This policy explains how ShypConnect handles personal data in connection with ShypConnect (the “Service”). It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices) Rules.
1. Two different roles, and why it matters to you
The Service handles two kinds of personal data, and our responsibility for each is different.
Data about you, our customer
Your name, your email address, your business details. For this we are the Data Fiduciary: we decide why and how it is processed, and the rights in section 7 are exercised directly with us.
Data about your customers
The phone numbers you enter against a parcel, and the recipient names, addresses and checkpoint details couriers return to us. For this we are a Data Processor. You are the Data Fiduciary. We process it only on your instructions, and for no purpose of our own. Those instructions are the parcels you register and the notification settings you choose.
The practical consequence: you are responsible for having a lawful basis to give us your customers' data, for telling them how it is used, and for answering their requests. If one of your customers contacts us directly about their data, we will refer them to you and let you know.
2. What we collect
Account and identity data
- Your name and email address.
- Your business name, and your GSTIN if you choose to give it.
- A hashed form of your password. We never store the password itself and cannot recover it.
Billing data
- Your subscription, its plan, its status and its billing periods.
- A record of each payment: the amount, the GST, the date and the payment identifier.
- We never see or store your card, UPI or bank details. Those go directly to Razorpay, which is certified to handle them. We receive only the outcome of the payment and a reference to it.
Parcel and recipient data
- Tracking numbers and couriers you register.
- Phone numbers you add to a parcel, stored in international format.
- Status and checkpoint information returned by the courier through our tracking provider. This is written by the courier and can include a recipient's name, delivery address and signature details.
Configuration data
- Your Endpoint URL and the notification preferences you set.
- Your webhook signing secret, stored so that outgoing messages can be signed.
Technical data
- Server logs: IP address, timestamp, the request made, and a correlation identifier used to trace one parcel's path through the system when something needs investigating.
- Records of what was delivered to your Endpoint and how each attempt ended.
- An administrative audit log of changes made by our staff to accounts, plans and credits.
3. Why we process it
| Purpose | Data used | Basis |
|---|---|---|
| Providing the Service: registering parcels, tracking them, delivering events | Account, parcel, recipient, configuration | Performance of our contract with you |
| Verifying your email address and resetting your password | Name, email | Performance of our contract; security |
| Taking payment and raising tax invoices | Account, billing, GSTIN | Contract; legal obligation under tax law |
| Support: answering a question about a parcel or a charge | Whatever the question concerns | Contract; legitimate use |
| Security, fraud prevention, debugging and abuse investigation | Technical logs, audit log | Legitimate use; legal obligation |
We do not sell personal data. We do not share it for advertising. We do not profile you, and we do not use your data or your customers' data to train machine-learning models.
4. Who it reaches
Personal data reaches only the providers we need to run the Service. Each is bound by contract to process it only on our instructions and to protect it.
Razorpay Software Private Limited
- Why: Payment processing for subscriptions and credit packs.
- What: Name, email, billing details, GSTIN. Card details go to Razorpay directly and never reach us.
- Where: India
TrackingMore
- Why: Courier tracking: registering a consignment and receiving its status updates.
- What: Tracking number and courier. Checkpoint data comes back from the courier and may include the recipient name, address and phone number.
- Where: Outside India
Resend
- Why: Transactional email: address verification and password resets.
- What: Name and email address of account users. No recipient data.
- Where: Outside India
Our hosting provider
- Why: Application hosting, database and backups.
- What: All data stored by the platform, at rest.
- Where: India
Beyond these, we disclose personal data only where the law requires it (a valid order from a court or an authority acting within its powers), or to establish or defend a legal claim. If our business is sold or merged, data may transfer to the acquirer, who will remain bound by this policy or one no less protective; we will tell you if that happens.
Data leaving India
Some of the providers above operate outside India, so some data is processed abroad. Where that happens we rely on contractual protections with the provider and transfer no more than the purpose requires. Transfers are made only to countries not restricted by the Central Government.
5. How long we keep it
- Account data: for as long as your account is open, and for a reasonable period after closure to settle accounts and handle disputes.
- Billing records and tax invoices: for the period Indian tax law requires us to retain them, which is longer than the life of your account and is not something we can shorten at request.
- Raw courier payloads, the unprocessed messages our tracking provider sends us, which carry the most personal detail, are deleted automatically after 90 days. They exist to resolve a dispute about what a courier actually reported, and beyond that window they are a liability rather than a record.
- Parcels, webhook deliveries and credit ledger: for the life of the account, because they are the record of what you were charged for.
- Server logs: a short operational period, then rotated out.
6. How we protect it
- Passwords are stored as bcrypt hashes at a work factor of 12. They cannot be reversed, and we cannot read them.
- Transport is encrypted with TLS, both for the Service and for the events we send to your Endpoint.
- Tenant isolation. Every query the application makes is scoped to one account at the database layer, so one customer's data cannot be returned to another. This is the property we treat as the most consequential in the system, and it is covered by automated tests.
- Message authenticity. Events we send are signed with a per-account secret; messages we receive from payment and tracking providers are signature-verified before anything in them is trusted.
- Administrative access is limited to staff who need it, sits behind a separate login, and every change an administrator makes to an account, plan or credit balance is written to an audit log.
- Secrets, including your webhook signing secret, are shown once and never displayed again.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.
7. Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access a summary of the personal data we hold about you and what we do with it.
- Correct data that is inaccurate, and complete data that is incomplete. Most of it you can edit yourself on your profile and account screens.
- Erase personal data we no longer need, subject to what we must retain by law, tax records in particular.
- Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
- Complain to us, and then to the Data Protection Board of India if our answer does not satisfy you.
To exercise any of these, email hello@owlsy.dev from the address on your account. We will respond within the time the law allows, and we may need to verify your identity first.
If you are the recipient of a parcel and want to know why a business has your phone number in our system, that business is the one to ask. It decides what to send us and why. We hold that data on their behalf. Write to us anyway if you cannot reach them and we will pass the request on.
8. Cookies
The Service sets a session cookie to keep you signed in, and a cookie carrying a token that protects forms against cross-site request forgery. Both are necessary for the Service to work, and neither is used for advertising or analytics.
We do not use third-party advertising cookies, and we do not track you across other websites. Blocking cookies will prevent you from signing in.
9. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.
10. Changes to this policy
We may update this policy. The date at the top shows when it last changed. Where a change materially affects how we handle your data we will notify you by email or in the Service before it takes effect.
11. Grievance Officer
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, the contact for data protection complaints is:
- Email: hello@owlsy.dev
- Address: ShypConnect, B-203, Shiv Dhrasti Residency, Umbhel, Surat, Gujarat 394325, India
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.