ship.by Covantra
← Back to home

Privacy Policy

Effective date: June 25, 2026

1. Who We Are

Covantra Ltd. ("Covantra," "we," "us," or "our") is a company incorporated under the laws of British Columbia, Canada. We operate ship. by Covantra, a multi-carrier shipping service. This Privacy Policy explains how we collect, use, and protect personal information in accordance with the Personal Information Protection Act (PIPA), SBC 2003, c. 63.

2. Information We Collect

We collect the following categories of personal information:

  • Account information: Name, business name, email address, and password (stored in hashed form).
  • Shipment information: Sender and recipient names, addresses, package dimensions and weights, declared values, and tracking numbers.
  • Billing information: Billing address and payment method details. Payment card data is handled directly by our payment processor and is not stored on Covantra's servers.
  • Usage data: Information about how you use the Service, including pages visited, API calls made, and features used.
  • Technical data: IP address, browser type, and operating system, collected automatically when you use the Service.
  • Analytics and cookie data: Cookies and similar technologies set by our analytics services that record page visits and session information on our public-facing website. See Section 8 for details.

We collect only the information necessary to provide and improve the Service. We do not sell your personal information to third parties.

3. How We Use Your Information

We use your personal information to:

  • Create and manage your account and authenticate your sessions.
  • Process label purchases and submit shipment details to carriers.
  • Send transactional emails such as shipping confirmations, tracking updates, and team invitations.
  • Handle billing, invoicing, and payment processing.
  • Resolve disputes, investigate fraud, and comply with our legal obligations.
  • Improve the Service through aggregated, anonymized usage analysis.

4. Third-Party Service Providers

We share personal information with third-party providers only to the extent necessary to deliver the Service. These providers are contractually required to protect your information and use it only for the purposes we specify.

Carrier API Aggregator

Our carrier API aggregator processes shipment data (addresses, package details) to obtain rates and generate labels. This service is based in the United States.

Carrier Networks

Shipment data is shared with the carrier you select (e.g. UPS, USPS, FedEx) to create and process your labels. Each carrier's own privacy policy governs their use of this data.

Resend

Our transactional email service. Your email address and the content of notifications (e.g. shipment confirmations) are processed by Resend to deliver messages. Resend is based in the United States.

Cloudflare

We use Cloudflare for content delivery, DNS, and site analytics. Cloudflare processes your IP address and request metadata as part of normal CDN operation. Cloudflare's analytics are cookie-free and do not store personal identifiers.

Google Analytics

We use Google Analytics 4 (GA4) to collect aggregate information about how visitors use our website — including pages visited, session duration, and general device and browser characteristics. This data is sent to and processed by Google LLC in the United States. We use GA4 for site analytics only and do not use it for advertising, remarketing, or audience targeting. We do not send personally identifiable information (such as names, email addresses, or account identifiers) to Google Analytics.

We may add or change service providers over time. Material changes to this list will be communicated via an updated Privacy Policy.

5. Cross-Border Data Transfers

Some of our third-party service providers (including our carrier API aggregator, Resend, Cloudflare, and Google LLC for Google Analytics) are located in the United States. By using the Service, you consent to the transfer of your personal information to these providers in the United States, which has different privacy laws than British Columbia. We take steps to ensure these providers protect your information in a manner consistent with PIPA.

6. Data Retention

We retain your account information and shipment records for seven (7) years following account closure. This retention period is required for financial record-keeping compliance under applicable Canadian law. After the retention period, personal information is securely and permanently deleted.

You may request deletion of your personal information at any time by contacting our Privacy Officer. Requests will be honoured subject to our legal obligations and retention requirements.

7. Your Rights Under BC PIPA

Under British Columbia's PIPA, you have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate or incomplete personal information.
  • Request deletion of your personal information, subject to our legal retention obligations.
  • Know the purposes for which your information is being collected, used, or disclosed.

To exercise these rights, contact our Privacy Officer at privacy@covantra.net. We will respond within 30 days.

8. Cookies and Analytics

We use two analytics services to understand how the Service is used:

Google Analytics 4 (GA4)

Google Analytics sets the following cookies and also uses local storage to measure site usage:

  • _ga — Persistent client identifier that distinguishes unique visitors across sessions. Expires after 2 years.
  • _ga_<MEASUREMENT_ID> — Property-specific session container that maintains session state for this GA4 property. Expires after 2 years.
  • _gid — Daily session identifier that scopes activity to a single day. Expires after 24 hours.

Data collected includes page views, session duration, approximate geographic location (derived from IP address and not retained), and general device and browser information. We use GA4 for site analytics only and do not use it for advertising, remarketing, or audience targeting. We do not send personally identifiable information — such as names, email addresses, or account identifiers — to Google Analytics. Analytics data is retained in Google's systems for 14 months, after which it is automatically deleted.

You can opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on, or by disabling cookies in your browser settings.

Cloudflare Web Analytics

We also use Cloudflare Web Analytics for aggregate traffic measurement. Cloudflare's analytics are cookie-free, do not fingerprint users, and do not store personal identifiers.

9. Data Security

We use industry-standard security measures to protect your personal information, including TLS encryption for data in transit, hashed storage for passwords, and role-based access controls within our systems. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a breach of security safeguards involving your personal information that poses a real risk of significant harm, we will notify you and the Office of the Information and Privacy Commissioner for British Columbia as required under PIPA. We aim to provide notice within 72 hours of determining that such a risk exists.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via the email address on their account at least 30 days before the changes take effect. The effective date at the top of this page reflects the most recent revision.

12. Contact — Privacy Officer

Questions, access requests, or complaints regarding this Privacy Policy or Covantra's handling of personal information should be directed to our designated Privacy Officer:

Privacy Officer, Covantra Ltd.

Email: privacy@covantra.net

Jurisdiction: British Columbia, Canada

If you are not satisfied with our response, you may file a complaint with the Office of the Information and Privacy Commissioner for BC at oipc.bc.ca.