Privacy Policy

1. What information do we collect?

Information you provide to us

When you create an account, request a demo, submit a form, or contact us, we collect the information you choose to give us. This includes your name, business email address, company name, job title, phone number, and the contents of your message. Brands and 3PLs onboarding onto the platform also provide business details such as monthly order volume, sales channels, warehouse count and locations, warehouse management system (WMS) in use, and square footage.

We also collect the credentials and configuration needed to connect your systems: API keys, OAuth tokens, webhook endpoints, warehouse and node definitions, SKU mappings, and order routing rules. Credentials are stored encrypted and are never returned in API responses or written to application logs.

Order data we receive from connected channels

The core function of the Services is to receive orders from a merchant’s connected sales channels and route them to the correct fulfillment node. To do that, we process the following order data:

• Order and line-item identifiers, SKUs, and quantities
• Order value, currency, and order placement timestamps
• Customer name (the recipient name on the order)
• Shipping address, including street address, city, state or province, postal code, and country
• Shipping method, service level, and any delivery instructions included on the order
• Fulfillment status, tracking numbers, and carrier information returned by the fulfilling 3PL

Business contact details for merchant and 3PL account holders are treated separately from shopper order data — see “Information you provide to us” above.

Information collected automatically

When you visit our website, we automatically collect your IP address, browser type and version, operating system, device characteristics, referring URL, the pages you view, and any UTM campaign parameters in the link you followed. We may derive an approximate city and country from your IP address. We collect this information through cookies and similar technologies, as described in Section 5.

Within the application, we log service diagnostics: API request and response metadata, webhook delivery attempts and outcomes, routing decisions, error traces, and timestamps of user actions.

Information from third parties

We may receive information about you from your connected sales channels and warehouse management systems, from our 3PL partners, and from business data providers, joint marketing partners, and publicly available sources. Information received this way is limited to what is necessary to operate and market the Services.

2. How do we process your information?

We process personal information for the following purposes:

• To create and administer accounts, authenticate users, and manage access
• To deliver the Services: receiving orders from connected channels, selecting a fulfillment node, transmitting orders to the selected 3PL, and returning tracking information to the channel
• To geocode shipping addresses so that orders can be routed to the nearest or most appropriate warehouse
• To match brands with 3PL partners through the marketplace and directory
• To respond to support requests, and to send administrative and service messages about the Services
• To invoice, collect payment, and administer subscriptions
• To send marketing communications where permitted, subject to your preferences and your right to opt out at any time
• To monitor usage, analyze trends, troubleshoot, and improve platform performance and reliability
• To detect, prevent, investigate, and address fraud, abuse, and security incidents
• To comply with legal obligations, enforce our agreements, and establish or defend legal claims
• To protect the vital interests of an individual where processing is necessary to prevent harm

We do not sell personal information, and we do not use shopper order data for advertising, profiling, or any purpose other than performing fulfillment for the merchant that supplied it.

3. What legal bases do we rely on to process your information?

If you are located in the EU, UK, or Switzerland

We process personal information only where we have a valid legal basis under the General Data Protection Regulation (GDPR) or the UK GDPR:

• Consent, which you may withdraw at any time — for example, for marketing emails and non-essential cookies
• Performance of a contract — to provide the Services you or your organization signed up for
• Legitimate interests — to secure and improve the Services, prevent fraud, understand how the Services are used, and market to business contacts, balanced against your rights
• Legal obligation — where processing is required by law
• Vital interests — where processing is necessary to protect someone’s life or safety

Where FulfillPros acts as a processor for a merchant’s order data, the merchant is responsible for establishing the legal basis for that processing, and we act only on the merchant’s documented instructions.

If you are located in Canada

We process personal information with your express or implied consent. In limited cases permitted by law, we may process without consent — for example, to investigate a breach of an agreement or a contravention of law, to prevent fraud, in an emergency threatening someone’s life or safety, or where the information is publicly available as defined by applicable regulations.

