Privacy
Last updated: 16/09/2026
What data we keep
Your name, email address and phone number, and as a sender your town and the first four characters of your postcode. We only keep your full address so stock can be sent to it, and it is visible only to the shops you actually work with.
What we send you
Notifications about your account are always in the app. On top of that we send them by email, and by text at two moments: when someone gets in touch with you for the first time, and when a sender joins in a country your shop sends to. Each channel has a monthly maximum — fifteen emails and five texts — so it never becomes a stream. We only send marketing if you have given separate permission for it.
Unsubscribing
Under every email notification there is a link that switches it off in one click, without logging in. Your notifications then stay in the app. In your settings you can switch all four ticks on and off separately: email and text, and service and marketing per channel. We send email through Resend and text through Klaviyo; both are processors for AirPost and use your data for nothing else.
Recipients’ addresses
We use the address details of a shop’s customers only to create the shipping label and track the shipment. They never appear in a public profile.
Shop integrations (Shopify)
If you connect your Shopify store with the Airpost Order Link app, we receive the recipient’s name, address, email address and phone number and the items ordered for every paid order. We use them to create the shipping label, track the shipment and report the tracking code back to Shopify; we only pass the email address and phone number on to the carrier that needs them for delivery. We keep your store’s access token encrypted, and we keep a copy of the order for as long as it is needed to process it. If a customer asks for deletion through Shopify, we erase that copy; the same happens 48 hours after you uninstall the app. The shipment itself and the invoice are kept for seven years, as under «How long we keep it». For this data your shop is the controller and AirPost the processor.
Identity documents
The identity check runs through our payment partner. AirPost keeps no copy of your identity document; we only see whether the check passed.
Payment details
Payments and payouts run through Stripe. Account numbers and card details never reach our servers.
Who can see it
Our database enforces per row who may see what. One seller does not see another seller’s data, not even by accident. AirPost staff can access data needed for support. If a sender withholds a seller’s stock, we share their verified name and address with that seller and with the police, so they can file a report and recover the stock (legitimate interest, GDPR article 6(1)(f)).
How long we keep it
We keep your account for as long as you use it. If you delete it, we erase your personal data within 30 days. We keep financial records for seven years, as the law requires.
Your rights
You can see your data, have it corrected or have it deleted. Ask for that through the contact form. You can also complain to your national data protection authority.
Cookies
Functional cookies to keep you logged in — those are always there; without them logging in does not work. We only set analytics and advertising cookies if you have clicked «Accept» on our public pages. We keep your choice in your browser and you can withdraw it: clear the site data for airpost.network in your browser and the question comes back.
Measuring
We count how often our public pages are visited, so we can see what people are looking for. That happens in two ways: without cookies through Vercel as a processor, and through Google Analytics, also as a processor. In Google Analytics a visit counts without cookies until you give permission: we put nothing in your browser and do not recognise you between visits. Click «Accept» and analytics cookies are added. We do not build a profile per visitor.
Advertising
We advertise through Google Ads and Meta (Facebook and Instagram). If you click «Accept», Google sets an advertising cookie (_gcl_aw, 90 days) and Meta a pixel cookie (_fbp, 90 days) that tell us which ad brought you here. If you then create an account, top up your balance or place an order, we report that to Google and Meta as a conversion — with your email address in hashed form at Google, so it can be matched to the click without seeing the address itself. Without «Accept» such a conversion counts at Google without cookies and anonymously, and Meta receives nothing. We pass on nothing else.
Measuring inside your account
Behind the sign-in we record which pages you open and which errors you get. That sits in our own database, we use it for support and to find bugs, and we delete it after 90 days. This data does not go to Google or any other party, and no cookie is involved.