Privacy Policy
Last updated: September 18, 2026
FulfillPros is a product of ETechSphere Inc., an Illinois corporation (“ETechSphere,” “we,” “our,” or “us”). This Privacy Policy describes how ETechSphere collects, uses, discloses, and safeguards information when you visit fulfillpros.ai, install or use the FulfillPros application, or otherwise interact with our services (together, the “Services”). ETechSphere is the entity responsible for the processing described here; “FulfillPros” refers to the product through which that processing happens.
ETechSphere plays two different roles, and your rights depend on which one applies:
- As a controller. For information about visitors to our website and about the merchants, brands, and third-party logistics providers (“3PLs”) who hold FulfillPros accounts, we decide why and how the information is processed.
- As a processor (service provider). For order data we receive from a merchant’s connected sales channels, the merchant is the controller and ETechSphere acts on the merchant’s instructions. If you are a shopper whose order passed through FulfillPros, the merchant you bought from is the controller of that order data, and requests about it are handled as described in Section 11.
The short version of what matters most: we process order data — including customer name and shipping address — but we do not collect shopper email addresses or phone numbers, and raw webhook payloads are deleted on a five-day cycle. The detail is below.
1. What information do we collect?
Information you provide to us
When you create an account, request a demo, submit a form, or contact us, we collect the information you choose to give us. This includes your name, business email address, company name, job title, phone number, and the contents of your message. Brands and 3PLs onboarding onto the platform also provide business details such as monthly order volume, sales channels, warehouse count and locations, warehouse management system (WMS) in use, and square footage.
We also collect the credentials and configuration needed to connect your systems: API keys, OAuth tokens, webhook endpoints, warehouse and node definitions, SKU mappings, and order routing rules. Credentials are stored encrypted and are never returned in API responses or written to application logs.
Order data we receive from connected channels
The core function of the Services is to receive orders from a merchant’s connected sales channels and route them to the correct fulfillment node. To do that, we process the following order data:
- Order and line-item identifiers, SKUs, and quantities
- Order value, currency, and order placement timestamps
- Customer name (the recipient name on the order)
- Shipping address, including street address, city, state or province, postal code, and country
- Shipping method, service level, and any delivery instructions included on the order
- Fulfillment status, tracking numbers, and carrier information returned by the fulfilling 3PL
ETechSphere does not collect shopper email addresses or phone numbers. Where a connected sales channel includes an email address or phone number in an order webhook, that field is dropped before the order is persisted and is not forwarded to any 3PL partner, sub-processor, or downstream system. We do not need it: order routing is performed on the shipping address, and customer notifications are sent by your sales channel, not by us.
Business contact details for merchant and 3PL account holders are treated separately from shopper order data — see “Information you provide to us” above.
Information collected automatically
When you visit our website, we automatically collect your IP address, browser type and version, operating system, device characteristics, referring URL, the pages you view, and any UTM campaign parameters in the link you followed. We may derive an approximate city and country from your IP address. We collect this information through cookies and similar technologies, as described in Section 5.
Within the application, we log service diagnostics: API request and response metadata, webhook delivery attempts and outcomes, routing decisions, error traces, and timestamps of user actions.
Information from third parties
We may receive information about you from your connected sales channels and warehouse management systems, from our 3PL partners, and from business data providers, joint marketing partners, and publicly available sources. Information received this way is limited to what is necessary to operate and market the Services.
2. How do we process your information?
We process personal information for the following purposes:
- To create and administer accounts, authenticate users, and manage access
- To deliver the Services: receiving orders from connected channels, selecting a fulfillment node, transmitting orders to the selected 3PL, and returning tracking information to the channel
- To geocode shipping addresses so that orders can be routed to the nearest or most appropriate warehouse
- To match brands with 3PL partners through the marketplace and directory
- To respond to support requests, and to send administrative and service messages about the Services
- To invoice, collect payment, and administer subscriptions
- To send marketing communications where permitted, subject to your preferences and your right to opt out at any time
- To monitor usage, analyze trends, troubleshoot, and improve platform performance and reliability
- To detect, prevent, investigate, and address fraud, abuse, and security incidents
- To comply with legal obligations, enforce our agreements, and establish or defend legal claims
- To protect the vital interests of an individual where processing is necessary to prevent harm
We do not sell personal information, and we do not use shopper order data for advertising, profiling, or any purpose other than performing fulfillment for the merchant that supplied it.