4. When and with whom do we share your personal information?

Sub-processors

We engage a deliberately short list of sub-processors. Each is bound by a written agreement requiring confidentiality, security measures no less protective than our own, and processing only on our instructions.

The 3PL partners in the table above are selected by the merchant, not by FulfillPros. A merchant can see exactly which partners receive its order data in the platform, and changing partners changes the recipients.

Other circumstances in which we share information

• With marketplace counterparties: when you use the marketplace or directory to connect with a brand or 3PL, we share the business information needed to evaluate and complete that connection, such as capabilities, requirements, and business contact details.
• With professional advisors: auditors, lawyers, and accountants, where required for the operation of our business.
• For legal reasons: where we believe disclosure is required by law, regulation, legal process, or an enforceable governmental request, or is necessary to protect the rights, property, or safety of FulfillPros, our customers, or others.
• In a business transfer: in connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. The recipient will remain bound by this Privacy Policy or provide equivalent protection.
• With your direction or consent: for any other purpose disclosed to you at the time.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising as those terms are defined under United States state privacy laws.

5. Do we use cookies and other tracking technologies?

We use cookies and similar technologies on our website to keep the site secure, remember your preferences, and understand how visitors use our pages. The categories we use are:

• Essential cookies — required for the site and application to function, including session management, load balancing, and security.
• Analytics cookies — help us understand which pages are visited and how visitors navigate the site, so we can improve it.
• Marketing cookies — used to measure campaign effectiveness and, where permitted, to deliver relevant advertising.

You can control cookies through your browser settings, including refusing or removing them. Disabling essential cookies may prevent parts of the site from working. Where required by law, we request consent before setting non-essential cookies, and you can change your choice at any time.

The FulfillPros application itself sets only essential cookies. No analytics or advertising cookies are used in the authenticated application, and no order data is ever passed to an advertising or analytics provider.

6. Do we offer artificial intelligence-based products?

Some features of the Services use automated and machine-learning techniques — for example, to recommend a fulfillment node, forecast capacity, or suggest 3PL matches. These features operate on order metadata, warehouse capacity, and shipping cost and transit data.

We do not send shopper personal information to any third-party generative AI provider, and we do not use customer order data to train models made available to other customers. Automated decision-making does not produce legal or similarly significant effects on individuals; where you believe it has, you may request human review under Section 11.

7. Is your information transferred internationally?

FulfillPros is based in the United States and our servers are located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), together with supplementary technical and organizational measures, to provide an appropriate level of protection.

Order data may also be transmitted to a 3PL partner located in the country of fulfillment. Merchants choose their fulfillment partners and therefore control where their order data is sent for shipping.

8. How long do we keep your information?

We keep personal information only as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law.

Our retention periods are:

Encrypted backups may hold copies of deleted data for a short period until the backup rotates out of retention, after which the copies are destroyed. Backups are not used to service access requests.

9. How do we keep your information safe?

We maintain technical and organizational measures designed to protect personal information, including encryption in transit using TLS, encryption at rest, an encrypted credential vault, role-based access control on a least-privilege basis, network isolation of production systems, audit logging, and regular review of access and dependencies.

However, no method of transmission over the Internet and no method of electronic storage is completely secure. We cannot guarantee that unauthorized third parties will never defeat our safeguards. You should access the Services only within a secure environment and keep your account credentials confidential.

If we become aware of a personal data breach affecting your information, we will notify you and any applicable regulator within the timeframes required by law.

10. Do we collect information from minors?

The Services are business-to-business tools and are not directed to children. We do not knowingly collect or solicit personal information from anyone under 18 years of age. By using the Services you represent that you are at least 18. If we learn that we have collected personal information from a person under 18, we will deactivate the account and take reasonable steps to delete the information promptly. If you believe we may have such information, contact us at [email protected].

