Privacy policy
Last updated: May 29, 2026
This policy explains how Littles Fulfillment, LLC (“Littles,” “we,” “us”) collects, uses, shares, and protects information in connection with our website and our third-party logistics (3PL) services. We work with two kinds of people: the partner brands who hire us to fulfill their orders, and the end customers whose orders we pick, pack, and ship on a brand’s behalf.
1. Our two roles
For information about a partner brand and the people who run it (account, billing, and operational data), we act as a data controller. For the end-customer information a brand sends us to fulfill its orders, we act as a data processor — we only handle that information on the brand’s instructions, governed by our Data Processing Agreement.
2. Information we collect
From partner brands: business name, contact name and email, the Shopify store domain, billing and remittance details needed for ACH or wire payment, and the operational data required to run fulfillment (orders, SKUs, inventory levels, inbound shipments). When a brand connects its store, we receive a Shopify access token via OAuth — we never see or store a brand’s Shopify password.
From end customers (on behalf of the brand): name, shipping address, order line items, and an email address or phone number only where a carrier requires it for delivery. We do not collect or store payment-card numbers — checkout and payment happen entirely on the brand’s store. We do not collect government identifiers, Social Security numbers, or special-category data.
From website visitors: the limited information you submit through our contact or newsletter forms, plus standard server logs. Any analytics we use are described in §7.
3. How we use information
We use partner data to provide and bill for the services we’ve agreed to, to communicate operational notices (such as inbound receipts, low-stock alerts, and invoices), and to support and improve our service. We use end-customer data only to fulfill and deliver the order, process returns, and resolve delivery issues. We never use end-customer information for our own marketing, and we never sell it.
4. How we share information
We share the minimum information necessary with the service providers who help us operate, including our cloud host (Google Cloud Platform), our warehouse management system (SKUSavvy), our transactional-email provider, and the shipping carriers a brand authorizes (such as USPS and FedEx). A current list lives at /legal/sub-processors. By default, the partner brand’s name does not appear on the outside of the shipping label or package. We may also disclose information where required by law or to protect our rights, and in connection with a merger or acquisition (subject to this policy).
5. Discreet shipping
Discretion is core to what we do. Packages ship in unbranded outer packaging by default, and we limit the information printed on labels and shared with carriers to what delivery actually requires. See our note on what discreet shipping means in practice.
6. Retention
End-customer addresses are kept only as long as needed for delivery and the return window agreed with the partner brand (typically 30–90 days, configurable per brand), after which they are deleted or de-identified. Aggregated, de-identified order data may be retained for analytics and reporting. Partner business records are retained for the life of the contract plus the period required for tax and audit purposes.
7. Analytics and cookies
We keep website tracking to a minimum. We use only the cookies required for the partner portal to function (such as your login session). If and when we enable website analytics, we will use a privacy-respecting provider and update this section to name it and describe your choices.
8. Security
We encrypt data in transit (TLS 1.2+) and at rest (AES-256), enforce role-based access controls, and log access to production systems. See our security overview for current practices. No system is perfectly secure, but we work hard to protect the information entrusted to us.
9. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to certain processing. End customers: please direct requests to the brand you ordered from; when a brand passes a request to us, we honor it — including Shopify’s data-request and redaction flows — promptly, and within 30 days. Partner brands: you can export or delete your data through the portal or by contacting us. We do not sell personal information or use it for cross-context behavioral advertising.
10. International data
Our systems are hosted in the United States. Where we handle personal information originating in other regions, we rely on appropriate safeguards (such as Standard Contractual Clauses) as described in our DPA.
11. Children
Our services are for businesses and are not directed to children. We do not knowingly collect personal information from children.
12. Changes
We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to partner brands directly.
13. Contact
Questions about this policy or your data: privacy@littlesfulfillment.com.