3. What legal bases do we rely on to process your information?
If you are located in the EU, UK, or Switzerland
We process personal information only where we have a valid legal basis under the General Data Protection Regulation (GDPR) or the UK GDPR:
- Consent, which you may withdraw at any time — for example, for marketing emails and non-essential cookies
- Performance of a contract — to provide the Services you or your organization signed up for
- Legitimate interests — to secure and improve the Services, prevent fraud, understand how the Services are used, and market to business contacts, balanced against your rights
- Legal obligation — where processing is required by law
- Vital interests — where processing is necessary to protect someone’s life or safety
Where ETechSphere acts as a processor for a merchant’s order data, the merchant is responsible for establishing the legal basis for that processing, and we act only on the merchant’s documented instructions.
If you are located in Canada
We process personal information with your express or implied consent. In limited cases permitted by law, we may process without consent — for example, to investigate a breach of an agreement or a contravention of law, to prevent fraud, in an emergency threatening someone’s life or safety, or where the information is publicly available as defined by applicable regulations.
4. When and with whom do we share your personal information?
Sub-processors
We engage a deliberately short list of sub-processors. Each is bound by a written agreement requiring confidentiality, security measures no less protective than our own, and processing only on our instructions.
| Sub-processor | Purpose | Data involved |
|---|---|---|
| DigitalOcean, LLC | Cloud hosting, managed database, and object storage for the application (United States regions) | All platform data, including the webhook log, order routing records, and merchant records |
| Your 3PL partners | Physical fulfillment of orders — receiving, picking, packing, and shipping — by the fulfillment providers a merchant selects | Order data required to ship, including customer name and shipping address. No shopper email address or phone number is transmitted. |
| Google Maps Platform (Google LLC) | Geocoding of shipping addresses so orders can be routed to the nearest fulfillment node | Shipping address only. Customer name is not sent for geocoding. |
| HubSpot, Inc. | Customer relationship management for website enquiries and marketing communications | Business contact details submitted through our website forms. No shopper order data. |
The 3PL partners in the table above are selected by the merchant, not by ETechSphere. A merchant can see exactly which partners receive its order data in the platform, and changing partners changes the recipients.
Other circumstances in which we share information
- With marketplace counterparties: when you use the marketplace or directory to connect with a brand or 3PL, we share the business information needed to evaluate and complete that connection, such as capabilities, requirements, and business contact details.
- With professional advisors: auditors, lawyers, and accountants, where required for the operation of our business.
- For legal reasons: where we believe disclosure is required by law, regulation, legal process, or an enforceable governmental request, or is necessary to protect the rights, property, or safety of ETechSphere, our customers, or others.
- In a business transfer: in connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. The recipient will remain bound by this Privacy Policy or provide equivalent protection.
- With your direction or consent: for any other purpose disclosed to you at the time.
We do not sell personal information and we do not share personal information for cross-context behavioral advertising as those terms are defined under United States state privacy laws.
5. Do we use cookies and other tracking technologies?
We use cookies and similar technologies on our website to keep the site secure, remember your preferences, and understand how visitors use our pages. The categories we use are:
- Essential cookies — required for the site and application to function, including session management, load balancing, and security.
- Analytics cookies — help us understand which pages are visited and how visitors navigate the site, so we can improve it.
- Marketing cookies — used to measure campaign effectiveness and, where permitted, to deliver relevant advertising.
You can control cookies through your browser settings, including refusing or removing them. Disabling essential cookies may prevent parts of the site from working. Where required by law, we request consent before setting non-essential cookies, and you can change your choice at any time.
The FulfillPros application itself sets only essential cookies. No analytics or advertising cookies are used in the authenticated application, and no order data is ever passed to an advertising or analytics provider.
6. Do we offer artificial intelligence-based products?
Some features of the Services use automated and machine-learning techniques — for example, to recommend a fulfillment node, forecast capacity, or suggest 3PL matches. These features operate on order metadata, warehouse capacity, and shipping cost and transit data.
