Legal · Privacy Policy

Posty Privacy Policy

Effective Date: September 1, 2026 · Moda Global Inc. · itsposty.com

Moda Global Inc., doing business as Posty (“Posty,” the “Company,” “we,” “us,” or “our”), operates the website located at itsposty.com (the “Site”) and provides a post-purchase platform for e-commerce businesses that includes order benefits offered at checkout, support ticket and case management, order tracking, and related analytics (collectively with the Site, the “Services”).

This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It applies to visitors of the Site, to the merchants and other businesses that use our Services (“Merchants”), and to the customers of those Merchants whose orders include order benefits or are tracked through our Services (“Shoppers”).

By accessing the Site or using the Services, you acknowledge that you have read and understood this Privacy Policy and our Terms of Service, available at https://itsposty.com/terms. If you do not agree with our practices, please do not use the Site or the Services.

01Scope and Our Role

Posty acts in two different capacities depending on whose information is involved, and this distinction matters for how your information is handled and for which company you should contact about it.

When Posty acts on its own behalf

We are the party responsible for personal information we collect from visitors to the Site, from Merchants and their personnel who create accounts or contact us, and from Shoppers who interact with us directly (for example, by submitting or corresponding with us about a support ticket).

When Posty acts on behalf of a Merchant

When a Merchant installs our Shopify app or integrates our Services into another e-commerce platform through a custom integration, we receive order and customer information from that Merchant’s store. We process that information as a service provider (or “processor”) on the Merchant’s behalf and under the Merchant’s instructions and our agreement with the Merchant. The Merchant’s own privacy policy governs how it collects and uses your information. If you are a Shopper and have questions about how a Merchant handles your information, or wish to exercise privacy rights with respect to information the Merchant has shared with us, please contact the Merchant directly. We will assist Merchants in responding to those requests as required by law and our agreements.

02Information We Collect

We collect information in four ways: directly from you, automatically when you use the Site or Services, from Merchants and the e-commerce platforms they use, and from other third parties.

A. Information you provide to us

• Merchant account and business information: your name, business name, job title, email address, phone number, business address, store URL, platform credentials or API keys needed to connect your store, and bank account or debit card information used to bill for our Services. Bank and card details are collected and tokenized by our payment processor, Stripe; Posty stores only the resulting token and the last four digits, never full account or card numbers.
• Support ticket information: if you are a Shopper opening a support ticket about an issue with your order, we collect your name, email address, phone number, shipping address, order number, a description of the issue, any photos or other documentation you choose to provide, your preferred resolution, and any other information needed to help resolve the issue.
• Communications: information you include when you contact us for support, submit a form on the Site, request a demo, respond to a survey, or otherwise correspond with us, including the contents of your messages and any attachments.
• Marketing and event information: your name, email address, company, and preferences when you subscribe to our newsletter, download content, or register for a webinar or event.

B. Information we collect automatically

When you visit the Site, sign in to the Posty dashboard, or interact with our checkout app on a Merchant’s store, our servers and our hosting provider automatically record standard technical information about the request, such as your IP address, browser type and version, operating system, device type, the page or endpoint requested, and the date and time of the request. We use this information to deliver the Site and Services, keep them secure, block bots and abuse, and troubleshoot problems. We may also use third-party analytics services to help us understand how the Site and Services are used. See Section 4 (Cookies and Similar Technologies) for details.

C. Information we receive from Merchants and e-commerce platforms

When a Merchant connects its store to Posty, whether through our Shopify app or through a custom integration built for another platform, the Merchant’s store sends us order, customer, fulfillment, and product information (for Shopify stores, through the app and Shopify webhooks) so that we can offer order benefits at checkout, record a Shopper’s order benefits selection on the order, follow shipments, and handle support tickets. This information may include:

• Shopper contact details: name, email address, phone number, and billing and shipping addresses;
• Order details: order number, date, items purchased, order value, currency, shipping method, discounts, and whether order benefits were selected and their price;
• Fulfillment and shipping details: carrier, tracking number, shipment status, and delivery confirmation as reported by the Merchant’s store;
• Product catalog details: the Merchant’s products, variants, and prices, which we use to calculate order benefits pricing; and
• Store details: the Merchant’s store name, domain, platform, configuration settings, and aggregate order and sales data used to operate and price the Services.

When our checkout app requests live order benefits pricing, it sends the contents and value of the cart to our servers. It does not send payment information, and we do not receive payment card numbers from Merchants or their platforms.

D. Information we receive from other third parties

• Stripe, our payment processor, which confirms the status of payments and provides the tokens and last-four digits described above; and
• Shopify and other e-commerce platforms, which may provide account and store status information about a Merchant in connection with an app installation.

