Privacy Policy

This policy explains how Shifly collects, uses, shares and protects personal information when you use the Shifly website or app, as a sender, recipient or buyer. We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles, and Vietnam's Law on Personal Data Protection and its guiding decrees.

• your name and email, and the addresses and contact names you save;
• what you send or order: parcel contents, weights, photos and seal numbers recorded at our hubs, prices, and tracking history;
• photos you add to check a price and what you write about the item. We use them only for that check and don't keep them;
• payment activity: bank transfer references, COD payments (the courier tracking number and amount), Shifly credit from refunds, and rewards;
• messages with Support, and the notifications we send you;
• sign-in sessions, device push tokens, and technical logs (such as IP address and errors) that keep the service secure.

We don't collect your precise location, contacts or photos other than those you upload.

• to create and secure your account and sign you in;
• to quote, accept, inspect, ship, track and deliver parcels;
• to estimate what an item weighs and costs to ship, from its store link or, if you agree, from your photos and notes;
• to match bank transfers to your orders and COD payments, pay the courier for COD parcels you have paid, keep your Shifly credit, and handle refunds and Guarantee claims;
• to suggest addresses as you type and to price courier delivery by distance;
• to send you updates about your parcels, payments and account, and to answer your questions;
• to prevent fraud, theft and misuse, meet our legal obligations, and resolve disputes; and
• to understand and improve how Shifly works, using aggregated information where we can.

We ask for your consent where the law requires it, including before we send your photos or item notes to Anthropic's AI (see below). Each consent is asked for separately, never pre-ticked, and saved on your account. You can withdraw consent by contacting Support, or turn the AI consent off yourself in the app under Account › Privacy and security; this won't affect what we did before, but we may no longer be able to provide some services, such as price checks from photos.

We share only what each party needs:

• Service providers who work for us under contract: Anthropic (AI checks, below), Mapbox (address search and distances), Cloudflare (file and photo storage), Expo (app notifications), Stream (support chat), Resend (transactional email), Apple and Google (when you choose to sign in with them), and courier and freight partners (delivery quotes and exchange rates).
• Anthropic, whose AI, Claude, checks prices from photos for us, only after you agree in the app: it receives the photos and what you write about the item, to tell what it is and estimate its weight. For a price check from a store link, Claude reads only the public store page, nothing about you. You can turn this off at any time in the app under Account › Privacy and security.
• Authorities and others where needed: customs and border agencies, police, courts and insurers in Vietnam or Australia, when the law requires it or to resolve a claim about a parcel. We share only on a documented request or dispute.

We don't sell your personal information, and we don't share it for others' advertising.

Shifly operates between Vietnam and Australia, so your information is transferred between the two countries. Some of our service providers store or process information in other countries, including the United States and the European Union. We take reasonable steps to make sure they protect it to the standard of this policy, and we complete the cross-border transfer assessments Vietnamese law requires.

• information is sent over encrypted connections, and sensitive fields are encrypted when stored;
• staff access is limited by role and logged, and Shifly staff never ask for your password or verification codes;
• files such as parcel photos and receipts are kept in private storage and shown only to people who need them.

We keep your information while your account is open and for as long as we need it for the purposes above. When you delete your account in Settings › Privacy and security, we permanently delete your personal information as soon as you confirm: your name, email and sign-in details, profile, addresses, notifications, product requests, uploaded files and support chats. Files and chats are erased from storage within 24 hours. If you signed in with Apple, we also ask Apple to remove Shifly's access to your Apple ID.

We keep only the records that tax, accounting and financial laws require: orders, parcel records, payments, COD payments and Shifly credit transactions. We keep them for up to 10 years (7 years under Australian law, and 10 years for accounting records under Vietnamese law), and longer only while a claim or dispute is open. We use them only to meet those obligations and to resolve claims.

You can:

• see and update your details in Settings, and ask Support to correct anything you can't change yourself (such as a name on a past order);
• download a copy of your data from Settings › Privacy and security;
• delete your account there at any time. If money or a delivery is still open, the app tells you what to settle first, such as using your Shifly credit or cancelling an unpaid order;
• withdraw consent, or ask us to restrict or stop processing, where the law gives you that right; and
• turn off app notifications in your device settings (we'll still send messages needed for your parcels and account).

We reply to requests within the time the law sets, and may need to confirm who you are first.

The website and app store your sign-in session securely on your device and remember choices such as your language. We don't use advertising cookies, advertising identifiers or cross-site trackers.

Shifly is for people aged 18 and over. We don't knowingly collect information from children; if we learn we have, we delete it.

If a data breach is likely to cause you serious harm, we will tell you and the relevant regulators as the law requires, including under Australia's Notifiable Data Breaches scheme and Vietnam's personal data protection rules, and tell you what you can do to protect yourself.

We may update this policy. We'll tell you in the app before an important change takes effect, and the date at the top shows the latest version.

For privacy questions, requests or complaints, contact Shifly Support or email [email protected]. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in Vietnam, to the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security).