Shipt Privacy Notice

This privacy notice was last updated on October 25, 2024.

Scope

Shipt, Inc. (“Shipt”) is committed to protecting your Personal Information and processing it responsibly. This Privacy Notice (“Notice”) describes our general practices relating to the collection, use and disclosure of Personal Information of any individuals that we obtain in connection with our platforms and delivery services, including information collected via www.shipt.com and other Shipt-related sites, our mobile applications, communications with you, the services we provide, and our other interactions with you (collectively, “Services”). This Notice applies to information collected about our customers, Members and website visitors, as well as office visitors and individuals within our vendor and business partner organizations.

“Personal Information” means any information that relates to or may be used to identify a particular individual or household. “Member” or “Members” are respectively an individual or individuals who use Shipt’s Services and have subscribed to the Shipt membership service and are enabled to order and receive product delivery through the use of the Shipt platform. “Retail Partners” are those organizations, businesses, and entities that contract with Shipt to allow for individuals to order goods from their retail business, or purchase and have goods delivered through, the Shopper network.

By registering an account with us, accessing or using the Services, or otherwise providing us with personal information, you signify your acceptance of this Notice and expressly consent to the information-handling practices described herein. If you do not agree to this Notice, do not access or use the Services or provide us with your information.

We may change or add to this Notice, including updating this Notice or creating additional policies in order to accurately reflect changed circumstances or new legal requirements, so we encourage you to review it periodically. Your continued use of the Services after we make changes is deemed to be acceptance of those changes.

This Notice does not apply to third-party sites linked from our Services or to services offered by other companies or individuals, including products or sites that may be displayed to you. This Notice also does not cover the information practices of other companies or individuals who advertise our Services.

If you are a Shopper or prospective Shopper, please refer to the Shopper and Prospective Shopper Privacy Notice for details on how Shopper and prospective Shopper Personal Information is collected, used and disclosed. “Shoppers” are individuals to whom Shipt provides Shipt Technology Services (as defined in the applicable agreement between Shipt and each Shopper) and are enabled to accept Member orders, shop for and deliver products to Members. If you are seeking employment with Shipt, please refer to the Shipt Job Applicant Privacy Notice for details on how prospective employees' Personal Information is collected, used and disclosed.

The Personal Information Shipt Collects

How Personal Information is Used

How and to Whom Personal Information is Disclosed

How Personal Information is Protected

Retention of Personal Information

Your Choices

Third Party Links

Do Not Track Disclosure

Children

Information for Nevada Residents

Information for California Residents

Information for Washington Residents

Information for Residents of Other States

How to Contact Shipt

Personal Information Shipt Collects

Directly From You

When you browse our websites, create an account, use the Services, or communicate and otherwise interact or communicate with Shipt (including via phone, email, online forms, or any third-party chat functionality available on our websites and mobile applications), our Retail Partners, and Shoppers, Shipt may collect the following categories of Personal Information about you:

• Contact Information – First name, last name, name and address of your organization, mailing address (business or personal), email address (business or personal), phone number (business or personal).

• Transaction-Related Information - The content of your communications with us (whether online, in person, over a telephone call, via third-party chat functionality on our website, or otherwise), dietary preferences (if relevant to your purchases), driver's license or other identity document (for certain purchases, such as alcohol), date of birth, electronic signature, photos of the drop-off location for any delivered goods, orders placed, order ID number.

• Financial Account Information – Details about the financial accounts you designate to make payments or receive payments via the Services, including payment card information.

• User Account Information – Username, password, account number, or other information we may request or that you may provide relating to your account.

• Your Communications - Your messages and communications with us, including but not limited to via text, via email, via our website and through the third-party chat functionality on our website and/or mobile applications.

• Device and Usage Information – Details regarding how and when you use the Services, including the device used to connect to the Services, your IP address and device identifier, device model, mobile network information, browser type, operating system version, internet service provider, the frequency and duration of your usage, the pages you view, clickstream data, the search terms you use and pages you visit within the Services, what websites or search terms referred you to the Services, your behavior (including any bot-like behavior) using the Services, and other information about your interaction with the Services.

• Geolocation Information – Device and ordering location, precise geolocation based on your use of our mobile application (if you choose to enable this functionality on your mobile device), website or app performance based on geography.

You may choose to use the interactive and social features that Shipt offers, which permit you to access the Services, submit content and communicate with Shipt (whether online, in person, over a telephone call, via third-party chat functionality on our website, or otherwise). Doing so provides Shipt with information such as name, email address and public profile information. When you post information in these interactive and social features, the content may be publicly accessible to other users.

Please note if you choose not to provide us with some information, we may not be able to provide you with the requested products, services or information.

From Other Sources

We may obtain both Personal and non-Personal Information about you from other users of the Services, Retail Partners, business partners, vendor partners, contractors, suppliers, and other third parties. The Personal Information we collect in this manner includes the following:

• Shipt may collect Personal Information from a Shipt Member who uses the Services to have an order delivered to you. Through the use of the Services, Shipt may collect your name, mailing address, email address, phone number, and date of birth, driver’s license number or other identity document (for certain purchases such as alcohol).

