Legal

Privacy

What we collect, how we use it, and the choices you have. To opt out or make a request, use Your privacy choices.

Got a delivery from deliv?

You got a delivery through deliv. deliv, operated by PSMSM Logistics, Inc., arranges deliveries for the store you ordered from. The store shared your name, phone, email, and address with us so we, and the delivery company we assign, can deliver your order and send you updates. We keep a record of your delivery, including a photo at drop-off. We do not use your information to market deliv to you. If you opted in at the store’s checkout to see the store’s ads based on your address, we use your address for that store’s ads only; you can opt out at any time at deliv.us/privacy-choices. Reply STOP to any text to stop delivery texts. Full details: deliv.us/privacy.

Privacy Policy

Last updated: October 26, 2026

This Privacy Policy explains how PSMSM Logistics, Inc., a Georgia corporation doing business as “deliv” (“deliv,” “we,” “us,” “our”), collects, uses, discloses, and protects personal information. It applies to:

Businesses that use deliv (our “Merchants”) and their staff;
Recipients, meaning people who receive a delivery deliv arranges, view a tracking page, or get our delivery texts or emails;
Visitors to deliv.us and our other sites; and
people who see ads through AdReach, our advertising service.

Quick summary

We use delivery information to deliver orders, send updates, and run our business.
For Recipients, we act mostly on behalf of the Merchant you ordered from. That Merchant’s privacy policy also applies.
AdReach shows a Merchant’s ads to people who opted in at that Merchant’s checkout, and to devices seen at commercial locations a Merchant selects, using location data from consented sources. You can opt out at any time at deliv.us/privacy-choices.
We do not sell personal information for money. Some AdReach activity may be “targeted advertising,” “sharing,” or a “sale” under certain state laws; we explain this and give you a way to opt out in Section 7.
We honor Global Privacy Control signals on our websites and tracking pages.

1. Our role

For Merchants, Visitors, and our own marketing, deliv decides how and why personal information is used (we are a “controller” or “business”).

For Recipients, the Merchant you ordered from decides why your information is shared with us; we process it on the Merchant’s behalf to arrange and track your delivery (we are a “processor” or “service provider”). Questions about your order or how the Merchant uses your data should go to the Merchant. We will help Merchants respond to your requests, and you can also contact us directly (Sections 7 and 14).

For AdReach, we and our affiliate AdRadii run campaigns on the instructions of the Merchant. AdRadii and its advertising partners also process some data as independent businesses under their own privacy policies (Section 5).

2. Information we collect

2.1 From Merchants

Account and contact data: business name, address, staff names, emails, phone numbers, login credentials, and roles.
Billing data: billing contact, plan, invoices, and payment details. Card and bank details are collected and stored by our payment processor, Stripe, not by deliv; we receive limited details such as card type and last four digits.
Order data: pickup locations, order details, Shipment descriptions and values, and delivery instructions.
Brand assets for BrandTrack and creative for AdReach.
Communications with us, including support messages and emails.

2.2 About Recipients (provided by Merchants or generated by deliveries)

Contact and delivery data: name, phone number, email, delivery address, and delivery instructions.
Delivery records: status updates, timestamps, Carrier and driver assigned, and proof of delivery, which may include a photo of the delivered item at the door, a signature, or a recorded age-verification check.
Tracking page and messaging data: when you open a tracking link, your IP address, device and browser type, and the pages you view; your text replies, including STOP and HELP.
AdReach consent status: whether you opted in at the Merchant’s checkout to address-based ads, and any opt-out.

2.3 About drivers

Carriers share the assigned driver’s first name and vehicle details where available, and the driver’s location while the delivery is in progress so we can show it on the tracking page and monitor the delivery. We do not track drivers when they are not performing a deliv delivery.

2.4 From Visitors

Information you submit: name, business name, email, phone, ZIP code, delivery volume, and messages in our forms, and ZIP codes entered in our coverage checker.
Automatically collected data: IP address, device and browser data, referring page, pages viewed, and approximate location derived from IP, collected through cookies and similar technologies set by our website host, Wix.

