Privacy Policy
Shipal — Package Tracking App
Effective Date: February 25, 2026
This Privacy Policy explains how Yavio GmbH ("we", "us", "our") handles information in connection with the Shipal package tracking app ("the App"), accessible via the ChatGPT platform.
1. Data Controller
The data controller responsible for the processing described in this Privacy Policy is:
2. What We Do
Shipal allows you to track packages from carriers worldwide by entering a tracking number. The tracking number you provide is transmitted in real time to a third-party tracking service (17track, https://www.17track.net) to retrieve shipment status information.
3. Information We Process
The App processes the following information:
Package Tracking Numbers. The tracking number you provide is transmitted in real time to our third-party tracking provider (17track) to retrieve shipment status. Tracking numbers are not stored by us after the response is delivered.
Usage and Analytics Data. To improve the App and understand how it is used, we collect anonymized usage data through our own analytics system (Yavio SDK). This may include interaction events (e.g., features used, queries made), session information (e.g., session duration, session identifiers), and, where applicable, pseudonymous user identifiers. Analytics data is processed and stored on our own servers within the European Economic Area (EEA). We do not use third-party analytics services or advertising trackers for this purpose.
4. Legal Basis for Processing (GDPR)
We rely on the following legal bases for processing:
Tracking service (Art. 6(1)(b) GDPR). Processing your tracking number is necessary to provide you with the tracking service you requested.
Analytics (Art. 6(1)(f) GDPR). The collection of usage and analytics data is based on our legitimate interest in improving the App and understanding how it is used. You may object to this processing at any time by contacting us (see Section 12).
Where tracking numbers or analytics data do not constitute personal data (e.g., fully anonymized data), GDPR does not apply to that processing.
5. Third-Party Services
To provide tracking results, the App sends your tracking number to 17track. 17track operates as an independent service provider with its own data processing practices. We do not act as a data controller for any processing performed independently by 17track. We encourage you to review their privacy policy at: https://www.17track.net/en/about/privacy
Additionally, the App operates within the ChatGPT platform provided by OpenAI. Conversations within ChatGPT may be processed by OpenAI in accordance with their privacy policy and terms of use. This processing is outside of Yavio GmbH's control.
6. International Data Transfers
17track may process data on servers located outside the European Economic Area (EEA). By using the App and submitting a tracking number, you acknowledge that your tracking number may be transmitted to servers in countries that may not provide the same level of data protection as the EEA. Where applicable, we rely on the safeguards provided under Art. 49(1)(b) GDPR (transfer necessary for the performance of the service you requested).
7. Data Storage and Retention
Tracking numbers are not stored. Queries are processed in real time and are not retained after a response is delivered.
Analytics data is stored on our servers within the EEA and retained only for as long as necessary to fulfill the purposes described in this Privacy Policy. We regularly review and delete analytics data that is no longer needed.
8. Cookies and Tracking Technologies
The App does not use cookies or third-party tracking technologies. We use our own analytics system (Yavio SDK) to collect anonymized usage data as described in Section 3. No data is shared with third-party advertising or analytics providers.
9. Children's Privacy
The App is not directed at children under the age of 13. We do not knowingly collect any data from children.
10. Your Rights
If you believe we hold any information related to you, please contact us and we will address your request promptly.
Under the GDPR, you generally have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted at this URL with a revised effective date.
12. Contact
If you have questions about this Privacy Policy, please contact us at: