Shipbird
English
Open menu

Shipbird Privacy Policy

Last updated: 21 September 2026

This privacy policy explains how Fuan Tech B.V. processes personal data through Shipbird (https://shipbird.eu).

1. Controller

Fuan Tech B.V.
Winkelveldstraat 14, 5916 NX Venlo, The Netherlands
Chamber of Commerce (KvK): 69872198

Site: https://shipbird.eu
Privacy: [email protected] · Support: [email protected] · Tel: +31 (0)77 777 7788

Shipbird is a B2B platform to create and pay for parcel shipping labels (carriers such as GLS, DPD, PostNL).

2. Data we process

  • Account / business: name, email, phone, company, billing address, KvK/VAT ID, hashed credentials
  • Shipment / label: sender & recipient name, company, address, email, phone; parcel weight/size/reference; customs data if needed; tracking
  • Payments / invoices: amounts, status, Stripe customer/payment references — we do not store full card numbers or CVCs (Stripe does)
  • Technical: IP, device/browser, logs, cookies
  • Support: messages you send us
  • Address fill / validation: when enabled, street, house number, postcode, city and country may be sent server-side to Google so we can complete or check an address (logged-in use of the address fields). Dutch street, postcode and city are also checked server-side against BAG via PDOK Locatieserver. Street name, postcode and city in Germany, Austria, Switzerland and Liechtenstein are checked server-side against OpenPLZ. Belgian street, postcode and city are checked server-side against BeSt Address (FOD BOSA). French street, postcode and city are checked server-side against the Base Adresse Nationale via the IGN Géoplateforme. Danish street, postcode and city are checked server-side against Danmarks Adresseregister via Adressevælger.
  • Usage & session recording: on the customer site (shipbird.eu, not admin) we record pageviews and, via recorder.js, session replays of how the Platform is used (mouse movement, clicks and scrolling) to improve the experience and find errors. To protect your privacy and that of recipients, sensitive input fields (such as names, addresses, emails and other form inputs) are automatically masked in the recording (for example as ***), so those values are not visible in the session replay.

3. Purposes & legal bases (GDPR)

  • Provide the service (labels, account) — contract
  • Payments, invoicing, VAT — contract / legal obligation
  • Address autocomplete and validation — contract / legitimate interests
  • Security & fraud prevention — legitimate interests
  • Support — contract / legitimate interests
  • Legal compliance (tax retention) — legal obligation
  • Usage analytics and session recording (product improvement) — legitimate interests
  • Marketing emails — consent only (withdraw anytime)

4. Recipients

  • Stripe — payments, invoicing, tax: https://stripe.com/privacy
  • Amazon SES — transactional email (account, invoices, labels). Message content is the account or billing address plus the email body. AWS privacy: https://aws.amazon.com/privacy/
  • Carriers (GLS, DPD, PostNL, etc.) — label creation & delivery (may act as independent controllers)
  • Google — Places Autocomplete, Place Details and Address Validation, called server-side only via /api/v1/places* when configured. The API key is never in the browser; we do not load Google Maps JavaScript, so this feature sets no Google third-party cookies. Google’s privacy policy: https://policies.google.com/privacy
  • PDOK / Kadaster (BAG) — Dutch postcode, city and street checks plus NL street autocomplete via the public Locatieserver, called server-side only. Kadaster privacy: https://www.kadaster.nl/privacy
  • OpenPLZ — postcode, city and street-name checks plus street autocomplete for Germany, Austria, Switzerland and Liechtenstein via the public OpenPLZ API, called server-side only. OpenPLZ FAQ: https://www.openplzapi.org/en/faq/
  • BeSt Address (FOD BOSA) — Belgian postcode, municipality and street checks, plus street autocomplete once a Belgian postcode is filled, via the public BeSt Address API, called server-side only. Source: https://opendata.bosa.be/index.nl.html
  • IGN Géoplateforme (Base Adresse Nationale) — French postcode, city and street checks, plus street autocomplete once a French postcode is filled, called server-side only. https://data.geopf.fr/geocodage/search
  • Adressevælger (Klimadatastyrelsen) — Danish postcode, city and street checks, plus street autocomplete once a Danish postcode is filled, called server-side only. https://adressevaelger.dk
  • Hosting (cloud providers and related infra) — as processors
  • Umami (self-hosted on our own instance) — customer app only: script.js for pageview analytics and recorder.js for session recording / DOM replay. Data goes to our instance, not an Umami cloud. Sensitive input fields are automatically masked (for example as ***) before the recording is sent; replays are mainly clicks, scrolling and UX behaviour, not clear-text form input.
  • Authorities when legally required

We do not sell personal data.

5. International transfers

Providers such as Stripe, Google, and Amazon SES may process data outside the EEA (e.g. US) with appropriate safeguards (adequacy / SCCs) as described by those providers. SES is configured for an EU region when possible (eu-central-1). Self-hosted Umami runs on our own hosting stack.

6. Retention

Kept only as long as needed. Orders, labels and invoices typically up to 7 years (Dutch tax/accounting). Account data while active + reasonable wind-down. Logs shorter unless needed for security. Usage stats and session recordings are kept only as long as needed for analysis and product improvement.

7. Security

HTTPS/TLS, access controls, password hashing, no storage of full card data (PCI via Stripe). Google address APIs are server-side only (no API key in the browser).

8. Cookies and similar technologies

  • Essential session / auth cookies (Better Auth) to stay signed in. On the customer site these are host-only and are not shared with admin.shipbird.eu.
  • Google Places: no browser cookies from this feature (server-side calls only; no Google Maps JS).
  • Umami: as of this policy (21 September 2026) Umami sets no cookies on shipbird.eu. It may use localStorage (for example umami.disabled). Pageviews and session recording still run via scripts.
  • Functional preferences may be stored in a cookie or local storage (for example language).
  • Stripe payment pages may set their own cookies on Stripe’s domain.

You can manage cookies in your browser. Blocking essential cookies will stop sign-in from working.

9. Your rights

Access, rectification, erasure, restriction, portability, objection, withdraw consent. Contact [email protected]. Complaint: Autoriteit Persoonsgegevens — https://autoriteitpersoonsgegevens.nl

10. Children

B2B service; not directed at under-18s.

11. Changes

We may update this policy; the date above will change. Material changes may be notified via site or email.

12. Contact

Fuan Tech B.V. / Shipbird — [email protected]

Use of Shipbird is also governed by our Terms & Conditions.