This is Outpost's current privacy policy for its United States business-to-business service.
Overview
Outpost provides returns-processing software for third-party logistics providers, warehouses, brands, and their authorized personnel. This Privacy Policy explains how we collect, use, disclose, and protect personal information when people visit our websites, create or use an Outpost account, communicate with us, or otherwise interact with Outpost in a context where Outpost decides why and how personal information is processed.
Outpost also processes data for business customers through the Outpost platform. For that customer-controlled data, the business customer ordinarily determines the purposes and means of processing and Outpost acts as its processor or service provider. If your information appears in a return record, warehouse photograph, customer-support record, or other customer workspace content, please direct privacy requests first to the retailer, brand, warehouse, or logistics provider with which you have a relationship. We will support that customer in responding as required by our Data Processing Addendum and applicable law.
1. Scope and roles
This Policy applies to Outpost websites, account registration, the hosted Outpost platform, the Outpost station application, billing and support interactions, and other services that link to this Policy (collectively, the "Services"). It does not govern a customer's own privacy practices, websites, policies, or customer-directed third-party integrations. Outpost currently markets and offers the Services only to United States-based businesses for operations in the United States.
Depending on the context:
- Outpost acts as a controller or business for account, sales, billing, website, security, support, and relationship-management information that Outpost determines how to use.
- Outpost acts as a processor, service provider, or contractor for Customer Data submitted to the platform by or for an Outpost business customer, including return records, consumer contact details, item and order information, warehouse evidence, and operational instructions.
- The Outpost customer remains responsible for giving legally required notices, obtaining any necessary permissions, honoring consumer choices, and giving Outpost lawful processing instructions for Customer Data.
2. Personal information we collect
The information we collect depends on how a person interacts with Outpost and how a customer configures the Services.
Account and identity information
We may collect name, business email address, company name, job title or role, account identifiers, profile information, login and authentication records, invitation status, facility or client assignments, preferred language, and similar account details. Warehouse personnel records may include a display name, role, facility assignment, and a four-digit station PIN that authorized tenant administrators can view and manage. The PIN is a workplace convenience code used to identify an associate inside an already activated, facility-bound station; it is not represented as password-grade account authentication. We do not intend to collect Social Security numbers, government identification numbers, or biometric templates through the Services.
Customer workspace and return information
Customers and their connected systems may provide order and return numbers, return merchandise authorization numbers, tracking numbers, carrier information, customer email addresses, product names, stock-keeping units, barcodes, item quantities, return reasons, condition observations, warehouse notes, grading outcomes, disposition decisions, value-added-service records, photographs of packages or returned items, timestamps, facility details, and related operational history. Photos may incidentally contain shipping labels, surroundings, or people; customers should train personnel to avoid capturing unnecessary personal information.
Integration and credential information
We may process identifiers, configuration details, connection status, instance URLs, shop or warehouse identifiers, API or OAuth credentials, refresh tokens, printer and computer identifiers, print-job metadata, and synchronization results for customer-authorized warehouse management, marketplace, carrier, printing, email, and other integrations. Credentials are used to provide the requested connection and are not intended for display to ordinary users.
Billing and commercial information
We may collect billing contact details, company and billing addresses, tax information, plan and order details, subscription status, usage counts, invoice and payment status, transaction identifiers, and limited payment-method metadata. Stripe processes bank-account and card details for us. Outpost does not intend to store complete card numbers or complete bank-account credentials in its own application database.
Device, network, and usage information
We may collect IP address, browser and device type, operating system, session and device identifiers, referring page, pages and features used, timestamps, approximate location inferred from IP address, performance information, error reports, audit events, security events, and similar technical data. The station application may collect device activation, revocation, synchronization, and diagnostic events required to operate a shared warehouse device.
Communications and support information
We collect information included in emails, support requests, sales conversations, questionnaires, feedback, and other communications with Outpost, together with metadata about those interactions.