03How We Use Information

We use the information we collect for the following purposes:

• To provide and operate the Services, including offering order benefits at checkout, generating and delivering tracking pages and notifications, receiving and reviewing support tickets, resolving cases, and managing billing with Merchants;
• To create and manage Merchant accounts, authenticate users, process payments, and send transactional messages such as order, shipment, support ticket, and account notifications;
• To provide customer support and respond to your questions, requests, and support tickets;
• To detect, investigate, and prevent fraudulent support tickets, abuse, security incidents, and other harmful or illegal activity, and to protect the rights, property, and safety of Posty, Merchants, Shoppers, and others;
• To analyze and improve the Site and Services, including understanding how they are used, measuring order benefits attach rates and case resolution outcomes, developing new features, and refining how we price order benefits (using aggregated or de-identified data wherever practicable);
• To provide Merchants with reporting within the Posty dashboard about their orders, order benefits sales, shipping performance, and support tickets;
• To send Merchants and prospective Merchants communications about our products, features, and events, subject to your right to opt out as described in Section 8;
• To comply with legal obligations, respond to lawful requests, enforce our Terms of Service and other agreements, and satisfy tax, accounting, and audit requirements; and
• For any other purpose disclosed to you at the time the information is collected or to which you otherwise consent.

We may aggregate or de-identify personal information so that it can no longer reasonably be used to identify you. We may use and share aggregated or de-identified information for any lawful purpose, and we commit to maintaining it in de-identified form and not attempting to re-identify it, except as permitted by law to test the effectiveness of our de-identification.

04Cookies and Similar Technologies

We use cookies and similar technologies to run the Site and Services securely and, as described below, to understand how they are used. Specifically:

• Security and hosting: the Site and Services are delivered through Cloudflare, which may set cookies that are strictly necessary to route traffic, protect against attacks, and operate Cloudflare Turnstile, the bot-detection check shown on some forms. Cloudflare processes technical data such as your IP address for these purposes under its own privacy policy.
• Sign-in sessions: when a Merchant signs in to the Posty dashboard, we store a session token in the browser so that you stay signed in. It is removed when you sign out or the session expires.
• Theme preference: the Site stores a single value in your browser’s local storage to remember whether you chose light or dark mode. It contains no personal information and is never sent to us.
• Analytics: we may use third-party analytics services to understand how visitors use the Site, the dashboard, and our checkout app, and to measure and improve our Services. These services may set cookies or use similar technologies to collect information such as your IP address, device and browser information, and the pages you visit, and they process that information under their own privacy policies.

Our checkout app requests order benefits pricing from our servers and records the Shopper’s order benefits selection on that order. We do not sell personal information, share it for cross-context behavioral advertising, or engage in targeted advertising. If we begin using analytics or other third-party technologies in a way that gives you additional choices under applicable law, we will update this Privacy Policy and provide a way to exercise them. We will treat an opt-out preference signal such as the Global Privacy Control as a valid request under applicable law.

You can clear or block cookies and local storage through your browser settings. Blocking strictly necessary cookies may prevent you from signing in to the dashboard or passing the bot-detection check.

05How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only to the following categories of recipients, for the purposes described in this Privacy Policy:

• Merchants: if you are a Shopper, we share information about your orders with order benefits, shipment status, and support tickets (including case status and resolution) with the Merchant you purchased from, so the Merchant can support you and manage its own operations.
• E-commerce platforms: we exchange information with Shopify (through our app, Shopify webhooks, and the Shopify Storefront API) and with other platforms a Merchant uses so that our Services can function within the Merchant’s store. Those platforms handle information under their own privacy policies.
• Service providers: we rely on a small number of third parties to operate the Services on our behalf. Currently these are Supabase (database, authentication, and secure file storage, including support ticket photos), Cloudflare (hosting, content delivery, and bot protection), Stripe (payment processing), and Resend (delivery of transactional email such as support ticket and account notifications). We may also use third-party analytics providers as described in Section 4, and professional advisors such as lawyers, accountants, and auditors. These providers may use personal information only to perform services for us and in accordance with our instructions. We will update this Privacy Policy if the list of providers changes materially.
• Affiliates: we may share information with our current or future parent companies, subsidiaries, and affiliates, who will handle it consistently with this Privacy Policy.
• Legal and safety: we may disclose information if we believe in good faith that doing so is necessary to comply with a law, regulation, subpoena, court order, or other legal process or governmental request; to enforce our Terms of Service or other agreements; to investigate or prevent fraud, security issues, or technical problems; or to protect the rights, property, or safety of Posty, our Merchants, Shoppers, or the public.
• Business transfers: if we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our business or assets, personal information may be transferred as part of that transaction, subject to standard confidentiality arrangements. We will notify you of any change in ownership or in the use of your personal information as required by law.
• With your consent or at your direction: we may share information for other purposes when you ask us to or consent to it.

06Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In deciding how long to keep information, we consider the nature and sensitivity of the information, the purposes for which we process it, our legal, tax, and accounting obligations (support ticket and case records in particular may need to be kept for several years after a case is resolved to satisfy accounting and audit requirements), the need to defend against legal disputes, and the requirements of our agreements with Merchants. When personal information is no longer needed, we delete it, de-identify it, or securely archive it so that it is isolated from further use.