• Shipt may collect Personal Information from its Retail Partners who provide Shipt information related to shopping and deliveries.

• Shipt may collect your email address from someone who believes you may be interested in becoming a Member. Individuals who provide referrals are responsible for ensuring the submission of the email address is appropriate and permissible.

• We may collect demographic information from marketing partners and vendors and other third parties who supply us with information collected from you in other contexts or from your interactions with other businesses that could include information such as income, marital status, spending habits and other information.

• We may collect tracking links, click IDs, device IDs, IP addresses, and other online identifiers from marketing partners.

We, and the third parties we engage, may combine information we collect from you over time, and across the Services, with information obtained from other sources. This helps us improve the information’s overall accuracy and completeness, and also helps us better tailor our interactions with you.

Social Media

If you interact with us on any social media platform: (i) depending on your social media privacy settings, the Personal Information that you submit on the social media platform may be read, collected, or used by us as described in this Notice, and (ii) where we respond to any interaction with you on social media, your account name/handle may be viewable by any and all members or users of our social media accounts. Social media platforms operate independently from us, and we are not responsible for the Personal Information that you choose to submit or link to on any social media platform. We encourage you to review the privacy notices and settings of any social media platform with which you interact to help you understand the platform’s privacy practices.

Cookies and Similar Technologies

We and our partners use various technologies to automatically collect and store information when you interact with our Services, including the use of cookies, web beacons, mobile software developments kits (“SDKs”) or similar technologies:

• Cookies: When you access our Service, Shipt will issue a cookie to your device. A cookie is a small file that a website or application transfers to a visitor’s device for recordkeeping purposes. We use cookies to personalize visitors’ experiences on the Services, provide content that we believe may be of interest, track visitor trends and patterns, engage in marketing and advertising, and otherwise analyze the Services traffic. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of the Services. For further information about cookies, including how to refuse cookies, please visit www.allaboutcookies.org. The categories of cookies Shipt uses include:

• Strictly Necessary Cookies: These cookies are necessary for our websites to function and cannot be turned off or disabled. These cookies are usually only set in response to specific actions you take on our websites. For example, these cookies may be used to remember your selections or information you have entered when you navigate to different pages when visiting the websites.

• Performance Cookies: Performance cookies help us learn how you use our websites to help improve their performance and design. These cookies provide us with aggregated statistical information such as number of page visits, page load speeds, how long a user spends on a particular page, and the types of browsers or devices used to access our websites. These types of cookies are deployed in connection with Analytics services we use (discussed below).

• Targeted Cookies: These third-party cookies are placed by third-party advertising platforms or networks to collect information about your visits to and actions on certain pages of our websites so that they can deliver ads for relevant products and services to you later, such as when you are on the sites of third parties.

• Web beacons: Certain webpages maintained by Shipt, as well as emails sent by Shipt, may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that collect information about page visits and email viewing. Web beacons allow us to track pages and content accessed and viewed by users, as well as to monitor email readership. Information collected may include limited personal information, such as name, email address and universal ID.

• Mobile device identifiers and SDKs: Shipt collects information from its mobile application users through deployment of mobile SDKs. A mobile SDK is the mobile app version of a web beacon. The SDK is a bit of computer code that app developers can include in their apps to enable ads to be shown, data to be collected, and related services or analytics to be performed.

• Analytics: Our Services may also use third-party analytics tools such as Google Analytics. Analytics are used to create reports and statistics on the performance of our website and present you with content tailored to your interests. Analytics can be used to collect information such as IP address, type of device, operating system, referring URLs, country information, date and time of page visits, and which pages you visit the most. You can find more information about how data is collected and processed in connection with the Google Analytics service. You can adjust your Google Ad Settings. You can also read Google’s privacy notice.

For more information about your options relating to your personal information and your communication preferences, see the “Your Choices” section below.

Personal Information and non-Personal Information may be linked together and once linked, may identify an individual person. If we do combine non-Personal Information with Personal Information, the combined information will be treated as Personal Information for as long as it remains combined.

Aggregate or Anonymized Data

In each case above, we may aggregate or anonymize the foregoing types of information in support of legitimate business purposes such that they are no longer capable of identifying you. In that event, the information is no longer considered “Personal Information” and may be used for any purpose consistent with applicable law.

When using deidentified data, Shipt does not attempt to reidentify the data. We may use and disclose deidentified or aggregated data to any third party without restriction, as permitted by applicable laws.

We may use and disclose non-Personal Information for any purpose without restriction.

Public Data

Shipt may collect data about you that we have a reasonable basis to believe is lawfully made available to the general public by you. We do not consider such data to be “Personal Information” and may use such data for any purpose consistent with applicable law.

How Personal Information is Used

Shipt (or service providers acting on our behalf) may use Personal Information to:

• Support the shopping and delivery process, including fulfilling orders, processing payment, assessing delivery fees, verifying eligibility to buy certain products, communicating with Members and Shoppers and providing customer service to users.

• Authorize access to our Services.

• Manage your account and personalize your experience when using our Services.

• Verify your identity to access the Services.

• Provide Members with personalized Services.

• Send service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you, with such messages being conveyed via telephone, SMS, email and other electronic message channels, and to otherwise communicate with you (such as using interactive chat features on our websites and mobile applications).