2.5 For AdReach

Delivery addresses of opted-in Recipients, which we pass to AdRadii to build the Merchant’s audience.
Device and advertising data that AdRadii and its advertising partners collect or obtain from third parties: mobile advertising identifiers (such as IDFA or AAID), IP addresses, cookie IDs, the fact that a device was observed at or near a commercial location or household, and ad interactions (impressions, clicks, and later visits to the Merchant’s store).
This data can be precise geolocation, which many state laws treat as sensitive personal information. See Section 6.

3. How we use information

Provide the Services: quote, book, dispatch, route, track, and complete deliveries; select and switch Carriers; handle returns, claims, and cancellations.
Communicate: send delivery texts and emails on behalf of Merchants; send Merchants account, billing, and service messages; respond to inquiries.
BrandTrack: display tracking pages and notifications in the Merchant’s branding.
AdReach: build audiences and run, measure, and report on Merchant campaigns as described in Section 5.
Billing and accounts: process payments, prevent fraud, and collect amounts owed.
Safety, security, and legal: protect people, Shipments, and our systems; investigate misuse; enforce our terms; comply with law and legal process.
Improve the Services: analyze performance, Carrier reliability, and pricing, mostly using aggregated or de-identified data. We do not re-identify de-identified data.
Our own marketing (Merchants and Visitors only): send business marketing emails and, with consent, texts, about deliv. We do not market to Recipients on our own behalf.

4. How we disclose information

We disclose personal information to:

Merchants: Recipients’ delivery status, proof of delivery, and messages relating to their order. Merchants receive only aggregated AdReach reports, never device identifiers.
Carriers: the information needed to perform each delivery, such as Recipient name, phone number (which may be masked), address, and instructions. Carriers use it under their own terms and privacy policies.
Service providers that work for us under contract, such as cloud hosting, mapping and address validation, SMS and email delivery, customer support, analytics, and payment processing. A current list is at deliv.us/privacy#subprocessors.
AdRadii and its advertising partners for AdReach, as described in Section 5.
Connected platforms you or a Merchant link, such as an ecommerce or point-of-sale system.
Legal and safety: to comply with law, subpoenas, or court orders, to protect rights, property, or safety, or to enforce our terms.
Business transfers: to a buyer or successor in a merger, acquisition, financing, or sale of assets, subject to this Policy.
With consent or at your direction.

We do not sell mobile numbers or SMS opt-in data, and we do not share them with third parties for their own marketing.

5. AdReach

AdReach is an advertising service that Merchants on certain deliv plans can choose to use. It is operated with our affiliate AdRadii LLC, a separate company under common ownership with deliv, and with third-party advertising platforms.

Delivery Retargeting. If you opted in at a Merchant’s checkout to see that Merchant’s ads based on your delivery address, then about two to three weeks after your delivery we send your delivery address to AdRadii. AdRadii and its partners identify devices associated with that address and show that Merchant’s ads on those devices across websites and apps. If you did not opt in, your address is not used for AdReach. Your address is used only for the Merchant you ordered from, never for any other business.

Geo-Conquesting. A Merchant may select commercial retail locations, such as a competitor’s store. AdRadii’s partners identify devices that visited those locations and show the Merchant’s ads on them. We contractually require those partners to use only location data obtained with device users’ opt-in consent, and not real-time bidding data. We do not knowingly geofence health care facilities (or any location within 2,000 feet of one), pharmacies, places of worship, schools, shelters, government or military sites, or other sensitive locations, and do not use AdReach for sensitive product categories.

What Merchants see. Merchants get only aggregate reports (impressions, clicks, attributed store visits). They do not receive device identifiers, locations, or the identity of people who saw their ads.

Retention. Delivery addresses sent to AdRadii are deleted within 30 days after the audience is built. Device identifiers matched for a campaign are deleted or de-identified within 90 days after the campaign ends.

