Legal
Privacy Policy
Effective from 2 October 2026
The short version
- We collect only what we need to run ShipBahi: your account, your company details and the bookings, customers and invoices you enter.
- Your business data belongs to you. We don't sell it, rent it or use it for advertising.
- Each courier office's data is kept separate. Other ShipBahi users can't see it.
- Your public tracking page shows only basic shipment status, never phone numbers, addresses or amounts.
- You can export your data to Excel at any time, and ask us to correct or delete it.
1. Who we are
ShipBahi ("ShipBahi", "we", "us") is online software for courier offices in India to book shipments, share tracking with their customers and create GST invoices. It is available at www.shipbahi.in and app.shipbahi.in.
This policy explains how we handle personal data, in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules.
2. Your data and your customers' data
There are two kinds of personal data in ShipBahi, and the responsibilities differ:
- Data about you (the courier office owner and staff): your name, email and login. For this data, ShipBahi decides how it is used and is responsible for it.
- Data you enter about other people: your customers, senders and consignees (receivers), such as names, phone numbers and addresses. For this data, your courier office decides why it is collected and how it is used. ShipBahi only stores and processes it on your instructions, to provide the service to you. We don't contact your customers or use their data for our own purposes.
If you enter other people's data, you are responsible for having a lawful reason to collect it and for telling them how it is used, as you would with a paper register or Excel sheet.
3. What we collect
| What | Examples | From |
|---|---|---|
| Account details | Your name, email address and password. Passwords are stored only in scrambled (hashed) form; we can never see them. | You, when you sign up |
| Company details | Company name, short name, GSTIN, address, phone, email, website, bank details for invoices, logo and signature image, invoice and AWB settings | You, in setup and Settings |
| Business records | Customers (name, GSTIN, address, contact person, phone, email), shipments (sender and consignee names, phones and addresses, weights, carrier and tracking numbers, charges), tracking updates and invoices | You and your staff |
| Contact form messages | Name, email, phone number and your message, when you use "Have questions first?" on our website | You |
| Technical data | IP address, browser type and the time of each request. For the public tracking page we keep only a scrambled (hashed) form of the visitor's IP address, for up to one hour, to stop automated scraping. | Your browser, automatically |
We don't collect payment card details. When paid plans start, payments will be handled by a licensed payment provider, and we'll update this policy first.
4. How we use it
- To create and run your account, and keep your login secure.
- To provide the features you use: bookings, invoice PDFs, tracking pages, dashboards and Excel exports.
- To send you service emails, such as email confirmation and password reset. We don't send marketing emails without your consent.
- To reply when you contact us or fill in the contact form.
- To keep ShipBahi safe: preventing spam, abuse, fraud and attacks, and fixing problems.
- To meet legal obligations, such as tax records for our own invoices and lawful requests from authorities.
We process your data because you consent to it when you sign up or send the form, and because it is needed to provide the service you asked for. You can withdraw consent at any time by closing your account (see Your rights). This doesn't affect anything done before you withdrew it.
We do not sell personal data, show advertising, or use your business records to train AI models.
5. The public tracking page
Each courier office gets a public tracking page, and can add a tracking box to its own website. Anyone who knows the office's short name and a shipment's AWB or carrier tracking number can see that one shipment's:
- status, tracking history and update notes
- booking date, origin and destination city and country
- consignee's first name and last initial (for example "Rahul V."), and who received it once delivered
- number of pieces, weight, carrier and carrier tracking number
- the courier office's name, city, phone, email and website
It never shows phone numbers or addresses of senders and consignees, charges, invoices or customer accounts. Searches are limited per visitor to prevent scraping. Notes you type into tracking updates are shown publicly, so don't put private information in them.
6. Who we share it with
We use a few trusted service providers to run ShipBahi. They process data only on our instructions and must protect it:
| Provider | What they do |
|---|---|
| Supabase | Database, login and file storage (logos and signatures) |
| Vercel | Hosting the website and app |
| Brevo | Sending account emails, such as confirmation and password reset |
| Google Fonts and jsDelivr | Loading fonts and icons on our website. They receive your IP address, as any website you visit does. |
Apart from these, we share personal data only when required by law (for example, a valid order from a court or government authority), to protect the rights and safety of our users or the public, or as part of a merger or sale of ShipBahi, where the new owner must keep this policy. Inside your company, the owner and staff of your account can see your company's data.
7. Where it is stored
Our providers' servers may be located outside India. The DPDP Act allows this, except to countries the Government of India restricts; we will follow any such restriction. Data is encrypted while it travels between your browser and our servers.
8. How long we keep it
- Account, company and business records: for as long as your account is open. If you close your account, we delete them within 90 days, unless the law requires us to keep something longer.
- Before closing, please export your records to Excel. GST law requires businesses to keep tax records (generally for 72 months), and that duty stays with your courier office.
- Contact form messages: up to 24 months, or sooner if you ask us to delete them.
- Tracking page visitor hashes: about one hour.
- Backups and server logs kept by our providers are overwritten on their normal schedule.
9. How we protect it
- All connections use HTTPS encryption.
- Every record is tied to its courier office, and database rules stop one office from reading or changing another office's data.
- Passwords are hashed, and new accounts must confirm their email address.
- Logos and signatures are stored privately and shown only to your company through short-lived links.
- Access to the systems behind ShipBahi is limited to the people who run it.
No system is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires. Please keep your password private and tell us straight away if you think your account has been misused.
10. Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you and how it is used.
- Correct or update it. You can change most details yourself in the app.
- Erase it, by closing your account or asking us.
- Withdraw consent at any time.
- Nominate someone to exercise these rights if you die or can't act yourself.
- Raise a grievance with us, and if you're not satisfied, with the Data Protection Board of India.
If you are a customer, sender or consignee of a courier office that uses ShipBahi, please contact that courier office first, because it controls your data. We will help them respond.
Email us at connect2shipbahi@gmail.com from the email address on your account. We may ask you to confirm your identity, and we aim to reply within 30 days.
11. Cookies and browser storage
We don't use advertising or tracking cookies. The app saves a few things in your browser's local storage to work properly: your login session, and your light or dark theme choice. Logging out removes the login session.
12. Children
ShipBahi is a business tool for adults. You must be 18 or older to create an account. We don't knowingly collect data about children as users.
13. Changes to this policy
We may update this policy as ShipBahi grows, for example when paid plans start. We'll change the date at the top, and for important changes we'll tell you by email or in the app before they take effect.
14. Contact and grievances
For questions, requests or complaints about privacy, contact our Grievance Officer:
Grievance Officer, ShipBahi
Email: connect2shipbahi@gmail.com
We acknowledge grievances within 72 hours and aim to resolve them within 30 days.