• Communicate with Retail Partners and Shoppers about Member orders.

• Resolve any issues with the Services.

• Administer and communicate about referral programs and memberships, rewards, surveys, campaigns, sweepstakes, contest or other promotional activities or events sponsored or managed by Shipt, its parent companies, subsidiaries and affiliates, and/or our third-party business partners.

• Send surveys, marketing, advertising and promotional messages and other information that may be of interest, including information about Shipt, the Services, or general promotions for partner campaigns and services.

• Allow you to access the platform or specific features of the platform in connection with your geolocation but if you do not want your mobile device to provide us with location information when you access the platform, please follow the instructions in the “Your Choices” section below.

• Understand how users interact with our Services, including which web pages you visit on our website, which website you visited before coming to our website, and where you go after you leave our website.

• Support Shipt’s campaigns or other marketing efforts. Information may be combined, such as how web traffic data correlates with certain geography.

• Engage in advertising and website analytics, including through third-party advertising platforms, by collecting and storing information from cookies, pixels, tags, and similar technologies when you interact with our Services or the services offered by our partners.

• We may use your personal information in connection with certain technologies to deliver or help our third-party advertising partners deliver interest-based advertising (also known as behavioral advertising) through mobile applications and browsers based on your browsing and shopping activity online.

• If you’d like to opt out of ads tailored to you in this way, please follow the instructions in the “Your Choices” section below.

• Maintain, improve and optimize our Services as well as developing new services.

• Comply with legal requirements, including responding to subpoenas and search warrants.

• Support error monitoring and app stability.

• Protect Shipt and/or its parent companies, affiliates, subsidiaries, retail partners, Members, Shoppers, and the general public, including investigation of possible fraud, theft, violations of our Terms of Service or this Notice, misuses of our Services and/or attempts to harm Shipt and/or its parent companies, affiliates, subsidiaries, retail partners, other Members or Shoppers, or any individual.

• Preventing and detecting fraud, financial crime, hacking activities, security breaches, and other unlawful activities in connection with the Services or the use of our services.

• Enforcing our agreements and defending or advancing legal claims.

• Notifying you about changes to the Services or material changes to this Notice.

• Performing other functions as otherwise described to you at the time of collection or to which you otherwise consent.

How and To Whom Personal Information is Disclosed

Parent Companies, Subsidiaries and Affiliates

Shipt may disclose Personal Information within Shipt, its parent companies, affiliates and subsidiaries.

Service Providers

We disclose Personal Information to companies or individuals that help us provide the Services or otherwise operate our business. For example, we may disclose your Personal Information to our IT and system administration providers, cloud hosting providers, customer service software providers (including those vendors providing chat functionalities and features for our websites and mobile applications), and payment processors. We may also disclose your Personal Information to our professional advisors, such as lawyers, accountants, and other similar advisors. Service providers can only process Personal Information as instructed by Shipt.

Retail Partners

We may disclose Personal Information related to transactions at merchants where you shop as part of the Services, such as the transaction-related information described above, to our Retail Partners. Shipt may also disclose your contact information to our Retail Partners, in connection with providing you customer service, facilitating a dispute you raise regarding a transaction, or otherwise assisting the Retail Partner in investigating any illegal or unauthorized activity occurring in its stores or in connection with the Services. Shipt may also disclose your Personal Information to our Retail Partners as part of our agreement with the Retail Partner. Retail Partners may use your Personal Information for their own purposes, as set forth in their privacy notices. Please review the “Your Choices” section of this Notice to learn more about what rights you may have with respect to the disclosing of your Personal Information.

Shoppers and Other Users

We may disclose your Personal Information to Shoppers or other users of the Services who have access to Personal Information you have posted or disclosed in a public forum or user-accessible means via the Services. Shoppers use your Personal Information to deliver your purchases or otherwise facilitate our provision of the Services.

Third Party Advertising Partners

We may disclose Personal Information to our third-party advertising partners to permit such third parties to deliver advertisements (whether ads from Shipt or other businesses) when you visit other websites or mobile applications. This information is used to tailor online advertisements to your perceived interests (based on the behavioral information collected about you) and to provide advertising-related services such as reporting, attribution, analytics and market research. You may be able to stop receipt of advertising in accordance with DAA and NAI opt out mechanisms, as further described in the “Your Choices” section of this Notice.

Business Transition

In the event that Shipt, or any portion of our assets or business, are acquired, sold, merged, or transferred, whether as a result of or in the event of an acquisition, divestiture, reorganization, restructuring, or dissolution, or as a going concern or as a part of bankruptcy, liquidation, or similar proceeding, or otherwise, Shipt will disclose Personal Information to the company involved to complete the business transition, including at the negotiation stage and including where the Personal Information is among the assets being transferred.

Law Enforcement

We may report to law enforcement agencies any activities that we reasonably believe to be unlawful, or that we reasonably believe will aid a law enforcement investigation into unlawful activity. In addition, we reserve the right to release your Personal Information to law enforcement agencies if we determine, in our sole judgment, that either you have violated our policies, or the release of your Personal Information will protect the rights, property or safety of Shipt, or another person.

