Privacy Policy for Shipday

Effective Date: June 12, 2025

This “Privacy Policy” explains how Shipday Inc. (“Shipday” or “we”) collects, uses, discloses, and otherwise processes personal data on behalf of our customers – typically, merchants (any, a “Merchant”) – in connection with our application, Shipday (“App”), which runs on the Clover Point of Sale system ( “Clover POS”) and utilises data provided by Clover POS. This Privacy Policy does not apply to Shipday’s privacy practices in any other context.

Shipday’s processing of personal data in connection with our application is governed by this Privacy Policy and our agreements with Merchants. In the event of any conflict between this Privacy Policy and a customer agreement, the customer agreement will control to the extent permitted by applicable law.

Note: This Privacy Policy is not a substitute for any privacy policy that a Merchant may be required to provide to their customers, personnel, or other individuals.

Information We Receive and Process

We may receive or otherwise process personal data from or on behalf of Merchants. Merchants determine the scope of the personal data transferred to us (which we then receive and process), or that we may collect directly through our App interface (as detailed below). The information we handle may vary by Merchant. Typically, the information we handle on behalf of Merchants includes:

Information we receive regarding a customer payment

When a customer makes a payment via a Clover POS, Clover collects information about the transaction, which we then receive and process on behalf of the Merchant. Information about transactions includes the payment card used, name associated with the payment card, the location of the merchant’s store, date and time of the transaction, transaction amount, and information about the goods or services purchased in the transaction.

In addition, Clover POS may provide us with: the customer’s mobile phone number and/or email address (to send electronic receipts and real‑time delivery‑tracking links).

Additional information that customers of the Merchant provide through the Clover POS ancillary to a payment

We may receive from Clover POS additional information ancillary to the payment. This information may include:

• Customers’ email address or phone number, such as when the customer chooses to receive an electronic receipt
• Customers’ marketing preferences, such as whether the customer wishes to receive marketing communications or newsletters
• Information about participating customers’ activity in a merchant loyalty program
• Customers’ physical address, where needed for delivery of goods or services
• Other information the customer provides, such as birthdate, interests or preferences, reviews, and feedback

In addition, we may receive from Clover POS or collect via our App interface: delivery instructions (e.g., buzzer codes, drop‑off notes) and customer feedback about the delivery experience.

Information that we collect about personnel of a Merchant

We may receive from Clover POS or collect directly through our App interface information about Merchants’ personnel and interactions with the Clover POS, such as clock‑in and clock‑out time and tips earned.

Additional information that Merchants provide to us about their customers or personnel

Merchants may provide us with additional information directly, via access they grant to us, or otherwise. The types of information that Merchants may provide to us about their customers include email addresses, phone numbers, and purchase history plus historical order data and loyalty‑program status. The types of information that Merchants may provide to us about their personnel include email addresses, phone numbers, shifts, and sales history as well as driver rosters and assigned delivery zones.

How we use the information we process

We use the personal data we handle for or on behalf of Merchants to provide our services and the functionality of our application: dispatching and tracking deliveries, sending customers delivery‑status notifications, displaying live order status to store staff, and generating performance analytics reports for Merchants.

We may also use personal data for related internal purposes, including:

• To provide information about the application, such as important updates or changes to the application and security alerts
• To measure performance of and improve the application
• To respond to inquiries, complaints, and requests for customer support

In addition, Shipday may use personal data as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern our application; (c) protect our rights, privacy, safety or property, and/or that of you or others; and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

How we share information

We may share personal data that we handle (or process) with:

• The Merchant from whom or on whose behalf we collected the personal data
• The platform on which our application runs, the Clover POS (see Clover’s Privacy Notice)
• With third parties as a Merchant may direct
• With third‑party service providers that help us manage and improve the application
• With Shipday subsidiaries and corporate affiliates for the purposes described in this Privacy Policy or in our agreement with a Merchant

Shipday may disclose personal data to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern our application; (c) protect our rights, privacy, safety or property, and/or that of you or others; and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Shipday may sell or transfer some or all of its business or assets, including your personal data, in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, in which case we will make reasonable efforts to require the recipient to honor this Privacy Policy.

Your rights and choices

Data subject rights

To the extent that applicable law provides individuals with rights pertaining to their personal information, such as to review and request changes to their personal information, individuals should contact the Merchant with any requests pertaining to the Merchant’s use of our application. To the extent that Clover is responsible for responding to data subject rights requests under applicable law, individuals may contact Clover with applicable requests as explained in Clover’s Privacy Notice, https://www.clover.com/privacy-policy. Shipday will assist a Merchant, or Clover, as applicable, in responding to such requests subject to our contract with a Merchant or Clover.

Updates

We reserve the right to modify this Privacy Policy at any time. We will notify you of updates by updating the date of this Privacy Policy.

Contact us

You may contact us with any questions, comments, or complaints about this Privacy Policy or our privacy practices via:

• Email: info@shipday.com or privacy@shipday.com
• Phone: +1 (650) 550‑2921
• Address: Shipday Inc., 101 Jefferson Dr, 1st Floor, Menlo Park, CA 94025, USA

Additional Information for Merchants Located in Europe

Controller

Shipday is a data processor acting for and on behalf of the Merchant that has installed our application on their Clover POS. That Merchant is the controller of personal data that we process on its behalf. Clover is also a controller of personal data in some circumstances. Clover’s Privacy Notice is available at https://www.clover.com/privacy-policy.

Legal basis for processing

Shipday processes personal data as directed or permitted by the Merchant that uses our application. The Merchant is responsible for establishing a legal basis for our processing of personal data for or on behalf of the Merchant.

Cross‑border data transfer

When we transfer personal data outside of Europe (or the UK) to countries not deemed by the European Commission to provide an adequate level of protection for personal data, we make the transfer pursuant to one of the following transfer mechanisms:

• A contract approved by the European Commission (sometimes called “Model Clauses” or “Standard Contractual Clauses”);
• The recipient’s Binding Corporate Rules;
• The consent of the individual to whom the personal data relates; or
• Other mechanisms or legal grounds as may be permitted under applicable European law.

Data retention

Subject to our agreement with a Merchant, Shipday retains personal data for as long as necessary to (a) provide our products and services; (b) comply with legal obligations; (c) resolve disputes; and (d) enforce the terms of any agreement we may have with a Merchant. You may contact us for additional information about our data‑retention practices in connection with the application.

Data subject rights

Under certain circumstances, data subjects in Europe and the UK have certain rights relating to their personal data.