Privacy Policy
1. Who we are
ShipTastic is operated by RoboTastic Limited, a company incorporated in Hong Kong SAR (business registration no. 75229437), 20/F Wellable Commercial Building, 513 Hennessy Road, Causeway Bay, Hong Kong. We handle personal data under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, "PDPO"). For any privacy question or request, contact connect@robotasticlimited.com. This policy covers shiptastictracking.com and the ShipTastic app; it also sets out our processing terms for business customers (Section 9).
2. Data we collect
- Account data: name, work email, company name, country, password (stored only as a bcrypt hash), and your acceptance of the Terms (version, date and time, IP address). If you tick the optional marketing-email box, we also record that choice (date and time, wording version, language, IP address) until you withdraw it.
- Shipment identifiers you enter: container, bill-of-lading, booking, PO/SO numbers, your own references and notes, and the tracking results returned for them.
- Usage and device data: pages viewed, actions taken, IP address, browser (through analytics only after you consent; see cookies).
- Billing data: handled by Stripe; we receive your plan, invoices and payment status, not your card number.
- Messages: what you send us through the contact form or by email.
- Feedback you choose to give: your score and comment if you answer our one-question survey, and your reason if you answer the optional question when you cancel a plan.
3. How we use it
- To provide tracking, alerts, Ask AI answers and your workspace, and to bill your plan (performance of our contract with you).
- To send service messages: verification codes, receipts, renewal and expiry notices, and the alerts you set.
- To operate, secure and improve the product, prevent misuse and resolve disputes (our legitimate business purposes).
- To understand which channels bring users and to measure our advertising, only with your consent (analytics and advertising cookies).
We do not sell personal data, and we do not send marketing email without your consent.
4. Who we share it with
We share data only with the providers we need to run the service, under contracts that bind them to protect it. Analytics and advertising providers receive data only if you accept them in the cookie banner.
| Provider | Purpose | Data |
|---|---|---|
| Stripe | Payments and subscriptions | Billing details and payment status (card data stays with Stripe) |
| Amazon Web Services | Hosting, database and email (SES) | All service data; recipient email for account emails |
| Cloudflare, Inc. | Content delivery and security for the website | IP addresses and request data, to deliver and protect the website |
| Google (Workspace) | Business email, files and our customer records | Name, email, company and message from enquiries and sign-ups; your plan, survey answers and cancellation reason; notes of our replies and calls |
| GoDaddy (Professional Email, powered by Titan) | Our support mailbox, support@shiptastictracking.com | Emails you send to support: your name, email address and what you write or attach |
| Anthropic (Claude) | AI assistant our team uses to sort support and sales emails and draft replies, which a person checks before sending | The content of those emails and the related customer records |
| Container-tracking data providers | Ocean container tracking | Identifiers only: container, B/L or booking numbers; never party names, contacts or cargo values |
| Mapbox | Maps in the app | Vessel and route coordinates |
| Google (Gemini API, paid Tier 2, Global region) | Ask AI answers | Your question and the shipment details needed to answer it: container, vessel, carrier, status, ports, dates and your own references |
| Google (Tag Manager, Analytics 4); PostHog | Website and product analytics | Pages, events, device, IP (only with consent) |
| LinkedIn, Google Ads, Meta, Microsoft Advertising | Advertising conversions and retargeting | Pages, conversion events, browser identifiers (only with consent) |
Ask AI. When you use Ask AI, your question and the relevant shipment data are sent to Google (Gemini API) to generate the answer. We use the paid API tier (Tier 2) with the Global region for our API key; under those paid API terms, Google does not use this data to train its models.
We update this list before adding or replacing a provider that processes customer data.
Legal requests. We disclose personal data to a court, regulator or law-enforcement authority only where the law requires it and after checking the legal basis of the request. Where the law allows, we tell the affected customer before we disclose. We do not otherwise share personal data with governments.
5. Retention
- While your account is active we keep your account and shipment data to provide the service.
- When your subscription ends (after cancellation, at the end of the paid period, or after non-payment), your shipment data and workspace are removed from the service immediately and the account cannot be resumed. Export what you need before then; RoboTastic is not liable for loss of data after a subscription expires.
- Afterwards we keep billing records and an archived copy of the account for 3 months, to resolve billing or contractual disputes and to meet our legal and accounting obligations, then delete it.
- Contact-form messages are kept for as long as needed to answer you and then deleted, and at most for 12 months.
- Survey answers and cancellation reasons are kept while your account is active and for at most 12 months after your subscription ends, then deleted. We may keep totals that do not identify you.
You can ask us to delete your account data at any time.
6. Your rights
Under the PDPO you may ask to access and correct the personal data we hold about you, ask us to delete it, and withdraw any consent you gave (for example for analytics or advertising cookies). To exercise a right, email connect@robotasticlimited.com; we may need to verify your identity, and we respond within 40 days as the PDPO requires. If local law gives you additional rights where you live, tell us and we will honour them where they apply. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and advertising cookies for that browser.
California residents. We do not sell personal information, and we share it for cross-context behavioural advertising only through advertising cookies that run after your consent. To opt out, use the Cookie preferences / Do Not Sell or Share link in the footer of every page (our "Do Not Sell or Share My Personal Information" link), which opens cookie settings, or set the Global Privacy Control signal in your browser, which we honour. You may also ask what personal information we collect, use and disclose, and ask us to delete or correct it, by emailing connect@robotasticlimited.com. We will not treat you differently for exercising these rights.
Users in mainland China. Our servers are located outside mainland China, so personal information you provide is transferred to and stored in Hong Kong SAR and with the providers listed in Section 4. Under the Personal Information Protection Law (PIPL) we ask for your separate consent to this transfer when you create an account. The recipient is RoboTastic Limited, Hong Kong SAR; the purposes are those in Section 3; the categories are those in Section 2; the retention period is in Section 5; and you can exercise your rights to access, copy, correct, delete or withdraw consent by emailing connect@robotasticlimited.com.
Children. The service is for businesses and professional users and is not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe a child has given us information, email us and we will delete it.
7. Cookies
We use essential cookies to run the site and, only with your consent, analytics and advertising cookies. Every cookie is listed in our Cookie Policy. Manage your choice via cookie settings.
8. Security
Our measures include email one-time-code two-factor sign-in, passwords stored as bcrypt hashes, encryption in transit, per-workspace isolation and Stripe-handled payments. Everyone who can access your data is bound by confidentiality. See Security. If a personal-data breach affects your data, we will tell you without undue delay, with the information you need to meet your own obligations.
9. Business customers: processing terms
Where you add personal data inside your shipment data (references, notes, contact names you choose to include), you are the data user for that data and we process it on your behalf, only to provide ShipTastic to you, on your instructions (these terms, your settings and your use of the service), for as long as your account is active. We use the providers listed in Section 4 for that processing and remain responsible for their performance. We will help you answer data-subject requests and meet your own security obligations as far as our role allows, and we make available the information reasonably needed to show compliance. When your account ends, the data is deleted as described in Section 5. Business customers who need a signed agreement can download our Data Processing Addendum (PDF), complete the customer details and send the signed copy to connect@robotasticlimited.com; we countersign and return it.
10. Where data is processed, and changes
We are based in Hong Kong SAR. The providers in Section 4 process data in other countries, including the United States, the European Union and, for our container-tracking data providers, mainland China, under contracts that require them to protect it. Those providers receive shipment identifiers only. We may update this policy; material changes will be posted here with a new date and version.
Language. This policy is written in English. Translations are provided for convenience only; if a translation differs from the English text, the English text prevails.