Legal Process

We may disclose your Personal Information to others as required or permitted by law. This includes disclosing your Personal Information to governmental entities or third parties in response to subpoenas, court orders, other legal process, or as we believe is necessary to comply with applicable laws, to exercise our legal rights, to defend against legal claims that have been brought against us, or to defend against possible legal claims that we determine in our sole discretion might be brought against us.

With Your Consent

We will disclose Personal Information when we have your consent or when you have directed us to do so.

How Personal Information is Protected

Shipt uses commercially reasonable administrative, organizational, and physical safeguards designed to protect Personal Information from loss, theft, and unauthorized use, disclosure or modification. Please be aware that no data transmission over the internet is 100% secure. While we strive to protect your Personal Information, we cannot ensure or warranty the security of any information you transmit to us, and you do so at your own risk.

Retention of Personal Information

Shipt will retain your Personal Information for as long as is reasonably necessary to fulfill the purpose for which it was disclosed or as required to comply with legal obligations. The precise periods for which we keep your Personal Information vary depending on the nature of the information and why we need it. Factors we consider in determining these periods include the minimum required retention period prescribed by law or to fulfill the purpose(s) for which the Personal Information was collected. At the end of that period, Shipt will securely delete the Personal Information. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of such data.

Your Choices

In addition to the options described in detail below, you may submit a request to Shipt or otherwise contact Shipt about this Notice by using the information provided in the “How to Contact Shipt” section at the end of this Notice.

Email Marketing

At any time, you can opt out of marketing emails by clicking on the unsubscribe link in the footer of the marketing email. You may still receive operational emails such as order confirmation or other service-related emails. In some cases, we may provide an unsubscribe link within an operational email (e.g., surveys).

Text Messages (SMS)

By creating a Shipt user account, you consent to accept and receive communications from Shipt and/or its third party partners, including via text messages to the phone number you provided to Shipt. You understand and agree that you may receive messages related to your order (“Transactional Messages”). By selecting the opt-in option, you provide your express consent to receive marketing messages (“Marketing Messages”) (collectively, the “Text Messages”) generated by Shipt’s dialing system which may deliver prerecorded messages sent by or on behalf of Shipt, its affiliated companies, and/or third party partners, including but not limited to communications concerning orders placed through your Shipt account. You acknowledge that (i) the frequency of Text Messages may vary; and (ii) standard message and data rates may apply. You can opt-out of the Text Messages at any time by texting "STOP". After you send "STOP", we may send you an additional text message to confirm that you have been unsubscribed. You will no longer receive text messages from that short code or number, as applicable, but you may receive text messages if you are subscribed to other text lists. If at any time you have questions about the text messages, text "HELP". After you send “HELP” we will respond with instructions on how to contact us for support. Message and data rates may apply. Data obtained through text messages will not be shared with any third-parties for their own reasons/purposes.

Push Notifications

You can opt out of receiving push notifications from the Shipt mobile app by adjusting the permissions on your mobile device. This opt out does not apply to in-app notifications.

Geolocation

You may prevent your mobile device from sharing location data by adjusting the permissions on your mobile device.

Online Ad Choices

You may find more information about entities involved in online advertising and additional choices you may make, including opting out of having your information used for Internet-based advertising, through the Network Advertising Initiative (NAI) at the NAI Service, and the Digital Advertising Alliance (DAA) at the DAA consumer choice service. Shipt is a participant in the online industry’s self-regulatory program administered by the DAA and has agreed to adhere to the DAA’s principles applicable to interest-based ads. The tools provided at the DAA opt out page and the NAI opt out page are provided by third parties, not Shipt. Shipt does not control or operate these tools, or the choices advertisers and others provide through these tools.

Website Analytics

Analytics services such as Google Analytics provide services that analyze information regarding visits to our websites and mobile apps. They use cookies, web beacons and other tracking mechanisms to collect this information. Learn more about Google's privacy practices, or to opt out of Google Analytics, install the Google Analytics Opt-out Browser Ad-on.

Jurisdiction-specific Choices

Choices relating to the rights afforded consumers under the California Consumer Privacy Act (CCPA) are described in the “Information for California Residents” section below. Choices relating to the rights afforded to consumers residing in other U.S. states are in the “Information for Residents in Other States” section below.

Declining to Provide Information

You can choose not to provide us with information we may request through the Services, but that may result in you being unable to use certain features of the Services, request information about our Services, or initiate other transactions with us.

Third Party Links

Shipt’s platforms, including its website and mobile apps, may contain links to webpages created by parties other than Shipt. We do not control such websites and are not responsible for their contents or the privacy policies or other practices of such websites. Our inclusion of links does not imply any endorsement of the material on such websites or any association with their operators. These websites and services may have their own privacy notices, which the user will be subject to upon linking to the third party’s website. Shipt strongly recommends that users review the third party’s terms and conditions and privacy policies.

Do Not Track Disclosure

Some browsers have a “do not track” feature that lets you tell websites that you do not want to have your online activities tracked. Except for legally-recognized universal opt out mechanisms (such as Global Privacy Control), we do not respond to “do not track” signals.