AI-assisted feature information
If an AI-assisted feature is enabled, Outpost may send limited product or return content to an AI service provider to perform a requested function. Current product designs may use product names and an item image for product classification, or product names, condition tags, and warehouse notes to produce a concise issue summary. These features are not intended to send payment credentials, integration secrets, or a return customer's email address to the AI provider. AI output may be stored with the related return record and should be reviewed by an authorized user before it is relied upon.
Inferences and derived information
We may derive account health, feature usage, operational metrics, billing measurements, issue classifications, security risk signals, return summaries, and similar information from the information above.
3. Sources of personal information
We collect personal information:
- directly from account owners, users, prospects, and people who communicate with us;
- from the Outpost business customer that creates an account, invites a user, configures a facility, or supplies Customer Data;
- from customer-authorized systems and integrations, such as warehouse management systems, marketplaces, carriers, payment processors, printing services, and email providers;
- automatically from browsers, applications, devices, cookies, logs, and monitoring tools; and
- from service providers, business partners, and public business sources used for security, support, sales, or compliance.
4. How we use personal information
We use personal information to:
- provide, operate, maintain, secure, troubleshoot, and improve the Services;
- authenticate users, manage permissions, isolate customer workspaces, activate station devices, and prevent unauthorized access;
- import, process, grade, document, route, reconcile, and report on returns according to customer instructions;
- operate customer-selected integrations, print labels, synchronize records, and send authorized write-backs;
- create and administer accounts, trials, subscriptions, metered usage, invoices, payments, cancellations, and refunds;
- communicate about accounts, security, billing, service changes, support, and requested product information;
- monitor availability, performance, abuse, fraud, and security incidents, and preserve audit evidence;
- provide AI-assisted classification or summarization when the feature is enabled;
- create aggregated or deidentified analytics that are not reasonably capable of identifying a person or customer, and maintain them in deidentified form;
- comply with law, enforce agreements, establish or defend legal claims, protect people and property, and cooperate with lawful requests; and
- conduct a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction subject to appropriate confidentiality protections.
Where applicable law requires a legal basis, Outpost relies on performance of a contract, steps requested before entering a contract, compliance with legal obligations, consent, and legitimate interests such as operating and securing a B2B service, preventing fraud, supporting customers, improving reliability, and managing business relationships. We balance those interests against the rights and expectations of affected people.
5. How we disclose personal information
We may disclose personal information as follows:
- Customer workspace participants. Information is available to the Outpost customer and its authorized users according to configured roles, tenant boundaries, brand assignments, and facility assignments.
- Service providers and subprocessors. We use vendors for application and database hosting, authentication, storage, backups, payment processing, transactional email, monitoring, AI-assisted features, and related business operations. They may process information only to provide contracted services or as otherwise permitted by law. The current vendor list is maintained in Schedule 3 of the Data Processing Addendum.
- Customer-directed integrations. At a customer's direction, Outpost exchanges information with systems such as ShipHero, Mirakl, EasyPost, PrintNode, Labelary, or another integration selected by that customer. The third party's own terms and privacy practices apply to its independent processing.
- Professional advisers and business operations. We may disclose information to auditors, counsel, accountants, financial institutions, and similar advisers subject to duties of confidentiality.
- Legal, safety, and rights protection. We may disclose information when we reasonably believe disclosure is required by law or legal process, or is appropriate to protect rights, security, safety, property, users, customers, or the public.
- Corporate transactions. Information may be disclosed under confidentiality obligations in connection with a financing, diligence process, merger, acquisition, restructuring, bankruptcy, or sale of some or all of the business.
- At a person's or customer's direction. We disclose information when an authorized person or customer instructs us to do so.
6. Sale, sharing, and targeted advertising
Outpost does not sell personal information for money. Based on the Services' current design, Outpost does not share personal information for cross-context behavioral advertising and does not process personal information for targeted advertising. We do not knowingly sell or share the personal information of people under 16.
