Privacy Policy

WOOLII, LLC is responsible for processing associated with platform accounts, customer relationships and its own business activities. When processing merchant customers’ delivery information on a merchant’s instructions, the parties’ roles depend on the actual activity and applicable law; where applicable, we act as the merchant’s processor or service provider. Processing for our own security, accounting or legal obligations must be assessed separately by its actual purpose.

This policy covers visitors, registered users, merchant contacts and other individuals involved in the services. Sign-in providers, commerce platforms and payment institutions provide their own notices for processing they independently determine. Do not provide identity documents, health, financial or other sensitive information unrelated to the service needed.

Depending on the features you use, we process the following information; not every category applies to every person:

• Account and verification information: name, email, country or region, a password hash, verification and sign-in records; for third-party sign-in, the account identifier, name, email, profile image and verification information supplied by that provider.
• Merchant application and contract information: business identity, registration and address details, contact role and contact information, store or business website, business volume, goods and destinations, supporting information needed for review, and agreement versions, service scope, discounts and confirmation records.
• Instructions and fulfillment information: sender and recipient name, address, phone and applicable contact information; goods, declarations, orders, parcels, weight and dimensions, warehouse operations, photos, tracking events and necessary customs information. Sources include you, connected stores, senders, warehouses and transport partners.
• Payment and reconciliation information: bills, amounts, currency, payment status, transaction references, refunds and wallet entries. Payment processors handle card payments; we do not store full card numbers.
• Support and communications: messages, tickets and attachments you submit, and relevant account and order information consulted to address the issue.
• Technical and usage information: IP address, browser and device information, session and security records, page and feature events, and the cookies, acquisition and advertising-measurement data you permit.
• Referral and benefit information: referrals, affiliate or promotional activities you join, and associated rewards.

Some information is necessary to create an account, review a business or complete a particular instruction; without it, the relevant operation may not be possible. Optional analytics and marketing choices are not required for registration.

We use relevant information to create and verify accounts, review merchants and record contracts; provide requested receiving, storage, packing, shipping and other activated services; handle quotations, payments, billing and refunds; coordinate necessary delivery and customs work; provide support and essential notices; prevent fraud, protect systems, troubleshoot, address disputes and meet legal obligations. Optional analytics, advertising measurement and promotions follow section 6 and the relevant choices.

Where EU or UK data-protection law applies, the ground depends on the activity: necessity for a contract with you or steps requested by you before contracting; an applicable legal obligation; legitimate interests balanced against your rights, such as business-contact administration, system security, fraud prevention and handling legal claims; or consent for a specific optional purpose. Including a purpose in a contract does not by itself make it necessary for performance.

Elsewhere, processing grounds are determined under applicable law. Sensitive information, disclosures or transfers requiring separate or explicit consent must follow the relevant rules. Withdrawing consent does not affect the lawfulness of consent-based processing before withdrawal, or automatically end processing that remains necessary on another lawful ground.

To perform your requested services, relevant necessary information is provided to the warehouses, transport, delivery and customs-service providers involved, and to customs or other authorities where legally required. We also use providers for hosting, databases, file storage, email, payments, support and technical operations. Processing instructions, confidentiality, security and permitted purposes must reflect each provider’s actual role; recipients independently determining their purposes are responsible for that processing.

Necessary information may be disclosed to respond to valid legal requirements, address disputes, maintain safety and protect lawful rights. Disclosures during a business reorganization or transfer remain subject to applicable law and purpose restrictions, with further notice where required. Accepting the account terms does not give us unrestricted permission to disclose information.

If a merchant connects a commerce platform, we process store identity, installation and authorization records, product and SKU references, order and fulfillment identifiers, recipient name, delivery address, phone number, email address, tracking data and operational notes only as needed to provide fulfillment, support, reconciliation, fraud prevention and legal compliance, including completing customs-declaration information for cross-border shipments. Customer email addresses are read on demand and used only to collect missing customs-declaration information, such as applicable EU IOSS particulars or destination tax identifiers, and as a fallback contact for delivery issues. They are not persisted in our systems or used for marketing. For Shopify, access tokens are encrypted at rest, app requests use short-lived Shopify session tokens, and webhook authenticity is verified before processing a payload.

The merchant remains responsible for appropriate customer notices and a lawful basis to instruct Woolii to process delivery data. Woolii acts as a service provider or processor for that merchant where applicable. We do not sell merchant customer data or use it for unrelated advertising. We restrict staff access by role, keep an integration-event audit trail without retaining raw webhook bodies, separate development validation from production use, and delete or de-identify platform data where required, subject to records that must be retained for shipping, customs, tax, security, disputes or other legal obligations.

Shopify privacy requests are handled through the mandatory customers/data_request, customers/redact and shop/redact webhooks. Merchants and customers may also contact support@woolii.com to exercise access, deletion or other privacy rights.

Necessary session, security and verification features operate the account and website. Optional analytics, marketing and preference features follow your Cookie Settings choices, which you can reopen to change or withdraw. Rejecting optional cookies does not prevent basic registration or logistics services.

Analytics you permit include page and feature usage, acquisition source, and internal analysis of first-shipment steps and error codes. Some events are linked to your signed-in account, without recording the relevant form contents. When we use Google or other analytics or advertising-measurement tools, device, page, acquisition and permitted conversion information is processed according to the relevant choices.

