers, session duration, pages viewed and interactions recorded by analytics tools. Your IP address is anonymised for analytics and is not transmitted to Meta.
(g) Advertising & attribution identifiers
Where you have accepted the applicable tracking consent, we may process and, where applicable, transmit to Meta Platforms: fbp/fbc advertising identifiers; campaign parameters (UTM, gclid, fbclid); browser/user-agent information; and — only after SHA-256 hashing on our servers — your email address, phone number, and a stable merchant identifier (external_id). Your email and phone number are never sent to Meta in plain text. Your IP address is not transmitted to Meta. An internal, random attribution reference (sbx_lead_id) is used to correlate a registration with the visit that preceded it; it does not itself contain a name, email address, phone number or other direct identifier.
3. Lawful Basis & Purpose of Processing
We process personal data only for specified, lawful purposes. Depending on the processing activity, the applicable basis may include your consent, performance of a contract, compliance with a legal obligation, or a legitimate use specifically permitted under Section 7 of the DPDP Act 2023. Analytics and advertising measurement on this website rely on your consent, which you may withdraw at any time.
- Operate, maintain and improve the Platform.
- Qualify leads, schedule demos, generate quotations and onboard merchants.
- Provide customer support, resolve disputes and process refunds.
- Detect, prevent and investigate fraud or abuse.
- Send transactional emails (account, billing, shipment, support).
- Send marketing communications you have opted into; you can unsubscribe at any time via the link in every marketing email or by writing to support@shipybox.in.
- Comply with legal obligations, court orders, or regulatory requests.
- Analyse aggregated, anonymised usage to improve our website, content and product.
4. Consent & Withdrawal of Consent
When you first visit shipybox.in, non-essential trackers are off by default. You can choose Accept or Reject on the consent banner.
If you Reject or make no choice: the Meta Pixel and Microsoft Clarity remain blocked; analytics and advertising cookies stay disabled; Google Analytics 4 and Google Ads may operate in denied, cookieless Consent Mode, which does not set analytics or advertising cookies.
If you Accept: permitted analytics and advertising storage is enabled for Google Analytics 4 and Google Ads measurement, and the Meta Pixel and Microsoft Clarity are permitted to load.
Your choice is stored in your browser (cookie sbx_consent, up to one year); we do not maintain a central register of consent choices. You may change or withdraw consent at any time via the Privacy Preferences link in the website footer, or by writing to support@shipybox.in from your registered email.
If you continue to our merchant panel (panel.shipybox.in), your consent choice travels with you and is enforced on our servers — advertising measurement events are not transmitted without a granted consent, regardless of browser behaviour. Withdrawal does not affect the lawfulness of processing carried out before withdrawal; it may limit certain services (for example, we cannot fulfil shipments without consignee data).
5. Data Principal Rights (under the DPDP Act 2023)
Subject to applicable law, you have the following rights as a Data Principal:
- Right to access — request a summary of personal data being processed and the activities undertaken.
- Right to correction and erasure — ask us to correct inaccurate or outdated information, or to erase data that is no longer necessary for the purpose for which it was collected.
- Right to grievance redressal — escalate any concern to our Grievance Officer (details below); we will respond within statutory timelines.
- Right to nominate — nominate an individual who may exercise these rights in the event of your death or incapacity.
- Right to withdraw consent — at any time, with effect prospectively.
- Right to information about sharing — ask for a list of categories of third parties with whom your data has been shared.
To exercise any of these rights, send a verifiable request to support@shipybox.in with sufficient information to identify you (typically the email on file). We will respond within thirty (30) days, or such shorter period as required under applicable law.
6. Data Retention & Deletion
We retain information only for as long as necessary to fulfil the purpose for which it was collected, satisfy legal obligations, or resolve disputes. Indicative retention periods:
| Category | Retention period |
|---|---|
| Active merchant account data | Duration of the account + 12 months after closure |
| Closed or inactive leads | Up to 24 months from last interaction |
| Shipment metadata | Up to 7 years (tax, audit and dispute purposes) |
| Quote requests & quotations | 7 years from issuance |
| Transactional emails & support communications | 36 months |
| Marketing-only subscribers (no transactional relationship) | Until unsubscribe |
| Consent preference (browser cookie) | Up to 1 year (enforced by cookie expiry) |
| Audit & compliance logs | 7 years |
Deletion requests are honoured for data not subject to a statutory or contractual retention obligation. Where deletion is not legally possible, we will restrict processing to the minimum required to comply with the obligation and inform you accordingly.