Children

The Services are not intended for use by children. We do not intentionally gather Personal Information online about visitors who are under the age of 16. If a child has provided us with Personal Information, a parent or guardian of that child may contact Shipt to have the information deleted from our records. If you believe that we might have any information from a child under age 16, please contact us at privacy@shipt.com. If we learn that we have inadvertently collected the Personal Information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible.

Information for Nevada Residents

Nevada law gives Nevada consumers the right to direct a company to not sell certain of their Personal Information. This right applies even if their Personal Information is not currently being sold. If you are a Nevada resident and wish to exercise this right, please submit a “Do not sell your personal information request” by filling out this form.

Information for California Residents

If you are a Shopper or prospective Shopper and a California resident, please refer to the Shopper and Prospective Shopper Privacy Notice for details on how Shopper and prospective Shopper Personal Information is collected, used and disclosed, including with respect to California consumers.

If you are seeking employment with Shipt and a California resident, please refer to the Shipt Job Applicant Privacy Notice for details on how prospective employees’ Personal Information is collected, used and disclosed, including with respect to California consumers.

A. California Shine the Light Law

In connection with the California “Shine the Light” law, Shipt has a policy of not disclosing the Personal Information of certain California residents to third parties for their direct marketing purposes if the resident contacts us to opt out of the disclosure of Personal Information to third parties for their direct marketing purposes. You may choose to exercise your right to opt out of the sharing of your Personal Information with third parties for their direct marketing purposes, free of charge, at any time by filling out this form or submitting a request to privacy@shipt.com.

B. California Consumer Privacy Act

This section supplements the other information in this Notice and applies solely to “consumers” as defined by the California Consumer Privacy Act of 2018, as amended from time to time, and its related regulations (the “CCPA”). Specifically, this Notice applies to our processing activity when we are acting as a “business” under the CCPA—meaning that we control the purposes and means of processing your personal information. This section explains Shipt’s collection, processing, and disclosure of personal information relating to California consumers or households.

As defined by the CCPA, “personal information” includes any information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information does not include information:

• That is lawfully made available from government records.

• That Shipt has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or by the consumer.

• Made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

• That is lawfully obtained, truthful information that is a matter of public concern.

• That is deidentified or aggregate consumer information.

• Excluded from the CCPA’s scope, personal information is covered by certain sector-specific privacy laws such as the Fair Credit Reporting Act.

In the past 12 months, Shipt has collected the following categories of personal information from consumers and disclosed such information to the following categories of third parties for the business purposes further described below.

Please note that we may also use, disclose, or transfer your information in connection with the sale, merger, dissolution, restructuring, divestiture, or acquisition of our company or its assets. We may disclose your personal information in response to a court order, subpoena, search warrant, law or regulation.

Shipt collects these categories of personal information from the following sources:

• Direct collection: We collect information directly from you when you choose to provide it to us by filling out forms on our website, engaging in transactions with us, signing up to receive promotional or information communications from us, communicating with us about our services, or otherwise directly providing the information to us as described above.

• Indirect and technology-based collection: We also collect certain information from you indirectly when you visit, use, or navigate our Services. Shipt collects certain identifiers (such as IP addresses) and internet and similar network activity (such as website usage data) from you indirectly using cookie, pixels, and passive tracking technologies, as described above.

• Collection via social media: We may collect personal data about social media users, including basic user profile information (such as username), user-generated content (such as posts, comments, pages, profiles, or feeds) and associated metadata (such as time and location of a post or comment); contact details (such as name, email address, telephone number if made public by the user); and additional individual information published by the user (such as employer, profession, age, location, education information, habits, etc.). The type and scope of personal data obtained from social media platforms depends on the type of APIs and permissions set out by the respective platforms and the administrative permissions granted by customers, where applicable.

• Third-party collection: From time-to-time, we may obtain marketing or lead lists from third party vendors. For example, we engage vendors who provide us with information that was collected from your interactions with third parties that indicate you may be interested in Shipt’s services. We use this information, for example, to send you marketing communications.

Sensitive Personal Information

Shipt does not collect or process “sensitive personal information” (as defined by the CCPA) for the purposes of inferring characteristics about California consumers. For example, Shipt does not collect or process geolocation information for the purposes of inferring characteristics about California consumers. Accordingly, Shipt treats any such information as “personal information” consistent with applicable provisions of the CCPA.

Purposes for the Collection and Use of Personal Information

We collect and use your personal information we collect for the following business or commercial purposes (as well as any other purposes as set forth in our Notice above).

• Providing and optimizing your experience on our website and ensuring that our content is presented to you in the most effective manner.

• Fulfilling transactions with you, processing your payments, and managing the transaction and delivery process.

• Communicating with you and responding to your inquiries about our Services, including to provide you with promotional and informational communications regarding our services, informing you about new services, updating you about changes to our Services, and investigating any concerns you have about our Services or your transactions.

• Engaging in analytics regarding use of our Services by customers for the purposes of marketing to current or potential customers

• Developing, updating, and improving our services, customer service, customer experience, and marketing efforts, and otherwise improving our knowledge and insights regarding customers.

• Preventing and detecting fraud, financial crime, hacking activities, security breaches, and other unlawful activities in connection with the Services.