Opt out of AdReach at any time:

Use deliv.us/privacy-choices to opt out by address, email, phone number, or mobile advertising ID. We add opted-out addresses and identifiers to a suppression list so they are not matched again.
Turn on Global Privacy Control in your browser when you visit our sites or the Merchant’s checkout.
Reset or limit your mobile advertising ID: on iOS, turn off “Allow Apps to Request to Track” and location access for apps; on Android, delete your advertising ID in Settings > Privacy > Ads.
Use industry opt-out tools, which apply to participating companies: optout.aboutads.info, youradchoices.com/appchoices, and optout.networkadvertising.org.
Contact the Merchant, or email support@deliv.us with “Privacy request” in the subject line.

Opting out stops new AdReach targeting based on your address or device. You may still see ads that are not targeted using your data.

6. Sensitive personal information

The only sensitive personal information we process is: (a) precise geolocation used in AdReach, as described above, and processed only with consent where state law requires it; (b) the driver’s location during a delivery; and (c) account login credentials. We do not use sensitive personal information to infer characteristics about you. We do not knowingly process data of children, and we do not use AdReach to target anyone we know is under 18. California residents: we use sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), except AdReach geolocation, which you may limit through deliv.us/privacy-choices (“Limit the Use of My Sensitive Personal Information”).

7. Your privacy rights

Depending on where you live, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with similar laws, you may have the right to:

Know and access the personal information we have about you, including categories, sources, purposes, and recipients;
Correct inaccurate information;
Delete your information;
Portability: get a copy in a usable format;
Opt out of targeted advertising, “sales,” “sharing” for cross-context behavioral advertising, and profiling for significant decisions (we do not do such profiling);
Limit or withdraw consent for sensitive personal information;
Not be discriminated against for exercising your rights; and
Appeal our decision on your request.

We extend these rights to all U.S. residents, not only those in states that require it.

How to make a request. Use deliv.us/privacy-choices, email support@deliv.us with “Privacy request” in the subject line, or call +1-844-335-4824. We will verify your identity by matching information we hold, such as your phone number or delivery address. You may use an authorized agent, who must provide proof of authorization. We confirm receipt within 10 business days and respond within 45 days, which we may extend once by 45 days where the law allows. If we deny your request, you may appeal by replying to our decision or emailing support@deliv.us with “Privacy appeal” in the subject line; we respond to appeals within 45 days (60 in Colorado). If your appeal is denied, you may contact your state attorney general.

If you are a Recipient, we may forward your request to the Merchant you ordered from, since it controls your order data, and help it respond.

Opt-out preference signals. On our websites and tracking pages, we treat Global Privacy Control as a valid request to opt out of sale, sharing, and targeted advertising for that browser and, if known, for you.

Categories under California law (last 12 months).

Category	Examples	Disclosed for business purposes to	“Sold” or “shared”
Identifiers	name, email, phone, address, IP, advertising ID	Carriers, service providers, Merchants	Advertising IDs and addresses for AdReach, only for opted-in Recipients and Geo-Conquesting audiences: AdRadii and ad partners
Customer records	billing contact, order data	service providers, payment processor	No
Commercial information	orders, plans, delivery history	service providers, Merchants	No
Internet activity	site and tracking page usage, ad interactions	service providers, ad partners	Ad interactions for AdReach only
Geolocation	delivery address, driver location, device location for AdReach	Carriers, service providers, AdRadii and ad partners	Device location for AdReach (sensitive)
Audio/visual	proof-of-delivery photos	Merchants, service providers	No
Professional	Merchant staff role and business	service providers	No
Sensitive	precise geolocation (AdReach), account credentials	AdRadii and ad partners (geolocation only)	Geolocation for AdReach
Inferences	none	n/a	No

Nevada: we do not sell covered information as defined in Nevada law. Washington, Nevada, and Connecticut consumer health data: we do not intentionally collect consumer health data. Shipment descriptions for health products are used only to perform the delivery. We do not knowingly geofence within 2,000 feet of health care facilities.

8. Cookies and similar technologies

Our website is hosted by Wix, which uses cookies and similar tools to run the site, keep it secure, remember settings, and measure traffic. You can control cookies through your browser settings. Our sites do not respond to “Do Not Track” signals, but they do honor Global Privacy Control as described above. Tracking pages and the deliv account app use only what is needed to show the page, keep it secure, and count usage in deliv’s own systems; they do not use outside analytics or advertising cookies.