11. What are your privacy rights?

Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — confirm whether we process your personal information and obtain a copy of it
• Correction — have inaccurate or incomplete information corrected
• Deletion (erasure) — request that we delete your personal information, subject to the limits described below
• Portability — receive your information in a structured, machine-readable format
• Restriction and objection — restrict or object to certain processing, including processing based on legitimate interests
• Withdraw consent — at any time, without affecting processing already carried out
• Opt out of marketing — using the unsubscribe link in any marketing email or by contacting us. We will still send service and account messages.
• Non-discrimination — we will not deny you service, charge a different price, or provide a different quality of service because you exercised a privacy right

What an erasure request does and does not cover

If you are a shopper and you send an erasure request to us directly, we will action it against the data we hold as a processor, tell you what was deleted, and forward the request to the merchant that controls the order.

Where a merchant’s sales channel sends us a mandatory data request or redaction webhook — for example Shopify’s customers/data_request, customers/redact, and shop/redact topics — we respond within the timeframe the channel requires and apply the same scope described above.

How to exercise your rights

Email [email protected] with the details of your request, or use our contact form. We respond to rights requests within 30 days, and will tell you if we need an extension permitted by law. We may ask for information to verify your identity before acting, and we will use that information only for verification.

An authorized agent may submit a request on your behalf with written, signed authorization; we may still contact you to confirm the agent’s authority.

If we decline your request you may appeal by replying to our decision. If you are in the EEA or UK, you also have the right to complain to your local supervisory authority or to the UK Information Commissioner’s Office. In Switzerland, you may contact the Federal Data Protection and Information Commissioner.

12. Controls for do-not-track features

Most browsers include a Do-Not-Track (“DNT”) setting. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will update this notice. We do honor Global Privacy Control signals where required by applicable state law.

13. Do United States residents have specific privacy rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have additional rights, including the right to know what personal information is processed, to access and correct it, to request deletion, to obtain a copy, to opt out of targeted advertising, sale, or profiling, and not to be discriminated against for exercising those rights.

The categories of personal information we have collected in the past twelve months are:

We collect this information from you directly, from your connected channels and 3PL partners, automatically through your use of the Services, and from business data providers. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes that require the right to limit under California law.

To exercise any of these rights, email [email protected]. If we deny your request, you may appeal by replying to our response; if your appeal is denied, you may complain to your state attorney general. California residents may also request the information described in the “Shine The Light” law (Cal. Civ. Code § 1798.83) once per year.

14. Do other regions have specific privacy rights?

Australia and New Zealand

We collect, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and the Privacy Act 2020 (NZ) and the Information Privacy Principles. This notice satisfies the requirement to tell you what we collect and why. If you do not provide the information we request, we may be unable to provide the Services. You may seek access to and correction of your information using the contact details in Section 16, and you may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Republic of South Africa

You may request access to and correction of your personal information using the contact details in Section 16. Complaints that we cannot resolve may be directed to the Information Regulator (South Africa).

15. Do we make updates to this notice?

We may update this Privacy Policy from time to time. The revised version will be indicated by an updated “Last updated” date at the top of this page and takes effect as soon as it is posted. If we make material changes, we will notify you either by posting a prominent notice or by contacting you directly. We encourage you to review this notice periodically.

16. How can you contact us about this notice?

If you have questions or comments about this notice, or wish to exercise a privacy right, contact us at:

FulfillPros, Inc.
Privacy and legal: [email protected]
Product support: [email protected]
Web: fulfillpros.ai/contact

Merchants and 3PLs who need a data processing agreement, a sub-processor notification subscription, or a security questionnaire completed should write to [email protected].

17. How can you review, update, or delete the data we collect from you?

Account holders can review and update most of their information directly in the FulfillPros application under account settings. To request a copy of your data, ask us to correct it, or ask us to delete it, email [email protected] from the address associated with your account, or submit our contact form and state that your message is a data subject request.

Before you send a deletion request, please read Section 11, which explains that erasure covers the application’s webhook log and merchant record but not the order record in the fulfillment system of record.