• Enforcing our agreements with customers and complying with our legal or regulatory obligations.

Performing other functions as otherwise described to you at the time of collection or to which you otherwise consent.

Applicable Retention Periods

Shipt determines the retention period for each category of personal information based on the criteria set forth above in the section titled “Retention of Personal Information”.

Sale or Sharing of Personal Information

Retail Partners

Shipt discloses some personal information concerning member transactions that may qualify as a sale of information as defined by the CCPA. For example, Shipt discloses purchase transactional information about a specific retailer with said retailer, such as transactions concerning how many Shipt Members used a particular retailer, and what items were purchased, during a specific time. This information may include personal information such as order ID, Member email address or telephone number.

In the past 12 months, Shipt has sold the following categories of personal information to its Retail Partners for the purposes of fulfilling our contracts with those Retail Partners:

• Identifiers: First and last name, email address, telephone number, order ID.

• Commercial information: Records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.

• Internet or other similar network activity: Browsing history, search history, information on a consumer’s interaction with the Retail Partner’s site or store.

Other Sales

In the past 12 months, Shipt has also sold to (i) marketing/advertising service companies, and (ii) online analytics providers, the following categories of personal information:

• Identifiers: First and last name, mailing address, email address, telephone number, retail loyalty card number or card ID, household identifier or primary card.

• Commercial information: Records of transactions and other purchasing histories.

Shipt sold such personal information for the purposes of allowing such third parties to provide targeted advertising and cross-context behavioral advertising services to others.

Sharing

As described elsewhere in this Notice, Shipt discloses personal information to its third-party analytics, advertising, and marketing vendors to assist such vendors in delivering interest-based advertisements on Shipt’s and others’ behalf to consumers when they interact with various websites or mobile applications. This activity may qualify as a “share,” as defined by the CCPA. Often, the personal information that is shared is collected and disclosed via the use of cookies, pixels, tags, and similar technologies. You can learn more about these technologies in the “Cookies and Similar Technologies” section above.

In the past 12 months, Shipt shared with (i) marketing/advertising service companies (including social media and third-party advertising platforms), and (ii) online analytics providers, the following categories of personal information for the purposes of cross-context behavioral advertising:

• Identifiers: First and last name, mailing address, email address, telephone number, retail loyalty card number or card ID, household identifier or primary card, IP address, device ad ID.

• Internet or other similar network activity: Cart additions, completed purchases, products browsed, ads interacted with, pages clicked on or through.

• Commercial information: Records of transactions and other purchasing histories.

• Geolocation information: City, zip code, or state of residence.

Shipt shared such personal information for the purposes of allowing such third parties to provide targeted advertising and cross-context behavioral advertising services to Shipt and others.

Additional information regarding how you may exercise your right to opt-out of the sale of your personal information is located below in the section titled, “How to Exercise Your Rights,” below.

Shipt does not have actual knowledge of any sales or sharing of personal information regarding minors under 16 years of age.

How to Exercise Your Rights

The CCPA provides California residents with the following rights relating to their personal information, subject to certain exceptions:

Access/Data Portability: the right to request access to the personal information that Shipt collects, uses, discloses, sells or shares (including that personal information collected and used in the past 12 months) and the right to request that we provide copies of the specific pieces of personal information we collected about you.

• If a verifiable consumer request is made, and subject to any exceptions or limitations under the CCPA, we will take steps to deliver the personal information to you electronically in a portable and readily useable format, to the extent technically feasible. Consistent with the CCPA and our interest in the security of your personal information, we will not provide copies of sensitive personal information we may receive from you (e.g., driver’s license number, other government-issued identification number, financial account number, account password, or security questions or answers) in response to a CCPA request, to the extent any of those items are in our possession.

Deletion: the right to request that Shipt delete personal information we have collected from you subject to certain exceptions permissible by the applicable law.

• Please note that if you are a Shipt Member and you submit a deletion request, your account will be deactivated. If you would like to continue your membership after deletion, you will need to set up a new membership account, which will be devoid of all prior order history or other information. We may retain an archived copy of your records as permitted or required by law.

Do Not Sell: the right to request that Shipt opt you out of the sale of your personal information.

Do Not Share: the right to request that Shipt opt you out of the sharing of your personal information for the purposes of cross-context behavioral advertising.

Correction: if we maintain inaccurate personal information about you, the right to request that Shipt correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.

As mentioned above, if you are a Shopper or prospective Shopper and a California resident, please refer to the Shopper and Prospective Shopper Privacy Notice for details on how to exercise your rights. If you are seeking employment with Shipt and a California resident, please refer to the Shipt Job Applicant Privacy Notice for details on how to exercise your rights.

How to Submit a Request

You can submit a request using the methods listed below:

• Access/Data Portability Requests: Contact Shipt at 877-557-1484 or click this link.

• Deletion Requests: Contact Shipt at 877-557-1484 or click this link.

• Do Not Sell My Personal Information Requests: Contact Shipt at 877-557-1484 or click this link.

• Do Not Share Requests: Contact Shipt at 877-557-1484 or click this link.

• Correction Requests: Contact Shipt at 877-557-1484 or click this link.

