Privacy Policy — Shiplist

1. Who We Are

Shiplist is a project tracking service operated at https://shiplist.eu. For any privacy-related enquiries, contact us at info@shiplist.eu.

2. Data We Collect

We collect only what is necessary to provide the service:

Email address — required for account creation and passwordless authentication (magic links).
Name — required. Displayed to other members in shared projects and organisations.
Social link — optional. Only collected and shown if you choose to make your user profile public.
Account activity and usage data — actions you take within the app (projects created, tasks completed, etc.) to operate and improve the service.

We do not collect your phone number, postal address, or payment card details.

3. How We Use Your Data

To authenticate you via magic links sent to your email address.
To display your name to collaborators in projects you share with others.
To operate, maintain, and improve the Shiplist service.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Analytics

We use Cloudflare Web Analytics to understand how visitors use Shiplist. Cloudflare Web Analytics collects anonymised page view counts only. It does not collect personal data, does not set cookies, and does not perform cross-site tracking. No individual user profiles are built.

5. Cookies

We use first-party session cookies only, solely to keep you signed in after authentication. No third-party tracking, advertising, or analytics cookies are used on Shiplist.

6. Data Storage and Security

Your data is stored in Cloudflare D1 (database) and Cloudflare R2 (file storage). All data is encrypted at rest. Cloudflare operates globally distributed infrastructure subject to industry-standard security controls.

7. Payments and Billing

Payment processing for Shiplist Pro subscriptions is handled by Creem, who acts as the merchant of record. Creem collects and stores your billing information, processes payments, issues invoices, and handles VAT on our behalf. We do not store your payment card details. For details on how Creem handles your data, refer to Creem's Privacy Policy.

8. Data Retention

Your data is retained for as long as your account is active. If you delete your account, your personal data and all project content are permanently and irreversibly removed from our systems.

As the merchant of record, Creem independently retains billing and tax records for the period required by applicable law (typically 7-10 years). This is outside our control and is necessary for VAT and financial compliance.

9. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

Right of access — request a copy of your personal data.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure — request deletion of your personal data ("right to be forgotten").
Right to restriction of processing — ask us to limit how we use your data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests.

To exercise any of these rights, contact us at gdpr@shiplist.eu. We will respond within 30 days.

10. International Data Transfers

Your data is processed on Cloudflare's globally distributed infrastructure, which may involve transfers outside the European Economic Area. Cloudflare provides appropriate safeguards for such transfers in compliance with applicable data protection law, including Standard Contractual Clauses where required.

11. Changes to This Policy

We will notify you by email of any material changes to this Privacy Policy before they take effect. Continued use of Shiplist after the effective date constitutes acceptance of the updated policy.

12. Contact

General enquiries: info@shiplist.eu
GDPR / data requests: gdpr@shiplist.eu