When you consent to both analytics and marketing cookies, we use OpenAI’s ChatGPT Ads pixel and server conversion API to measure advertising. We send the advertising click identifier and the time of a registration, parcel forecast or confirmed paid order; paid-order events include the payment amount and currency. Our server events do not include your name, email, delivery address or parcel contents. The browser pixel receives landing-page, browser and device information and may use hashed matching identifiers where advanced matching is enabled. These events are sent with OpenAI’s opt-out flag for future user-level personalization.

A shared cookie carries the ChatGPT advertising click identifier between woolii.com and porter.woolii.com for up to 30 days. You can withdraw consent in Cookie Settings; withdrawal stops future pixel measurement and pending server transmissions. Events already received by OpenAI remain subject to OpenAI’s privacy practices. Hashing or using a click identifier does not automatically make data anonymous.

If you use the WooliiPorter app for iOS or Android, the account, shipment, payment and support information described in this policy is processed in the same way as on the website. The app also involves the following:

• Signed-in devices: we keep a record of each device signed in to your account (device name, platform, app version and sign-in method) so you can review and sign out devices, and to protect the account.
• Push notifications: if you allow notifications, the app obtains a push token from Apple or Google, which we deliver through Expo, our notification provider. We use it to send the account, shipment, payment and support notices you have turned on. You can turn notifications off in the app or in your device settings.
• Photos: the app reads only the photos you choose to attach to a support ticket.
• Face ID and fingerprint: unlocking the app or confirming a payment with biometrics happens on your device. We receive only whether the check succeeded, never biometric data.
• Address search: when you search for a delivery address, the text you type and the selected country are sent through our servers to Google Places to suggest matching addresses.
• Card payments: card details entered in the app's payment sheet go directly to Stripe, which processes the payment. We do not receive or store full card numbers.
• Sign in with Google: if you choose it, we receive the name, email address and account identifier Google shares with us.

The apps contain no advertising or analytics SDKs, do not use the device's advertising identifier and do not track you across other companies' apps or websites. Information the app stores on your phone, such as search history and preferences, stays on the phone; signing out removes account data stored there.

If you use automated support in your account, the system processes your messages and may consult your identity and relevant account, order and ticket information to respond or create a staff support ticket. This may involve the technology and model providers supporting that feature. Do not enter sensitive information unrelated to your question. Automated responses may be inaccurate; refunds, claims or exceptions requiring staff judgment should be handled through a support ticket. Account registration itself does not authorize unrelated model training with your information.

We are a US business, relevant warehouse operations take place in China, and international delivery involves destination countries or regions. Information may cross borders because of these operations and providers’ processing locations; local protections may differ from those where you live.

International processing must satisfy the laws that actually apply. Where additional information, specific safeguards or separate consent is required, it must be addressed before the relevant processing; this policy and the registration button do not replace those requirements. You may contact us about recipients, processing countries or regions, and safeguards applicable to the services you use.

Necessary retention depends on the actual purpose, whether the account or business is active, goods in storage or transit, outstanding settlements, refunds or disputes, and applicable customs, tax, accounting and other record obligations. Agreement acceptance and necessary operational evidence are retained to the extent needed to establish relevant rights and duties and handle disputes. There is no single permanent retention period for all data. Known optional-cookie periods are stated in the relevant disclosures.

When no lawful retention reason remains, information must be deleted, anonymized or restricted from further use as required by law. Account closure does not necessarily require immediate deletion of records that must lawfully be retained, nor does it justify unlimited additional retention purposes.

We use safeguards proportionate to actual risks, including access controls and password hashing. No system can be guaranteed absolutely secure. Protect your credentials and report unusual activity promptly. Personal-information incidents will be addressed according to their circumstances and applicable law.

You can update editable account information, change Cookie Settings, and submit privacy requests through support or support@woolii.com. We may request identity or authority evidence proportionate to the request. We will respond within applicable legal deadlines and explain any restriction on fulfilling the request and available further steps.

You can delete a personal account in the app (Me → Settings → Delete account) or by following the steps at woolii.com/account-deletion. Deletion closes and deactivates the account immediately: every device is signed out, you can no longer sign in, and the email address is released for a new account. The account's data is retained, not erased, including profile, contact details, addresses, recipient tax IDs, shipments, declarations, payments, wallet records, coupons and notifications, because customs and tax rules require shipment records to be kept (section 10). You can ask support@woolii.com to erase personal information that the law does not require us to keep.

Depending on the law that applies, rights may include information about processing, access and copies, correction, deletion, restriction or objection, a portable copy, withdrawal of consent, and complaints to a competent authority. Where relevant US state privacy laws apply and the processing occurs, rights may also include opting out of sale, sharing for cross-context behavioral advertising or targeted advertising; limiting certain sensitive-information uses; choices concerning profiling with legally significant effects; and appeal of a request decision. We will not unlawfully discriminate against you for exercising these rights.

Conditions and exceptions are determined by law, not solely by nationality, language or the website version selected. Merchant customers may contact the merchant from whom they bought goods; we will handle or assist with requests according to our actual role, and will not disregard an applicable request merely because you do not hold a platform account.

Account registration and contracting are intended for people with the necessary legal capacity. Children should not register independently or provide children’s information unrelated to a service. Contact us if you believe children’s information has been handled improperly so we can investigate and take legally appropriate steps. An adult providing information necessary to deliver to a minor must still have appropriate authority and meet applicable protections.

This policy displays its version and update date. Material changes in information categories, purposes, recipients or important rights will be explained through proportionate further notice. Renewed or separate consent will be obtained where required. Continued use alone is not consent to a new optional purpose. Editing this policy does not rewrite existing agreement-acceptance records.

Responsible entity: WOOLII, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Privacy contact: support@woolii.com or the support channels at porter.woolii.com.