Process for Do Not Sell or Share My Personal Information Requests

To exercise your right to opt out of the sale or sharing of your personal information, you—or someone authorized to act on your behalf—can submit a request through one of the methods listed below:

• Do Not Sell My Personal Information Requests: Contact Shipt at 877-557-1484 or click this link.

• Do Not Share Requests: Contact Shipt at 877-557-1484 or click this link.

Universal Opt Out Mechanism

In addition, you may choose to enable a universal online tool that automatically communicates your opt out preferences, such as the Global Privacy Control. In accordance with applicable law, Shipt recognizes such universal opt out mechanisms and processes them in a frictionless manner as a request to opt out of the sale and sharing of your personal information at the browser level. Please consult and use the settings and extension available to you by your browser to implement any available universal opt out mechanism.

Shipt’s websites will recognize the use of a universal opt out mechanism. That said, your opt out request may be processed differently depending on whether you are logged into your Shipt account during your interaction with the applicable website. If you are logged into your Shipt account, your preference will be associated with your account, and the browser with which you exercised your choice.

If you are not logged into your account, your request will only be associated with that browser with which you exercised your choice; please use one of the methods identified below to opt out of the sale or sharing of your personal information collected by other means or to otherwise communicate your preference in connection with your Shipt account.

Processing Opt Outs

The CCPA requires us to comply with a consumer request to opt out of sales or sharing as soon as feasibly possible, but no later than fifteen (15) business days from the date the request is received. No verification is required; however, we may deny a request to opt-out of sales or sharing if we have a good-faith, reasonable, and documented belief that the request is fraudulent. In the event we deny a request for this reason, we will inform the consumer that we are not complying with the request and provide an explanation of why we believe the request is fraudulent.

Requests may be made using an authorized agent, if the consumer provides the agent with written permission signed by the consumer to act on the consumer’s behalf. We may deny a request if the applicable agent does not submit proof that it has been authorized by the consumer to act on the consumer’s behalf.

Once a consumer makes an opt out request, we will honor such request for at least twelve (12) months before asking the consumer to reauthorize personal information sales or sharing.

Additionally, if a consumer initiates a transaction or attempts to use a product or service that requires the sale or sharing of the consumer’s personal information, we may inform the consumer that the transaction, product or service requires the sale or sharing of the consumer’s personal information and provide the consumer instructions on how to opt in to sales or sharing.

Shipt uses an advertising service, Criteo, for internet based retargeting advertising. Criteo works through the use of a web pixel on Shipt’s website that will collect electronic information about you. Shipt does not see this information, which is transmitted directly to Criteo. Criteo considers the use of their product to be a potential data sale under California law. Accordingly, if you wish to opt out of the use of Criteo services with respect to your data, you may do so via Criteo’s opt out mechanism.

Process for an Access/Data Portability, Deletion or Correction Request

You will be required to provide at least 4 pieces of information which may include your name, mailing address, email address and phone number. Shipt will use this information to search our systems and determine if we have information about you. If we are able to locate information about you, we will fulfill your request. If we are not able to match the 4 pieces of information you submit, we may only be able to provide you with a report that includes the categories of Personal Information we collect, use, disclose or sell.

A link to your access report will be sent to you by email, which will be sent to the email address you provided at the time you submitted your request.

If you are an authorized agent, you will be required to submit your name, mailing address, email address and phone number as well as the name, mailing address, email address and phone number of the individual you are making a request on behalf of. Shipt will use the individual’s information to search our systems and determine if we have information about the individual. If we are able to locate the information about the individual, we will fulfill the request. As an authorized agent you will receive an email confirming that we received the request along with a second email asking you to fill out a certification form confirming your information and certifying that you have the right to make this request on behalf of the individual. Once the report is ready, it will be sent to the email address you have given us.

The CCPA requires us to respond to a verifiable consumer request within forty-five (45) days of its receipt; however, we may extend that period by an additional 45 days. If we require more time, we will inform you of the reason and extension period in writing. We will deliver our written response via e-mail. Any disclosures we provide will only cover the twelve (12)-month period preceding the receipt of the verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. You may only make a verifiable consumer request for access twice within a twelve (12)-month period, provided that you may request disclosure beyond the 12-month period as permitted by the CCPA. We will not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing the request.

Our Commitment Not to Discriminate

Consistent with the CCPA, we will not discriminate against you for exercising any of your CCPA rights by:

• Denying you goods or services.

• Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Providing you with a different level or quality of goods or services.

• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Information for Residents of Washington

The Washington My Health My Data Act (the “MHMDA”) comes into force on March 31, 2024, and regulates the collection of “consumer health data” relating to “consumers” as defined in the MHMDA. As of March 31, 2024 and in response to MHMDA, Shipt has implemented technical controls to prevent the sale of products through its platform to consumers that would result in it collecting “consumer health data” and will not otherwise collect such data.

Information for Residents of Other States

This section supplements the other information in this Notice and provides additional details for residents of Virginia, Colorado, Connecticut, Utah, Oregon, and Texas (i.e., “consumers,” as defined by the Virginia Consumer Data Protection Act (“VCDPA”), Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CTDPA”), Utah Consumer Privacy Act ("UCPA"), Oregon Consumer Privacy Act (“OCPA”), and Texas Data Privacy and Security Act (“TDPSA”) respectively).