9. Retention

We keep personal information only as long as needed for the purposes in this Policy, including legal, tax, and accounting requirements and resolving disputes. Typical periods:

Data	Retention
Recipient order and delivery records	3 years after delivery, then deleted or de-identified
Proof-of-delivery photos	13 months, or until any open claim or dispute is resolved
Driver location during deliveries	90 days at full precision, then aggregated
Delivery text message logs and opt-out records	2 years for logs; opt-outs kept as long as needed to honor them
AdReach delivery addresses	30 days after the audience is built
AdReach matched device identifiers	90 days after the campaign ends
Merchant account and billing records	life of the account plus 7 years
Website form submissions	3 years after last contact

10. Security

We use administrative, technical, and physical safeguards appropriate to the information, including encryption in transit, access controls, and vendor security reviews. No system is perfectly secure. If a breach affects your information, we, or the Merchant for Recipient data, will notify you and authorities as the law requires.

11. Children

The Services are for businesses and adults. We do not knowingly collect personal information from children under 13, and we do not knowingly sell, share, or use for targeted advertising the information of anyone under 18. If you believe a child provided us information, contact us and we will delete it.

12. Location

deliv operates in the United States, and we and our service providers store and process information primarily in the United States.

13. Changes

We may update this Policy. We will post the new version with a new “Last updated” date and, for material changes, notify Merchants by email and give notice on our site before the change applies. We will ask for consent where the law requires it.

14. Contact

PSMSM Logistics, Inc. d/b/a deliv Attn: Privacy Atlanta, Georgia support@deliv.us (subject: “Privacy request”) · +1-844-335-4824 Privacy choices: deliv.us/privacy-choices

Data Processing Addendum

Last updated: October 26, 2026

This Data Processing Addendum (“DPA”) is part of the Terms and Conditions (the “Terms”) between PSMSM Logistics, Inc. d/b/a deliv (“deliv”) and the Merchant. It applies automatically when the Merchant accepts the Terms. Capitalized terms not defined here have the meanings in the Terms.

1. Definitions

“Data Protection Laws” means all U.S. federal and state laws on privacy and personal information that apply to the processing of Merchant Personal Data, including the California Consumer Privacy Act as amended (“CCPA”) and the comprehensive consumer privacy laws of other states.
“Merchant Personal Data” means personal information in Merchant Data, including Recipient Data, that deliv processes on the Merchant’s behalf.
“Controller,” “Processor,” “Business,” “Service Provider,” “Consumer,” “Sale,” “Share,” “Targeted Advertising,” “Sensitive Data,” and “Deidentified Data” have the meanings in the applicable Data Protection Laws.
“Subprocessor” means a third party deliv engages to process Merchant Personal Data on deliv’s behalf.
“Security Incident” means a breach of security leading to unauthorized access to, or acquisition, disclosure, alteration, or loss of, Merchant Personal Data.

2. Roles and scope

2.1 The Merchant is the Controller (Business) and deliv is the Processor (Service Provider) of Merchant Personal Data.

2.2 Carriers are not Subprocessors. The Merchant instructs deliv to disclose Recipient Data to the Carrier deliv selects for each delivery. Carriers receive it to perform deliveries and process it under their own terms and privacy policies as independent parties. The Merchant is responsible for disclosing that sharing to its customers, as required by Section 7.2 of the Terms.

2.3 deliv processes Merchant Data about Merchant’s own staff, billing, and account administration as an independent Controller under deliv’s Privacy Policy, not under this DPA.

2.4 Annex 1 describes the processing.

2.5 AdReach. For AdReach Delivery Retargeting, deliv and AdRadii act as third parties, not as Service Providers or Processors, because that processing is cross-context behavioral advertising. Annex 2 is the contract required by Cal. Civ. Code § 1798.100(d) for that processing, and Sections 4.2 and 5 do not apply to it.