We do not send shopper personal information to any third-party generative AI provider, and we do not use customer order data to train models made available to other customers. Automated decision-making does not produce legal or similarly significant effects on individuals; where you believe it has, you may request human review under Section 11.
7. Is your information transferred internationally?
ETechSphere is based in the United States and our servers are located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States.
Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), together with supplementary technical and organizational measures, to provide an appropriate level of protection.
Order data may also be transmitted to a 3PL partner located in the country of fulfillment. Merchants choose their fulfillment partners and therefore control where their order data is sent for shipping.
8. How long do we keep your information?
We keep personal information only as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law.
Webhook payloads retained 5 days. The raw payload of every webhook we receive from a connected sales channel is written to a webhook log so that failed deliveries can be retried and support issues can be diagnosed. Each entry in that log, including any customer name and shipping address it contains, is permanently deleted five days after receipt. This deletion is automatic and requires no action by the merchant or the shopper.
Our retention periods are:
| Data | Retention period |
|---|---|
| Raw webhook payloads (webhook log) | 5 days from receipt, then permanently deleted |
| Order routing records (order reference, node selected, timestamps, status) | Life of the merchant account, then deleted within 30 days of account closure |
| Merchant record (account, business contact details, integration configuration, credentials) | Life of the account, then deleted within 30 days of account closure or a verified erasure request |
| Geocoding results for shipping addresses | Cached up to 30 days to avoid repeat lookups, then discarded |
| Website visit and campaign analytics | Up to 24 months |
| Marketing and enquiry contact records | Until you unsubscribe or request deletion, and up to 24 months after your last interaction with us |
| Invoices and financial records | As required by tax and accounting law, generally 7 years |
Encrypted backups may hold copies of deleted data for a short period until the backup rotates out of retention, after which the copies are destroyed. Backups are not used to service access requests.
9. How do we keep your information safe?
We maintain technical and organizational measures designed to protect personal information, including encryption in transit using TLS, encryption at rest, an encrypted credential vault, role-based access control on a least-privilege basis, network isolation of production systems, audit logging, and regular review of access and dependencies.
However, no method of transmission over the Internet and no method of electronic storage is completely secure. We cannot guarantee that unauthorized third parties will never defeat our safeguards. You should access the Services only within a secure environment and keep your account credentials confidential.
If we become aware of a personal data breach affecting your information, we will notify you and any applicable regulator within the timeframes required by law.
10. Do we collect information from minors?
The Services are business-to-business tools and are not directed to children. We do not knowingly collect or solicit personal information from anyone under 18 years of age. By using the Services you represent that you are at least 18. If we learn that we have collected personal information from a person under 18, we will deactivate the account and take reasonable steps to delete the information promptly. If you believe we may have such information, contact us at [email protected].
11. What are your privacy rights?
Your rights
Depending on where you live, you may have some or all of the following rights:
- Access — confirm whether we process your personal information and obtain a copy of it
- Correction — have inaccurate or incomplete information corrected
- Deletion (erasure) — request that we delete your personal information, subject to the limits described below
- Portability — receive your information in a structured, machine-readable format
- Restriction and objection — restrict or object to certain processing, including processing based on legitimate interests
- Withdraw consent — at any time, without affecting processing already carried out
- Opt out of marketing — using the unsubscribe link in any marketing email or by contacting us. We will still send service and account messages.
- Non-discrimination — we will not deny you service, charge a different price, or provide a different quality of service because you exercised a privacy right
What an erasure request does and does not cover
When we act on an erasure request, we delete the relevant entries in the application’s webhook log and the associated merchant record. We do not delete the order record held in the fulfillment system of record — that is, the record inside the warehouse management system of the 3PL that physically fulfilled the order, and the record held by the sales channel where the order was placed.
Those systems are operated by the merchant and its 3PL partner as separate controllers, and they retain order records under their own retention schedules and legal obligations, including tax, customs, and commercial-record requirements. ETechSphere cannot delete data from them. To have an order record erased there, address your request to the merchant you purchased from, which can then instruct its 3PL partner.
If you are a shopper and you send an erasure request to us directly, we will action it against the data we hold as a processor, tell you what was deleted, and forward the request to the merchant that controls the order.
