Privacy Policy

WooliiPorter operates a cross-border parcel-forwarding and consolidation platform. Buyers of Chinese e-commerce products have their parcels delivered to our warehouse in China, where we receive, store, consolidate, and forward them internationally to approximately 51 countries and regions across North America, Europe, Southeast Asia, Oceania, and beyond.

This Policy applies to personal information we process about our customers, website visitors, and other users of our services worldwide. Because our users are located around the world, this Policy also addresses rights and protections under the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as well as international transfers of personal data.

This Policy does not apply to third-party websites, merchants, or services that we do not control, even where we link to them or interact with them on your behalf.

We collect the following categories of personal information:

• Account information: your name, email address, and a hashed (encrypted) version of your password. We do not store your password in plain text.
• Shipping and address information: the shipping and recipient addresses you provide for delivering parcels, including recipient name, address, postal code, and contact details.
• Order and parcel information: details about the parcels you send to our warehouse and the orders you place, such as parcel contents descriptions, declared value, weight and dimensions, photos of items, consolidation instructions, and tracking numbers.
• Payment information: payments are processed by our third-party payment processors, Stripe and PayPal. We do not collect or store your full payment card numbers. We may receive limited transaction-related information such as confirmation of payment, the last digits of a card, or a transaction identifier.
• Support information: information you provide when you contact us or open a support ticket, including the content of your messages and any attachments.
• Cookies, usage, and device information: information collected automatically when you use our website, such as your IP address, browser type, device identifiers, pages viewed, and interactions with our services, collected through cookies and analytics tools (see Section 7).
• Affiliate program information: if you participate in our affiliate program, we process information related to referrals and any associated rewards.

We use your personal information to:

• Provide our core services, including receiving, storing, consolidating, and forwarding your parcels internationally.
• Create and manage your account and authenticate you when you log in.
• Process your orders and payments through our payment processors, and issue receipts and refunds.
• Arrange delivery with logistics carriers and complete customs declarations required for international shipping.
• Communicate with you about your orders, parcels, shipping status, and service updates, and respond to your support requests.
• Operate, maintain, secure, and improve our website and services, including troubleshooting, analytics, and fraud prevention.
• Administer our affiliate program and any promotions, coupons, or referral rewards you take part in.
• Comply with our legal obligations, including customs, tax, and record-keeping requirements, and to enforce our terms and protect our rights.

Where the GDPR applies, we rely on the following legal bases to process your personal information:

• Performance of a contract: to provide the services you request, including forwarding, consolidating, and delivering your parcels and managing your account.
• Consent: for certain activities, such as non-essential cookies and analytics, and optional marketing communications, where required. You may withdraw your consent at any time.
• Legitimate interests: to operate, secure, and improve our services, prevent fraud and abuse, and administer our affiliate program, provided these interests are not overridden by your rights and freedoms.
• Legal obligation: to comply with applicable laws, including customs and tax requirements, and lawful requests from public authorities.

We do not sell your personal information. We share personal information only as described below:

• Logistics carriers: we share recipient name, address, contact details, and parcel information with the third-party carriers that transport your parcels so they can complete delivery.
• Customs authorities: we share the information required for customs declarations and clearance, including recipient details and parcel contents and value, with the relevant customs authorities.
• Payment processors: Stripe and PayPal process your payments and receive the information necessary to complete transactions. Their handling of your data is governed by their own privacy policies.
• Service providers: we share information with vendors who help us operate our services, such as hosting, storage, analytics, email delivery, and customer support tools, under obligations of confidentiality and data protection.
• Legal and compliance: we may disclose information where required to comply with applicable law, respond to lawful requests from authorities, enforce our terms, or protect the rights, property, or safety of WooliiPorter, our users, or others.
• Business transfers: if we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

Because WooliiPorter provides cross-border forwarding services, your personal information is processed in China, where our warehouse operations are based, and may be processed in or transferred to other countries where we or our service providers operate. Forwarding your parcels also necessarily involves sharing recipient and parcel information with carriers and customs authorities in the destination country.