Advertising-event transmission logs, where they exist, record only the event type, timestamp and delivery status — never message content or unhashed personal data — and are kept for operational debugging; no automatic deletion schedule currently applies.
7. Sharing of Information
We share your information only as needed and under contractual safeguards:
- Courier Partners — shipment-level data required to dispatch, track and deliver each consignment.
- Technology providers — MongoDB Atlas (database hosting), Resend (transactional email), payment processors (where applicable), cloud infrastructure providers, and AI/ML providers strictly for routing-and-allocation decisions on encrypted shipment metadata.
- Measurement & advertising providers — Google Analytics 4 (website measurement, subject to the consent settings described above), Google Ads (conversion measurement), and Meta Platforms / Facebook / Instagram (advertising measurement, attribution and campaign optimisation via the Meta Pixel and, where activated, the Conversions API). Meta Pixel and Meta advertising measurement are enabled only after you accept tracking cookies.
- Session analytics — Microsoft Clarity (behavioural session replay with PII masking), enabled only after you accept tracking cookies.
- Professional advisers — legal, accounting and audit professionals under confidentiality obligations.
- Regulatory authorities — where required by Indian law, court order, or a legitimate government request.
- Successors-in-interest — in the event of a merger, acquisition or asset sale, your data may be transferred subject to equivalent privacy protections.
We do not sell your personal data, and we do not rent your contact list to third-party advertisers.
8. Cookies & Analytics
We use first-party cookies for session management, CSRF protection and preferences — including sbx_consent, which records your tracking choice (up to one year).
- Before consent: Google Analytics 4 and Google Ads operate in Consent Mode with analytics and advertising storage denied — no analytics or advertising cookies are set. The Meta Pixel and Microsoft Clarity do not load.
- After you Accept: Google Analytics 4 may use permitted analytics storage for website measurement, Google Ads may measure conversions, and the Meta Pixel (advertising measurement) and Microsoft Clarity (masked session replay) may load.
- Google Search Console uses a domain-verification tag only and does not track visitors.
You can change or withdraw your choice at any time via Privacy Preferences in the website footer.
9. Data Security
- Data is stored in MongoDB Atlas (India region where available) with encryption at rest (AES-256) and in transit (TLS 1.2 or higher).
- Access to production data is restricted to authenticated personnel via role-based access control (RBAC), with audit logs maintained for all sensitive operations.
- Admin authentication uses bcrypt-hashed credentials and signed JWT sessions.
- We follow the principle of least privilege and review access quarterly.
- Dependency vulnerability scanning and security patching are performed regularly.
No system is 100% secure. In the unlikely event of a personal data breach affecting your information, we will notify you and the Data Protection Board of India in accordance with the timelines and form prescribed under the DPDP Act 2023.
10. Children's Privacy
The Platform is intended exclusively for businesses and individuals aged eighteen (18) and above. We do not knowingly collect personal data from children. If you believe a minor has provided information to us, please contact support@shipybox.in so we may delete it.
11. Cross-border Transfers
Some service providers may process data outside India. Where this occurs, we ensure equivalent privacy protections through contractual safeguards (Standard Contractual Clauses or equivalent) and only transfer to jurisdictions that meet the requirements of the DPDP Act 2023 and rules notified thereunder.
12. Updates to this Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision; material changes will be communicated by email or a prominent notice on the website at least fifteen (15) days before they take effect.
13. Grievance Officer & Contact
In accordance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 and the DPDP Act 2023, Reliable International has designated a Grievance Officer to address concerns relating to personal data processing.
All grievances, data-principal requests and privacy questions can be addressed to:
- support@shipybox.in
- Postal address
- Reliable International, Gurugram, Haryana, India
- Response window
- Within 30 days of receipt of a verified request
If you are not satisfied with the response, you may further escalate the matter to the Data Protection Board of India once it is operational under the DPDP Act 2023.