The categories of personal data (as defined by the above-mentioned laws) of consumers processed by Shipt, the categories of personal data that are disclosed to third parties, the categories of third parties to whom Shipt discloses personal data, and a description of how those third parties may use the information are the same as those described above in the Section titled, Personal Information Shipt Collects and How and To Whom Personal Information is Disclosed, and in the table in Section B of Information for California Residents. Such personal data is processed by Shipt for the purposes described above in the Section titled, How Personal Information is Used, and the Purposes for the Collection and Use of Personal Information subsection in Section B of Information for California Residents. The categories of personal data sold by Shipt or processed by Shipt for the purposes of targeted advertising (as well as the categories of third parties who receive such data) are the same as those described above in the subsection titled Sales or Sharing of Personal Information in Section B of Information for California Residents. Consumers can contact Shipt at the information in the “How to Contact Shipt” section below.

Shipt does not process any personal data for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning a consumer.

Residents of Virginia, Colorado, Connecticut, Utah, Oregon and Texas have the right under the VCDPA, CPA, CTDPA, UCPA, OCPA, and TDPSA (as applicable, and each subject to applicable limitations or exceptions) to:

• Confirm whether or not Shipt is processing the consumer’s personal data and to access such data;

• Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of processing of the consumer's personal data;

• Correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data;

• Delete personal data provided by or obtained about the consumer;

• Obtain a copy of the consumer’s personal data, (a) for Virginia and Utah residents, that the consumer previously provided to Shipt, and (b) for Colorado and Connecticut residents –processed by Shipt, in a portable, and to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and

• Opt-out of the processing of the consumer’s personal data for the purposes of: (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

If you are a resident of Colorado, an explanation of how requests to opt out of the sale of personal data, or the processing of personal data for the purposes of targeted advertising using a universal opt out mechanism is in the “Information for California Residents” section above, in the sub-section titled “Process for Do Not Sell or Share My Personal Information Requests”.

If you are a resident of Virginia, Colorado, Connecticut, Utah, Oregon or Texas you may exercise these rights by clicking this link. We will verify your request using commercially reasonable efforts: this may include requiring you to provide at least 4 pieces of information which may include your name, mailing address, email address and phone number. Shipt will use this information to search our systems and determine if we have information about you. If we are able to locate information about you, we will fulfill your request, to the extent no exception or limitation under the VCDPA, CPA, CTDPA, UCPA, OCPA or TDPSA (as applicable) applies. If we are not able to match the 4 pieces of information you submit, we may only be able to provide you with a report that includes the categories of Personal Information we collect, use, disclose or sell. Note: Shipt does not sell Sensitive Personal Data or Biometric Information, as defined by the foregoing statutes.

If you are a resident of Colorado, Connecticut, Oregon, or Texas, requests to opt-out of the processing of your personal data may be made using an authorized agent. An authorized agent may be required to submit their name, mailing address, email address and phone number, as well as information about the consumer on whose behalf they are making the request, all of which will be used to authenticate the agent’s authority. We may deny a request if we cannot authenticate the authorized agent’s authority to act on the consumer’s request. Authorized agents may submit an opt-out request via this link.

Shipt will respond to the request within 45 days of receipt of the request; however, we may extend the period for response by an additional 45 days when reasonably necessary, in which case we will inform you of the extension together with the reason. If Shipt declines to take an action regarding your request, we will inform you of such, including the justification for declining to take action and instructions on how to appeal the decision.

Information provided in response to a request shall be provided free of charge. If requests are manifestly unfounded, excessive, or repetitive, Shipt may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. Shipt will not charge Oregon residents a fee to confirm that inaccuracies were corrected or information was deleted in compliance with a previous request.

In the event Shipt declines to take action regarding your request, you may appeal the decision by contacting Shipt at: privacy@shipt.com.

• If you are a resident of Virginia, within 60 days of receipt of an appeal, we will inform you of any action or inaction taken in response to such appeal. If the appeal is denied, you may contact the Virginia Attorney General to submit a complaint.

• If you are a resident of Colorado, within 45 days of receipt of an appeal, we will inform you of any action or inaction taken in response to such appeal, or if an extension (of up to 60 days) is warranted together with the reasons for the delay. If you have concerns about the results of the appeal, you may contact the Colorado Attorney General.

• If you are a resident of Connecticut, within 60 days of receipt of an appeal, we will inform you of any action or inaction taken in response to such appeal. If the appeal is denied, you may contact the Connecticut Attorney General to submit a complaint, including via this link.

How to Contact Shipt

If you have questions about this Notice, you can contact us in one of the following ways:

Send an email to: privacy@shipt.com

Write to:

Shipt

Attn: Legal Department

420 20th St. N, Suite 100

Birmingham, AL 35203

Changes to this Privacy Notice

Shipt will update this Notice periodically to reflect changes to our privacy practices. We will provide notice online when we make any material changes to this Notice.

Changes since last update on August 20, 2024:

• Addition of SMS policy