The data protection laws of these countries may differ from those in your country of residence. Where we transfer personal information internationally, including from the EU, UK, or California, we take steps to ensure appropriate safeguards are in place consistent with applicable law, and we share personal information only to the extent necessary to provide the services you request and to meet legal and customs requirements.

We use cookies and similar technologies on our website:

• Essential cookies: necessary for the website to function, such as keeping you logged in and maintaining your session and security. These cannot be switched off without affecting core functionality.
• Analytics cookies: used to understand how visitors use our website so we can improve it. We use analytics tools such as Google Analytics, which may collect information such as your IP address, device and browser information, and pages viewed.

You can control cookies through your browser settings, including blocking or deleting cookies, though this may affect how the website works. Where required, we ask for your consent before setting non-essential cookies. For Google Analytics, you can also use Google's opt-out browser add-on to limit data collection.

We retain your personal information for as long as necessary to provide the services you request, maintain your account, and fulfill the purposes described in this Policy. We also retain certain information for as long as necessary to comply with our legal obligations, including customs, tax, and record-keeping requirements, to resolve disputes, and to enforce our agreements.

When personal information is no longer needed for these purposes, we take reasonable steps to delete it or anonymize it.

We take reasonable technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, and loss. For example, passwords are stored in hashed form rather than plain text, and payment card details are handled by our payment processors rather than stored by us.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us of any unauthorized use of your account.

Depending on where you live, you may have certain rights over your personal information. We honor these rights in accordance with applicable law.

Under the GDPR (EU/UK residents), you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information ("right to erasure").
• Request that we restrict or object to certain processing.
• Receive your personal information in a portable, machine-readable format (data portability).
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

Under the CCPA (California residents), you may have the right to:

• Know the categories and specific pieces of personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Opt out of the sale of personal information. We do not sell personal information.
• Not be discriminated against for exercising your privacy rights.

To exercise any of these rights, please contact us via the website. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law.

Our services are not directed to children. We do not knowingly collect personal information from children under the age of 16 (or under 18 where required by local law). If you believe that a child has provided us with personal information, please contact us so that we can take appropriate steps to delete it.

Our website and services may contain links to third-party websites, merchants, or services that we do not operate or control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

If a merchant connects a commerce platform, we process store identity, installation and authorization records, product and SKU references, order and fulfillment identifiers, recipient name, delivery address, phone number, email address, tracking data and operational notes only as needed to provide fulfillment (including customs-declaration completion for cross-border shipments), support, reconciliation, fraud prevention and legal compliance. Customer email addresses are read on demand and used only to collect missing customs-declaration information — such as EU IOSS particulars or destination tax identifiers, without which a shipment cannot clear customs — and as a fallback contact for delivery issues; they are not persisted in our systems and are never used for marketing. For Shopify, access tokens are encrypted at rest, app requests use short-lived Shopify session tokens, and webhook authenticity is verified before a payload is processed.

The merchant remains responsible for providing appropriate notices to its customers and for having a lawful basis to instruct Woolii to process delivery data. Woolii acts as a service provider or processor for that merchant where applicable. We do not sell merchant customer data or use it for unrelated advertising. We restrict staff access by role, keep an audit trail of integration events without retaining raw webhook bodies, separate development validation from production use, and delete or de-identify platform data when required, subject to records that must be retained for shipping, customs, tax, security, dispute or other legal obligations.

Shopify privacy requests are handled through the mandatory customers/data_request, customers/redact and shop/redact webhooks. Merchants and customers may also contact support@woolii.com regarding access, deletion or other privacy rights.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "last updated" date at the top of this Policy and, where appropriate, provide additional notice. Your continued use of our services after an update takes effect indicates your acceptance of the revised Policy.

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us via the website at porter.woolii.com. We will respond to your inquiry as required by applicable law.

Data controller: WOOLII, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.