Privacy Policy
Effective September 2, 2026
Disputely LLC ("Disputely," "we," "us") is committed to protecting the personal information in our possession. This Privacy Policy describes (a) the products and services through which we collect personal data, (b) the purposes and legal bases for processing personal data, (c) the persons and entities with whom we share personal data, (d) how long we retain personal data, and (e) your privacy rights. It applies to information we collect through protect.shop, the Protection widget, our claims pages, and related services (collectively, the "Sites"), and to anyone whose personal data we process in providing our services. It supplements — and does not replace — the privacy policy of the store you purchased from.
A note about children: the Sites are general audience services and are not directed at children under 16. We do not knowingly collect personal information from anyone under 16.
What services do we provide?
Disputely provides optional package protection ("Protection") that customers can add to their order at checkout on participating merchant stores, and administers the related claims process on behalf of those merchants.
Our role in processing your data
We process data both as a processor/service provider and as a controller. When we receive order and delivery data from a merchant's store platform to provide Protection, we act as a service provider to that merchant. When you interact with us directly — for example, by filing a claim on our Sites or emailing our support team — we act as a controller of the data you provide.
What information do we collect?
Information we receive from the merchant's store platform
When you add Protection to an order, we receive:
- Order details — order number, items purchased, order total, and the Protection fee.
- Contact information — your name, email address, and phone number if provided at checkout.
- Delivery information — shipping address, carrier, tracking numbers, and tracking events.
Information you give us
When you file a claim or contact support, we receive the information you submit, such as descriptions of the issue, photos, and any supporting documents, along with your contact details.
Information collected automatically
When you visit the Sites, our servers automatically receive standard technical data, including your IP address, browser type and language, device information, the date and time of your visit, and the pages you view. We do not use advertising or social media tracking cookies on the Sites.
Payment information
The Protection fee is charged as part of your order through the merchant's checkout. We do not receive or store your payment card details.
How do we use this information?
- To provide Protection for your order, including monitoring delivery status.
- To review and resolve claims, including issuing replacements or refunds.
- To communicate with you about your Protection or an open claim.
- To detect, investigate, and prevent fraud and abuse of the Protection service.
- To operate, maintain, and secure the Sites.
- To comply with legal obligations.
Legal basis. Where the GDPR or similar laws apply, we process personal data on one or more of the following bases: (i) it is necessary to perform a contract to which you are a party, or to take steps at your request prior to entering into a contract; (ii) it is necessary to comply with a legal obligation; (iii) it is necessary for our legitimate interests, such as preventing fraud and securing our services; or (iv) you have given consent for one or more specific purposes.
Do we share information with third parties?
We do not sell your personal information. We share it only as described below, and our agreements with third parties that receive personal data from us prohibit them from using it other than to provide the service in question.
- The merchant you purchased from, to coordinate claim resolutions such as reorders and refunds.
- Carriers and tracking providers, to retrieve delivery status for your shipment.
- Service providers that support our infrastructure, such as cloud hosting and email delivery providers, bound by confidentiality obligations and limited to the information reasonably necessary to perform their function.
- Legal and safety recipients — we may disclose personal data to comply with valid legal requirements such as a law, regulation, search warrant, subpoena, or court order, or where we believe disclosure is reasonably necessary to investigate or prevent harm, fraud, abuse, or illegal conduct, to enforce our rights, or to protect the rights, property, or safety of others.
- Corporate transactions — if all or part of Disputely is merged, acquired, or otherwise transferred to another entity, personal data may be transferred as part of that transaction. We will take steps to ensure any transferred data is not used in a manner inconsistent with this Privacy Policy.
We may also share aggregated, de-identified information that does not allow you to be identified or contacted.
Where do we process and store data?
We are a United States company and store personal data in the United States. If you are located outside the United States (including in the European Economic Area or the United Kingdom), your personal data will be transferred to and processed in the United States. Where required by applicable law, we take steps designed to ensure appropriate safeguards for such transfers.
How do we protect personal data?
We protect personal data using administrative, technical, and physical safeguards, and we require our service providers to implement comparable protections. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
How long do we keep personal data?
We retain personal data for as long as we have an ongoing legitimate business need to do so — for example, to administer Protection for your order, resolve claims and disputes, prevent fraud, and meet legal and accounting requirements. When we no longer have such a need, we delete or anonymize the data.
What are your rights?
Depending on where you live, you may have the right to:
- Withdraw consent where processing is based on consent you previously provided.
- Object to processing of your personal data in certain cases, including for direct marketing.
- Access — obtain confirmation of whether we process your personal data and request a copy of it.
- Rectify — have inaccurate personal data corrected or incomplete data completed.
- Erase — request deletion of your personal data in certain cases.
- Data portability — receive your personal data in a structured, commonly used, machine-readable format.
- Lodge a complaint with your data protection authority.
To exercise any of these rights, email support@protect.shop with your order number. We may need to verify your identity before acting on a request. Unless a request is complex, repetitive, or manifestly unfounded or excessive, we aim to respond within one month, free of charge.
California residents
If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know what personal information we collect about you, to request its deletion or correction, and to not be discriminated against for exercising your rights. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, contact us using the details below.
Changes to this policy
We may amend and update this Privacy Policy at any time. When we make material changes, we will give notice via the Sites or, where feasible, using contact information available to us. Updates become effective upon publication on this page.