If Outpost later introduces advertising technology or another practice treated as a sale, sharing, or targeted advertising under applicable law, we will update this Policy and provide required opt-out methods before the practice begins. Because our present practices do not involve sale, sharing, or targeted advertising, there is currently no financial-incentive program or sale/sharing opt-out required for the Services. We will honor legally recognized browser-based opt-out preference signals where required for a practice to which they apply.
7. Cookies and similar technologies
The Services use technologies needed to authenticate users, maintain security, remember an active workspace, operate a station device, preserve user preferences, route traffic, and complete payments. These may include secure session cookies, an active-tenant preference cookie, and an opaque station-device token. Stripe or another customer-directed service may set its own technologies when a user opens that service.
Outpost may use limited diagnostics or performance monitoring, including Sentry when configured. The current configuration disables default PII collection and session replay, removes request bodies, cookies, authentication headers, and query values from monitoring events, and filters common credentials and contact identifiers before transmission. Monitoring events may still contain route paths, pseudonymous user IDs, error details, device/browser information, and performance data needed for diagnosis. If we enable nonessential analytics, advertising, session replay, or similar technologies, we will provide consent or choice controls where required. Browser settings can block some technologies, but blocking essential technologies may prevent account access or core features from working.
Some browsers offer a "Do Not Track" setting. Because there is not a uniform industry standard for that signal, the Services do not respond to it as a universal request. This statement does not limit our obligation to honor legally recognized opt-out preference signals where applicable.
8. Data retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, the customer's documented instructions, and applicable legal, accounting, security, and contractual requirements. The criteria we use include the duration of the customer relationship; whether an account or return remains active; the time needed for reconciliation, billing, audit, support, dispute, warranty, fraud-prevention, and security purposes; statutory limitation periods; legal holds; and the backup lifecycle.
In general:
- Customer Data is retained during the customer relationship and then returned, deleted, or deidentified according to the applicable agreement, customer instructions, and Outpost's documented deletion process.
- Account and profile data is retained while the account is active and for a limited period afterward to administer termination, prevent fraud, resolve disputes, and meet legal obligations.
- Billing, invoice, tax, and transaction records are retained for the period required by financial, tax, and accounting law.
- Security, access, device, and audit records are retained for a period proportionate to investigation, fraud-prevention, compliance, and system-integrity needs.
- Backup copies are protected from ordinary use and deleted or rendered inaccessible according to the backup provider's lifecycle, except where immutable retention or law temporarily prevents deletion.
We may retain aggregated or deidentified information that is not reasonably capable of identifying a person, provided we maintain it in deidentified form and do not attempt to reidentify it except to test our deidentification process as permitted by law.
9. Security
Outpost uses administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, destruction, loss, alteration, or disclosure. These include tenant and role-based controls, database row-level security, server-controlled financial and integration actions, HTTPS and browser security headers, provider-managed encryption at rest, restricted credential access, selected endpoint-specific throttles, audit and security events, protected backups, restoration exercises, and privacy-filtered monitoring when enabled. Some safeguards depend on provider configuration and Customer's selected features. Outpost maintains an internal evidence register so customer-facing statements can be limited to controls supported by current evidence.
No system is completely secure. Customers are responsible for choosing authorized users carefully, protecting account credentials and connected systems, configuring roles and integrations, using supported devices and browsers, promptly revoking access that is no longer needed, and notifying us of suspected compromise. Security questions or reports should be sent to benn@boxfortcommerce.com. Do not send passwords, payment credentials, or integration secrets by ordinary email.
10. Privacy choices and rights
Depending on residence and applicable United States law, a person may have rights to request access to or confirmation of personal information, correction, deletion, or portability, or to appeal a denied request. Some laws also provide rights to opt out of sale, sharing, targeted advertising, or certain profiling, or to limit certain uses of sensitive personal information. These rights are subject to scope, identity verification, exceptions, and limitations under applicable law.
