Privacy Policy

1. Who We Are

Covantra Ltd. ("Covantra," "we," "us," or "our") is a company incorporated under the laws of British Columbia, Canada. We operate ship. by Covantra, a multi-carrier shipping platform. This Privacy Policy explains how we collect, use, and protect personal information in accordance with the Personal Information Protection Act (PIPA), SBC 2003, c. 63.

2. Information We Collect

We collect the following categories of personal information:

• Account information: Name, business name, email address, and password (stored in hashed form).
• Shipment information: Sender and recipient names, addresses, package dimensions and weights, declared values, and tracking numbers.
• Billing information: Billing address and payment method details. Payment card data is handled directly by our payment processor and is not stored on Covantra's servers.
• Usage data: Information about how you use the platform, including pages visited, API calls made, and features used.
• Technical data: IP address, browser type, and operating system, collected automatically when you use the Service.

We collect only the information necessary to provide and improve the Service. We do not sell your personal information to third parties.

3. How We Use Your Information

We use your personal information to:

• Create and manage your account and authenticate your sessions.
• Process label purchases and submit shipment details to carriers.
• Send transactional emails such as shipping confirmations, tracking updates, and team invitations.
• Handle billing, invoicing, and payment processing.
• Resolve disputes, investigate fraud, and comply with our legal obligations.
• Improve the Service through aggregated, anonymized usage analysis.

4. Third-Party Service Providers

We share personal information with third-party providers only to the extent necessary to deliver the Service. These providers are contractually required to protect your information and use it only for the purposes we specify.

We may add or change service providers over time. Material changes to this list will be communicated via an updated Privacy Policy.

5. Cross-Border Data Transfers

Some of our third-party service providers (including Shippo, Resend, and Cloudflare) are located in the United States. By using the Service, you consent to the transfer of your personal information to these providers in the United States, which has different privacy laws than British Columbia. We take steps to ensure these providers protect your information in a manner consistent with PIPA.

6. Data Retention

We retain your account information and shipment records for seven (7) years following account closure. This retention period is required for financial record-keeping compliance under applicable Canadian law. After the retention period, personal information is securely and permanently deleted.

You may request deletion of your personal information at any time by contacting our Privacy Officer. Requests will be honoured subject to our legal obligations and retention requirements.

7. Your Rights Under BC PIPA

Under British Columbia's PIPA, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Request deletion of your personal information, subject to our legal retention obligations.
• Know the purposes for which your information is being collected, used, or disclosed.

To exercise these rights, contact our Privacy Officer at privacy@covantra.net. We will respond within 30 days.

8. Cookies and Analytics

We use Cloudflare Web Analytics to understand aggregate site usage. Cloudflare Analytics does not use cookies, does not fingerprint users, and does not store personal identifiers. No tracking pixels or third-party advertising cookies are used on our site.

If we introduce additional analytics tools in the future, this policy will be updated with at least 30 days' advance notice to registered users.

9. Data Security

We use industry-standard security measures to protect your personal information, including TLS encryption for data in transit, hashed storage for passwords, and role-based access controls within our systems. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a breach of security safeguards involving your personal information that poses a real risk of significant harm, we will notify you and the Office of the Information and Privacy Commissioner for British Columbia as required under PIPA. We aim to provide notice within 72 hours of determining that such a risk exists.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via the email address on their account at least 30 days before the changes take effect. The effective date at the top of this page reflects the most recent revision.

12. Contact — Privacy Officer

Questions, access requests, or complaints regarding this Privacy Policy or Covantra's handling of personal information should be directed to our designated Privacy Officer:

If you are not satisfied with our response, you may file a complaint with the Office of the Information and Privacy Commissioner for BC at oipc.bc.ca.