Where a merchant’s sales channel sends us a mandatory data request or redaction webhook — for example Shopify’s customers/data_request, customers/redact, and shop/redact topics — we respond within the timeframe the channel requires and apply the same scope described above.
How to exercise your rights
Email [email protected] with the details of your request, or use our contact form. We respond to rights requests within 30 days, and will tell you if we need an extension permitted by law. We may ask for information to verify your identity before acting, and we will use that information only for verification.
An authorized agent may submit a request on your behalf with written, signed authorization; we may still contact you to confirm the agent’s authority.
If we decline your request you may appeal by replying to our decision. If you are in the EEA or UK, you also have the right to complain to your local supervisory authority or to the UK Information Commissioner’s Office. In Switzerland, you may contact the Federal Data Protection and Information Commissioner.
12. Controls for do-not-track features
Most browsers include a Do-Not-Track (“DNT”) setting. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will update this notice. We do honor Global Privacy Control signals where required by applicable state law.
13. Do United States residents have specific privacy rights?
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have additional rights, including the right to know what personal information is processed, to access and correct it, to request deletion, to obtain a copy, to opt out of targeted advertising, sale, or profiling, and not to be discriminated against for exercising those rights.
The categories of personal information we have collected in the past twelve months are:
| Category | Collected |
|---|---|
| A. Identifiers (name, postal address, IP address, email address of business contacts) | Yes |
| B. Personal information under Cal. Civ. Code § 1798.80 (name, contact and billing details) | Yes |
| C. Protected classification characteristics | No |
| D. Commercial information (subscriptions, transactions, order records) | Yes |
| E. Biometric information | No |
| F. Internet or network activity (site and app usage) | Yes |
| G. Geolocation data (approximate location from IP address; geocoded shipping addresses) | Yes |
| H. Audio, electronic, visual, or similar information | No |
| I. Professional or employment information (job title, company) | Yes |
| J. Education information | No |
| K. Inferences drawn from the above | No |
| L. Sensitive personal information (account log-in credentials) | Yes |
We collect this information from you directly, from your connected channels and 3PL partners, automatically through your use of the Services, and from business data providers. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes that require the right to limit under California law.
To exercise any of these rights, email [email protected]. If we deny your request, you may appeal by replying to our response; if your appeal is denied, you may complain to your state attorney general. California residents may also request the information described in the “Shine The Light” law (Cal. Civ. Code § 1798.83) once per year.
14. Do other regions have specific privacy rights?
Australia and New Zealand
We collect, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and the Privacy Act 2020 (NZ) and the Information Privacy Principles. This notice satisfies the requirement to tell you what we collect and why. If you do not provide the information we request, we may be unable to provide the Services. You may seek access to and correction of your information using the contact details in Section 16, and you may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.
Republic of South Africa
You may request access to and correction of your personal information using the contact details in Section 16. Complaints that we cannot resolve may be directed to the Information Regulator (South Africa).
15. Do we make updates to this notice?
We may update this Privacy Policy from time to time. The revised version will be indicated by an updated “Last updated” date at the top of this page and takes effect as soon as it is posted. If we make material changes, we will notify you either by posting a prominent notice or by contacting you directly. We encourage you to review this notice periodically.
16. How can you contact us about this notice?
If you have questions or comments about this notice, or wish to exercise a privacy right, contact us at:
ETechSphere Inc. (FulfillPros)
2150 E Lake Cook Rd, Suite 900
Buffalo Grove, IL 60089
Privacy and legal: [email protected]
Product support: [email protected]
Web: fulfillpros.ai/contact
Merchants and 3PLs who need a data processing agreement, a sub-processor notification subscription, or a security questionnaire completed should write to [email protected].
17. How can you review, update, or delete the data we collect from you?
Account holders can review and update most of their information directly in the FulfillPros application under account settings. To request a copy of your data, ask us to correct it, or ask us to delete it, email [email protected] from the address associated with your account, or submit our contact form and state that your message is a data subject request.
Before you send a deletion request, please read Section 11, which explains that erasure covers the application’s webhook log and merchant record but not the order record in the fulfillment system of record.