3. Merchant obligations

The Merchant: (a) is responsible for the lawfulness of its instructions and of the collection and provision of Merchant Personal Data to deliv; (b) has provided all notices and obtained all consents required by Data Protection Laws for deliv’s processing under the Terms, including, for AdReach, the opt-in consent described in Exhibit B of the Terms; (c) will not instruct deliv to process Sensitive Data except AdReach processing as described in Annex 2; and (d) will promptly notify deliv of Consumer opt-outs, consent withdrawals, and other requests that affect deliv’s processing.

4. deliv obligations

deliv will:

4.1 Instructions. Process Merchant Personal Data only to provide the Services, on the Merchant’s documented instructions (the Terms, this DPA, and the Merchant’s use and configuration of the Services are its complete instructions), or as required by law, in which case deliv will inform the Merchant first unless the law prohibits it. deliv will notify the Merchant if it believes an instruction violates Data Protection Laws.

4.2 CCPA service provider commitments. Except for AdReach processing under Section 2.5 and Annex 2, not: (a) Sell or Share Merchant Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes in Annex 1, including any commercial purpose other than providing the Services; (c) retain, use, or disclose it outside the direct business relationship between deliv and the Merchant; or (d) combine it with personal information deliv receives from or on behalf of others or collects from its own interactions with Consumers, except as permitted for service providers under the CCPA regulations. deliv will comply with the CCPA and provide the same level of privacy protection it requires, will notify the Merchant if it can no longer meet its obligations, and grants the Merchant the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use. deliv certifies it understands and will comply with these restrictions.

4.3 Confidentiality. Ensure each person who processes Merchant Personal Data is subject to a duty of confidentiality.

4.4 Security. Implement and maintain reasonable administrative, technical, and physical security measures appropriate to the nature of the data, including those in Annex 3.

4.5 Assistance. Taking into account the nature of the processing, provide reasonable assistance to the Merchant in: (a) responding to Consumer requests to exercise rights under Data Protection Laws, including by forwarding requests deliv receives directly that identify the Merchant, and by deleting, correcting, or exporting data on the Merchant’s instruction; (b) meeting security and breach-notification obligations; and (c) conducting data protection assessments, by providing information reasonably available to deliv.

4.6 De-identified data. Where deliv de-identifies Merchant Personal Data, take reasonable measures to ensure it cannot be associated with an individual, publicly commit not to re-identify it, and contractually require any recipients to do the same.

5. Subprocessors

5.1 The Merchant gives general authorization for deliv to engage Subprocessors. AdRadii is a third-party recipient for AdReach under Section 2.5, not a Subprocessor. deliv’s current list is at deliv.us/privacy#subprocessors (see Annex 4).

5.2 deliv will give at least 15 days’ notice of a new Subprocessor by updating the list and notifying Merchants who subscribe to updates, or by email. The Merchant may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Merchant may terminate the affected Service and receive a refund of prepaid fees for the unused period, as its sole remedy.

5.3 deliv will engage each Subprocessor under a written contract imposing data-protection obligations no less protective than this DPA, and remains responsible for its Subprocessors’ performance.

6. Security Incidents

deliv will notify the Merchant without undue delay, and in any case within 72 hours, after confirming a Security Incident, and will provide information reasonably available about its nature, the data and Consumers affected, likely consequences, and measures taken. deliv will take reasonable steps to contain and remediate it. Unless the law requires otherwise, the Merchant, as Controller, is responsible for notifying affected Consumers and regulators, and deliv will not do so on the Merchant’s behalf without the Merchant’s approval, except where deliv is independently required by law. Notification is not an admission of fault.

7. Audits

On written request no more than once per year, deliv will respond to a reasonable written security and privacy questionnaire and make available information necessary to demonstrate compliance with this DPA. If a regulator requires it, or after a Security Incident, the Merchant may, at its expense and on 30 days’ notice, have an independent auditor under confidentiality obligations assess deliv’s compliance, during business hours and without unreasonable disruption. deliv may satisfy audit requests with a third-party report where available.

8. Return and deletion

Within 30 days after termination of the Services, the Merchant may request an export of Merchant Personal Data. After that period, deliv will delete or de-identify Merchant Personal Data, except where retention is required by law or for accounting, tax, claims, or dispute purposes, or in backups that are deleted on their normal cycle. Retained data stays subject to this DPA.

9. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on the processing of Merchant Personal Data, this DPA controls.

Annex 1: Description of processing

Item	Description
Business purposes	Arranging, dispatching, tracking, and completing deliveries; Carrier selection and switching; BrandTrack tracking pages and notifications; delivery texts and emails; claims, returns, and support; fraud prevention and security; billing; AdReach (only if ordered, see Annex 2)
Categories of Consumers	Recipients of deliveries; the Merchant’s customers who use tracking pages
Categories of data	Name, phone, email, delivery address, delivery instructions, order details, proof-of-delivery photos and signatures, age-verification result, tracking page usage data, SMS replies and opt-outs, AdReach consent flag
Sensitive Data	None, except AdReach processing in Annex 2
Duration	Term of the Terms plus the return and deletion period in Section 8. During the term: delivery records 3 years after delivery; proof-of-delivery photos 13 months or until any open claim is resolved; SMS logs 2 years; AdReach addresses 30 days after the audience is built; matched device IDs 90 days after the campaign ends
Nature of processing	Collection, storage, transmission, display, analysis, and deletion

Annex 2: AdReach processing instructions

When the Merchant orders AdReach, the Merchant instructs deliv to:

Disclose to AdRadii the delivery addresses of Eligible Recipients only (as defined in Exhibit B of the Terms: affirmative, separate opt-in consent recorded and passed by the Merchant; no opt-out; not in a disabled jurisdiction), no sooner than 14 days after delivery.
Permit AdRadii and its Ad Partners to match those addresses to devices and serve the Merchant’s ads to those devices, solely for the Merchant’s campaigns.
Exclude sensitive locations, sensitive categories, and minors as set out in Exhibit B.
Honor Consumer opt-outs received by the Merchant, deliv, or AdRadii, and Global Privacy Control signals the Merchant passes to deliv, within 15 days, and maintain a suppression list.
Delete addresses within 30 days after the audience is built, and delete or de-identify matched device identifiers within 90 days after the campaign ends.
Provide the Merchant only aggregated reporting.

The parties acknowledge that, under some Data Protection Laws, AdReach Delivery Retargeting may constitute Targeted Advertising, Sharing, or a Sale by the Merchant, and that the Merchant is responsible for the related notices, consent, and opt-out mechanisms. deliv will make deliv.us/privacy-choices available as an additional opt-out channel. AdRadii’s processing of location data it obtains from its own sources for Geo-Conquesting is performed by AdRadii as an independent business under its own privacy policy and the Exhibit B rules.

Annex 3: Security measures

Encryption of Merchant Personal Data in transit (TLS) and at rest, through deliv’s hosting and database providers.
Role-based access for deliv staff and Merchant users, with two-step sign-in required for deliv staff.
A change history of staff actions on accounts and orders.
Error monitoring of deliv’s applications.
Automated backups through deliv’s database provider.
Payment card data handled only by Stripe; deliv does not store full card numbers.
Text-message opt-outs recorded and enforced across all messages sent from deliv’s number.

Annex 4: Subprocessors (as of October 26, 2026)

AdRadii LLC, deliv’s affiliate, receives AdReach data as a third-party recipient under Section 2.5 and Annex 2, not as a Subprocessor.

Subprocessor	Purpose
Supabase	Database, sign-in, and file storage
Vercel	Hosting of the deliv account app, admin tools, and tracking pages
Burq	Delivery dispatch connection to Carriers, and delivery texts until deliv’s own texting is switched on
Twilio	Text messages
Mailgun	Email
Google Maps Platform	Address lookup, maps, and distances
Stripe	Payments (Merchant billing only)
Sentry	Error monitoring
Wix	Website hosting and website forms

Text messages

We send delivery texts on behalf of the stores that use deliv, and account texts to businesses that use deliv. We do not sell or share mobile numbers or text-message opt-in data with third parties for their own marketing. Opt-in data is shared only with the service providers that send our messages and with the store on whose behalf a message was sent. Reply STOP to any text to stop, or HELP for help.

Message types, frequency, and how to opt out are in our SMS Terms.