To make a request about information for which Outpost is the controller or business, email benn@boxfortcommerce.com. State the nature of the request and the account or business relationship involved. We will use information reasonably necessary to verify identity and authority. An authorized agent may submit a request where permitted, but we may require proof of authorization and direct verification from the person. We will not discriminate against a person for exercising applicable privacy rights.
If the request concerns Customer Data in an Outpost workspace, contact the relevant retailer, brand, warehouse, or logistics provider first. If a request is sent directly to us, we may identify the relevant customer, refer the request to that customer, and assist the customer as required by law and contract.
A person may opt out of non-transactional marketing from Outpost by using the unsubscribe method in the message. Operational, security, account, billing, and legal messages may still be sent when necessary.
11. California disclosures
This section applies only to the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to Outpost's processing as a business. The categories of personal information described below use the CCPA's statutory labels and reflect information collected during the preceding 12 months.
- Identifiers, such as names, business contact details, IP addresses, account identifiers, customer email addresses in return records, order numbers, tracking numbers, and similar identifiers.
- California customer records information, such as names, contact information, and limited financial or payment-related records.
- Commercial information, such as subscriptions, invoices, purchases, return transactions, service usage, and related records.
- Internet or other electronic network activity, such as device, session, access, navigation, error, and interaction data.
- Geolocation data, limited to approximate location inferred from IP address and customer-provided facility addresses; Outpost does not intend to collect precise mobile-device location through the current Services.
- Professional or employment-related information, such as company, role, facility assignment, and business relationship.
- Audio, electronic, visual, or similar information, such as item and package photographs and support communications. Outpost does not record calls unless separate notice is provided.
- Inferences, such as account health, product classifications, issue summaries, operational measures, and security risk signals.
- Sensitive personal information, potentially including account credentials, integration credentials, and financial-account information handled by Stripe. Outpost does not use sensitive personal information to infer characteristics about a consumer and does not use or disclose it for purposes that require a right to limit under current practices.
We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them to the categories of recipients in Section 5. Outpost has not sold or shared these categories for cross-context behavioral advertising during the preceding 12 months under current practices. We have not offered a financial incentive in exchange for personal information.
California residents may have the rights to know/access, correct, delete, and obtain information about collection and disclosure; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and to receive equal service and pricing. Because current practices do not involve sale, sharing, or restricted uses of sensitive personal information, those particular opt-out links are not presently offered. Other rights may be exercised as described in Section 10.
California's "Shine the Light" law may permit residents with an established business relationship to request information about certain disclosures for third parties' direct marketing. Outpost does not disclose personal information to third parties for their own direct marketing under current practices.
12. United States service scope and processing locations
Outpost is established in California and currently offers the Services only to United States-based businesses for operations in the United States. Outpost and its service providers primarily process information for that U.S. service and may process support, diagnostic, or provider data in other locations described in their applicable terms. Outpost does not currently offer a contractual data-residency commitment or represent that the Services are configured for the EU GDPR, UK GDPR, or Swiss data-protection law. A customer must contact Outpost and enter appropriate written terms before using the Services for an operation subject to non-U.S. data-protection law.
13. Children
The Services are business tools and are not directed to children. Users must be at least 18 years old and authorized to act for a business customer. Outpost does not knowingly collect personal information directly from children under 13 through account registration. If you believe a child has provided personal information directly to Outpost contrary to this section, contact benn@boxfortcommerce.com. Customer return records may relate to purchases involving a child, but customers should not provide a child's information unless it is lawful and necessary for the return operation.
14. Changes to this Policy
We may update this Policy to reflect changes in law, technology, vendors, or the Services. We will post the updated version at https://app.outpostreturns.com/privacy and change the "Last updated" date. If a change materially reduces privacy protections or materially changes how we use personal information, we will provide additional notice or obtain consent where required. Prior versions will be retained internally and made available on request at benn@boxfortcommerce.com.
15. Contact us
Privacy questions and requests may be directed to:
Privacy requests, security reports, and billing or refund questions may be sent to benn@boxfortcommerce.com. Do not include passwords, full payment credentials, or integration secrets.