Privacy
Last updated: 06/10/2026
What data we keep
Your name, email address and phone number, and as a sender your town and the first four characters of your postcode. We use your full address as the sender and return address on the labels you send, and for your invoice. In AirPost, shops only see your town and the start of your postcode; for stock, you share your address yourself in the conversation. AirPost is not meant for minors; we erase the data of anyone under 18 as soon as we notice.
What we send you
Notifications about your account are always in the app, and with a push notification if you allow it. We email them when something happens for the first time (your first order, the first message), when you have not been in the app for a few days or have no push notifications, and always for something that cannot wait — a label that is not handed over, a shop connection that drops or an answer from support. There are at least 48 hours between two emails, except for an order, something urgent or someone getting in touch with you, with a maximum of eight a month; and we only email between 9:00 and 20:00 on your clock. By text you get at most three messages, ever: one for each of your first two chat requests, and one when a sender joins in a country your shop sends to or a shop joins that sends to your country. Texts are only available in the Netherlands, Germany, France, Italy, the United Kingdom, Denmark, Portugal, Poland, Sweden, Norway, the United States and Canada for now. News about new senders and shops is marketing, and we only send it if you gave separate permission for it.
Unsubscribing
Under every email there is a link that switches that kind of email off in one click, without logging in: under a notification email the notification emails, under an email about new senders or shops only those. Your notifications then stay in the app. If you reply STOP to a text, we switch texts off on our side too. In your settings you can switch the ticks on and off separately: email and text, and service and marketing per channel. We send email through Resend and text through Klaviyo; both are processors for AirPost and use your data for nothing else. We never share your mobile number or your text consent with third parties or affiliates for marketing or promotional purposes.
Business email to webshops
We sometimes email online stores about AirPost. For this we only use the business email address a store publishes on its own website, together with the store’s name and web address, and we note where we found the address. Purpose: a short business offer of at most three emails. Legal basis: legitimate interest (Article 6(1)(f) GDPR and UK GDPR). We keep these details for at most 12 months after the last email. If you object, we keep only your address on a do-not-contact list, so we never email you again. You can object at any time by replying STOP or by emailing [email protected].
Recipients’ addresses
We use the address details of a shop’s customers only to create the shipping label and track the shipment. They never appear in a public profile.
Shop integrations (Shopify)
If you connect your Shopify store with the Airpost Order Link app, we receive the recipient’s name, address, email address and phone number and the items ordered for every paid order. We use them to create the shipping label, track the shipment and report the tracking code back to Shopify; we only pass the email address and phone number on to the carrier that needs them for delivery. We keep your store’s access token encrypted, and we keep a copy of the order for as long as it is needed to process it. If a customer asks for deletion through Shopify, we erase that copy; the same happens 48 hours after you uninstall the app. The shipment itself and the invoice are kept for seven years, as under «How long we keep it». For this data your shop is the controller and AirPost the processor.
Identity documents
The identity check runs through our payment partner. AirPost keeps no copy of your identity document; we only see whether the check passed.
Payment details
Payments and payouts run through Stripe. Account numbers and card details never reach our servers.
Who can see it
Our database enforces per row who may see what. One seller does not see another seller’s data, not even by accident. AirPost staff can access data needed for support. If a sender withholds a seller’s stock, we share their verified name and address with that seller and with the police, so they can file a report and recover the stock (legitimate interest, GDPR article 6(1)(f)).
How long we keep it
After account deletion, we retain conversations and account records, including contact details, billing address and identity checks, to handle outstanding obligations and legal claims. Orders, shipments, invoices and the ledger are kept for 7 years, as the law requires. A waiting-list sign-up and a handled contact message are erased after 12 months, read notifications and our error log after 6 months.
Your rights
You can see your data and have it corrected, and you delete your account yourself from your settings. For access or a correction, use the contact form. You can also complain to your national data protection authority.
Cookies
Functional cookies to keep you logged in — those are always there; without them logging in does not work. We only set analytics and advertising cookies if you have clicked «Accept» on our public pages. We keep your choice in your browser and you can change it at any time via «Cookies» at the bottom of every page; we then ask the question again. In the United States and Australia these cookies are on by default; choose «Decline» in the bar to turn them off.
Measuring
We count how often our public pages are visited, so we can see what people are looking for. That happens in two ways: without cookies through Vercel as a processor, and through Google Analytics, also as a processor. In Google Analytics a visit counts without cookies until you give permission: we put nothing in your browser and do not recognise you between visits. Click «Accept» and analytics cookies are added. We do not build a profile per visitor.
Advertising
We advertise through Google Ads and Meta (Facebook and Instagram). If you click «Accept», Google sets an advertising cookie (_gcl_aw, 90 days) and Meta a pixel cookie (_fbp, 90 days) that tell us which ad brought you here. If you then create an account, top up your balance or place an order, we report that to Google and Meta as a conversion — with your email address in hashed form at Google, so it can be matched to the click without seeing the address itself. Without «Accept» such a conversion counts at Google without cookies and anonymously, and Meta receives nothing. We pass on nothing else.
Measuring inside your account
Behind the sign-in we record which pages you open and which errors you get. That sits in our own database, we use it for support and to find bugs, and we delete it after 90 days. This data does not go to Google or any other party, and no cookie is involved.