1. Introduction & Commitment

At Refund Ninja (refundninja.com), protecting your confidential commercial data and customer privacy is our highest priority. This Privacy Policy outlines how we collect, process, store, and safeguard your operational shipping records in compliance with applicable data privacy statutes, including the California Consumer Privacy Act (CCPA/CPRA) and the General Data Protection Regulation (GDPR).

2. Information We Collect

To audit carrier invoices and recover uncredited refunds, Refund Ninja processes the following categories of information:

• Merchant Account Information: Business legal name, primary contact name, corporate email address, billing address, phone number, and authorized payment method on file.
• Carrier & Fulfillment Billing Feeds: Read-only API keys, OAuth tokens, EDI 210 (freight invoice) and EDI 214 (shipment status) data, carrier invoice numbers, billed surcharges, itemized line items, and dimensional weight scans.
• Package & Manifest Data: Tracking numbers, origin zip codes, destination zip codes, delivery timestamps, carrier service levels (Priority, Ground, Express), declared values, and carrier signature records.
• Recipient Information: Delivery street addresses and timestamps strictly required to substantiate late delivery claims or dispute invalid address-correction surcharges.

3. Purpose & Legal Basis for Data Processing

We process collected data exclusively for the following operational purposes:

• Scanning carrier and marketplace logs to identify billing discrepancies, duplicate charges, incorrect accessorial surcharges, and service failures.
• Formatting and submitting claims and dispute packets directly to carrier and marketplace billing portals.
• Verifying that credit memos and refund checks have been properly credited to Client accounts.
• Generating monthly contingency invoices and savings reports for Client finance teams.
• Maintaining the security, resilience, and integrity of Refund Ninja’s platform infrastructure.

4. The “Zero Data-Selling” Guarantee

Refund Ninja has never sold, and will never sell, rent, lease, trade, or monetize your corporate shipping data or end-consumer personal data to any third party. We do not aggregate your proprietary negotiated carrier discount rates or shipping patterns to sell competitive intelligence to brokers, carriers, or competitors. Your data is used exclusively to recover money for your business.

5. Security Architecture & Encryption Standards

Refund Ninja adheres to rigorous institutional security standards:

• Encryption in Transit: All communications between your systems, our audit engine, and carrier APIs are encrypted using modern Transport Layer Security (TLS 1.3).
• Encryption at Rest: All stored database records, access tokens, and manifest logs are encrypted using Advanced Encryption Standard (AES-256).
• Role-Based Access Control (RBAC): Access to client account data is strictly restricted to automated processing microservices and vetted support personnel with verified multi-factor authentication (MFA).
• Zero Password Storage: Whenever possible, Refund Ninja integrates via OAuth 2.0 or scoped carrier reporting tokens. We never store carrier master administrative passwords in plaintext.

6. Data Minimization & Retention Schedule

We retain shipping manifests, tracking records, and carrier invoice logs only for as long as necessary to fulfill the auditing and recovery lifecycle:

• Active Audit Logs: Maintained for up to eighteen (18) months to support retroactive carrier dispute filings, historical rate audits, and carrier lookback reconciliations.
• Automated Data Purge: Detailed package manifests older than 18 months are systematically deleted from active databases.
• Account Deletion: If you terminate your account, all connected API tokens and stored credentials are revoked and deleted within thirty (30) calendar days.

7. Merchant & Consumer Rights (CCPA / CPRA & GDPR)

Under global data privacy laws, you and your authorized representatives retain the following rights:

• Right to Access & Portability: You may request a complete export of all carrier audit records and historical dispute filings associated with your account.
• Right to Rectification: You may correct or update any account information or billing credentials at any time.
• Right to Deletion (“Right to be Forgotten”): You may request the permanent deletion of your account records, subject only to statutory tax or audit compliance obligations.
• Non-Discrimination: We do not discriminate against any merchant or user for exercising their legal privacy rights.

To exercise any of these rights, email our Data Protection team at [email protected].

8. Subprocessors & Cloud Infrastructure

Refund Ninja operates on secure, SOC-2 compliant cloud infrastructure (including Amazon Web Services and Cloudflare). Our subprocessors are contractually bound to uphold privacy and data security standards that meet or exceed those described in this Policy.

9. Incident Response & Breach Notification

In the event of a confirmed security incident impacting Client Confidential Information or personal data, Refund Ninja will notify affected account holders via email without unreasonable delay, and in all cases within seventy-two (72) hours of incident verification, providing full remediation details.

10. Contacting the Data Protection Desk

If you have questions, concerns, or requests regarding this Privacy Policy or our security architecture, contact us at:

Refund Ninja Compliance Desk
Email: [email protected]
Website: refundninja.com