Privacy Policy
How Premiumbyte Technologies handles personal data on ShipEasy — what we collect, who we share it with, and the rights you have over it.
Last updated 20 August 2026
1. Who we are
ShipEasy is operated by Premiumbyte Technologies (“Premiumbyte”, “we”, “us”). This policy explains what personal data we handle, why we handle it, and what rights you have over it.
It covers three things:
- the ShipEasy website and merchant dashboard;
- the branded tracking websites we host for merchants on our subdomains; and
- the emails we send on a merchant’s behalf about their shipments.
If you have any question about this policy, or want to exercise a right described in it, email support@shipeasy.pro.
2. Our two different roles
This is the most important section of this policy, because ShipEasy handles personal data in two very different capacities.
When we are the controller
For the accounts of merchants who sign up to ShipEasy — the person’s name, email address, phone number, company details and payment history — we decide how that data is used. We are the data controller, and this policy governs it in full.
When we are only a processor
When a merchant creates a shipment, they enter details about other people: the sender and the recipient, including names, addresses, email addresses and phone numbers. We did not collect that data and we do not decide what is done with it. The merchant is the controller of it; we merely store and display it, and email the recipient, on the merchant’s instructions.
If you are a sender or recipient asking why your details are on a tracking page, the answer lies with the courier or freight company you dealt with, and your request is best directed to them. Contact us at support@shipeasy.pro if you cannot reach them and we will help route it.
Merchants: by uploading another person’s details you confirm you have a lawful basis under the Nigeria Data Protection Act 2023 (NDPA) to do so. Your obligations are set out in our Terms of Service.
3. What we collect
Account information
Your full name, email address, phone number and a securely hashed password. If you sign in with Google we receive your name and email address from your Google profile — never your Google password.
Company information
Your company name, contact email and phone number, business address, logo, chosen subdomain, and your branding and template preferences. This information is deliberately public: it appears on your tracking website.
Shipment information
Sender and recipient names, addresses, email addresses and phone numbers; origin and destination; package description, declared value and weight; any images you upload; carrier name and tracking code; charges; and the full status history of each shipment.
Payment records
The bundle purchased, amount, currency, payment method, transaction reference and status, and — for cryptocurrency payments — the network and payment address.
Support and enquiries
Messages sent through a tracking site’s contact form or to our support address, along with the name, email and phone number supplied with them.
Technical information
Standard server logs, and a timestamp of when your account was last active. We do not build advertising or behavioural profiles.
4. What we never collect
We never see or store your card or bank credentials. Card payments are handled entirely by Paystack and cryptocurrency payments by NOWPayments, on their own systems. What reaches us is a transaction reference, an amount and a status — nothing that could be used to charge you again.
We also do not collect government identity documents, biometric data, or any special category data, and we ask that you do not upload such material as a shipment image.
5. How and why we use it
Under the Nigeria Data Protection Act 2023 (NDPA) we must have a lawful basis for each use of personal data. Ours are as follows.
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, and providing the dashboard | Performance of a contract |
| Publishing tracking pages and emailing recipients status updates | Performance of a contract, on the merchant’s instructions |
| Taking payment and maintaining a credit ledger | Performance of a contract |
| Keeping financial and tax records | Legal obligation |
| Blocking automated abuse of sign-up and sign-in | Legitimate interest in securing the service |
| Detecting fraudulent or impersonating use of the platform | Legitimate interest in protecting users and the public |
| Responding to support requests | Legitimate interest in supporting our users |
We do not sell personal data, and we do not share it with advertisers.
6. Tracking pages are public
Anyone who has a tracking ID can view that shipment’s page — including the sender and recipient names, the route, charges and any uploaded images. Tracking pages exist to be shared with recipients who do not have an account, so they are not password-protected.
We ask search engines not to index tracking pages, so they should not appear in search results. That reduces casual discovery, but it is not a security control: treat a tracking link as something that anyone holding it can open.
Merchants should therefore share tracking links only with the people entitled to see them, and should not enter information into a shipment record that they would not want a link-holder to read. If a tracking page contains information that should not be public, contact us at support@shipeasy.pro and we can take it down.
7. Service providers we share data with
We use a small number of specialist providers to run ShipEasy. Each one receives only the data it needs to perform its function, and none of them are permitted to use it for their own purposes.
| Provider | What it does | What it receives |
|---|---|---|
| Paystack | Card and bank payments | Your name, email and payment details you enter on their page |
| NOWPayments | Cryptocurrency payments | Transaction amount and wallet details |
| Mailtrap | Sending transactional email | Recipient email address and message contents |
| Cloudinary | Image storage and delivery | Logos and shipment images you upload |
| Cloudflare | Bot protection on sign-up and sign-in | Technical signals from your browser |
| Optional sign-in with Google | Your name and email address, only if you use it | |
| Smartsupp | Live chat support | Chat messages and basic session information |
| Mapbox | Route maps on tracking pages | Origin and destination countries |
| Vercel | Website hosting and delivery | Requests to our websites |
| Vultr | Application and database hosting | All data stored by the service |
We may also disclose data where we are legally required to, or where it is necessary to investigate fraud or protect someone’s safety.
8. Where your data is held
Our application and database servers are located in Europe. Some of the providers listed above operate globally, so your data may also be processed in other countries.
This means personal data collected in Nigeria is transferred outside Nigeria. Where the Nigeria Data Protection Act 2023 (NDPA) requires it, we rely on the recipient country offering an adequate level of protection, or on contractual safeguards with the provider, and we transfer only what is needed for the purposes described above.
10. How long we keep it
- Active accounts. We keep your account and shipment data for as long as your account is open, because your tracking pages depend on it.
- Closed accounts. We delete personal data in your account and shipment records within 30 days of closure. Tracking pages stop working at that point.
- Financial records. We keep payment and transaction records for approximately 6 years, because tax and audit law requires it. These are retained even after the rest of your data is deleted.
- Support messages. Kept for as long as needed to resolve the matter and for a reasonable period afterwards.
We may retain limited information for longer where necessary to investigate fraud or to establish or defend a legal claim.
11. How we protect it
- Passwords are stored using strong one-way hashing. Nobody at Premiumbyte can read them.
- All traffic to our websites and API is encrypted in transit with TLS.
- Access is authenticated with expiring, scoped tokens, and administrative actions are restricted by role.
- Suspending an account takes effect immediately, not when a session expires.
- Payment credentials never reach our servers.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) as required by law.
12. Your rights
Under the Nigeria Data Protection Act 2023 (NDPA) you have the right to:
- ask what personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- ask us to delete your data, where we have no overriding obligation to keep it;
- object to, or ask us to restrict, certain processing;
- receive data you gave us in a portable format; and
- withdraw consent at any time, where we relied on consent.
Email support@shipeasy.pro to exercise any of these. We will respond within the period the law allows, and we may ask you to confirm your identity first.
If you are dissatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).
13. Children
ShipEasy is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact support@shipeasy.pro and we will delete it.
14. Changes to this policy
We may update this policy as the service develops. The date at the top of this page always shows the current version. If a change materially affects your rights, we will notify account holders by email before it takes effect.
15. Contact us
For any privacy question, request or complaint, contact Premiumbyte Technologies at support@shipeasy.pro.
124 Olise Road, Ikeja, Lagos, Nigeria
See also our Terms of Service.
Questions about this page? Email support@shipeasy.pro and we will get back to you.