Information we process on behalf of a Merchant is retained in accordance with our agreement with that Merchant and is deleted or returned when the Merchant instructs us to or when our relationship with the Merchant ends, subject to any legal retention obligations.

07How We Protect Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encryption of data in transit and at rest, role-based access controls and authentication requirements, network and bot protection, logging and monitoring, and limiting access to personal information to personnel who need it. Bank account and payment card information is collected and tokenized by Stripe, which maintains PCI DSS compliance; Posty stores only tokens and last-four digits.

No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you believe your account has been compromised. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

08Your Choices and Privacy Rights

Marketing communications

If we send you marketing or product-update emails, you may opt out at any time by clicking the “unsubscribe” link in any such email or by contacting us at the address below. Please note that we will continue to send you non-promotional messages related to your account, orders, shipments, or support tickets, such as confirmations, status updates, security alerts, and notices about changes to our terms or policies.

Account information

Merchants can review and update account information by signing in to the Posty dashboard or by contacting us. Shoppers can update contact information associated with a support ticket by contacting us at the address below.

State privacy rights

Depending on where you live, you may have some or all of the following rights under applicable state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and comparable laws in other states:

• Right to know and access: to request confirmation of whether we process your personal information and to obtain a copy of it, including the categories of information collected, the sources, the purposes, and the categories of third parties with whom it was shared;
• Right to correct: to request that we correct inaccurate personal information;
• Right to delete: to request that we delete personal information we have collected from you, subject to certain exceptions;
• Right to data portability: to obtain a copy of your personal information in a portable and readily usable format;
• Right to opt out: to opt out of the sale of your personal information, the sharing of your personal information for cross-context behavioral advertising, targeted advertising, and certain profiling. As described in Sections 4 and 5, we do not currently engage in any of these activities; if that changes, we will update this Privacy Policy and provide a way to opt out;
• Right to limit use of sensitive personal information: to the extent we use sensitive personal information for purposes beyond those permitted by law;
• Right to non-discrimination: we will not deny you services, charge you a different price, or provide a different level of service because you exercised your privacy rights; and
• Right to appeal: if we decline to act on your request, you may appeal our decision by contacting us at the address below with the subject line “Privacy Appeal.”

To exercise these rights, email us at privacy@itsposty.com or write to us at the mailing address in Section 12. We will need to verify your identity before responding to a request, which may require you to confirm information we already hold about you (such as the email address associated with your account or support ticket). You may designate an authorized agent to make a request on your behalf; we may require the agent to provide proof of authorization and may still require you to verify your identity directly. We will respond within the time required by applicable law.

If we process your personal information on behalf of a Merchant (for example, order information received from a Merchant’s store), we may need to refer your request to the Merchant, who is responsible for responding to it, and we will assist the Merchant as appropriate.

California disclosures

In the preceding twelve months, we have collected the following categories of personal information described in the CCPA: identifiers (such as name, email address, phone number, postal address, IP address, and account identifiers); customer records (such as billing information); commercial information (such as orders, purchases, and support ticket history); Internet or network activity (such as server log data); audio, electronic, or visual information (such as support ticket photos); and professional or employment-related information (such as job title and employer for Merchant personnel). We collect these categories from the sources, use them for the purposes, and disclose them to the categories of recipients described in Sections 2, 3, and 5.

We have not sold or “shared” (as defined in the CCPA) personal information in the preceding twelve months, and we do not sell or share the personal information of consumers under 16 years of age. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA. California residents may also request information about our disclosure of personal information to third parties for their direct marketing purposes under California’s “Shine the Light” law; we do not disclose personal information to third parties for their own direct marketing purposes.

09Children’s Privacy

The Site and the Services are intended for businesses and for adults purchasing from those businesses. They are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, please contact us at privacy@itsposty.com and we will delete it as required by law.

10International Users

Posty is based in the United States, and the Site and Services are operated from the United States. If you access the Site or Services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States and in other countries where our service providers operate, which may have data protection laws that differ from those in your country. By using the Site or Services, you understand that your information will be transferred to and processed in the United States as described in this Privacy Policy.

11Third-Party Websites and Merchant Stores

The Site and Services may contain links to, or be embedded within, websites and services operated by third parties, including Merchant stores, e-commerce platforms, shipping carriers, and social networks. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. In particular, a Merchant’s store is operated by the Merchant, and your interactions with it are governed by the Merchant’s own privacy policy. We encourage you to read the privacy policies of any third-party website or service you visit.

12Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, or if you would like to exercise your privacy rights, please contact us:

• Moda Global Inc. (d/b/a Posty)
• Email: privacy@itsposty.com
• Mail: 131 Continental Dr, Suite 305, Newark, DE 19713, USA

13Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do, we will revise the “Effective Date” at the top of this page. If we make material changes, we will provide additional notice, such as by posting a prominent notice on the Site or sending an email to the address associated with your account, before the changes take effect. Your continued use of the Site or Services after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.