AFTERSHIP ADS TERMS
Last Updated: 11 August 2026
These AfterShip Ads Terms (the “Ads Terms”) form part of the AfterShip Terms of Service (the “Terms”). Capitalized terms used but not defined in these Ads Terms have the meaning given to them in the Terms or under applicable US Data Protection Laws. For more information on AfterShip Ads, please refer to the Site and the Documentation.
These Ads Terms apply solely to the Ads Service and constitute an express amendment to the DPA and the Terms, and except as supplemented or amended by these Ad Terms, the unmodified portions of the Terms and DPA remain in full force and effect and apply to Your use of the Ads Service. In respect of the Ads Service, these Ads Terms prevail over any conflicting provision of the Terms and/or DPA.
In addition to the Terms, the following Ads Terms apply to Your access and use of AfterShip Ads.
1. DEFINITIONS
When used in these Ads Terms with the initial letters capitalized, in addition to terms defined elsewhere in the Terms, the following terms shall have the following meanings:
Ads Service means the AfterShip advertising service under which Personal Data relating to End-Users is transmitted to one or more Advertising Partners for the purpose of serving advertising.
Advertising Partner means each third-party post-purchase commerce monetization platform designated by Data Controller to which Personal Data is transmitted through the Ads Service, as identified by Data Controller on the Site.
Authorized Data Points means the data elements set out in Schedule 1 that Data Controller has authorized for transmission through the Ads Service, subject to the “Restrictions” set out in Schedule 1.
Collection Month means the month during which AfterShip collects advertising revenue from an Advertising Partner in respect of the Ads Service delivered on User's surfaces.
Net Advertising Revenue means gross advertising revenue actually collected by an Advertising Partner(s) in respect of the Ads Service delivered on User's surfaces, less: (a) any refunds, credits, chargebacks, or adjustments made to or by the Advertising Partner; (b) any customary technology and operational costs incurred by the Advertising Partner to deliver the Services (including without limitation ad serving, exchange, measurement, and fraud and brand-safety fees); and (c) any applicable Taxes.
Prohibited Product Categories means the categories set out in Schedule 2.
2. ADVERTISING SERVICES
User instructs AfterShip to enable the display of targeted offers, advertisements, and promotional content (the “Ads Service”) to End-Users on User's branded tracking page and related post-transaction customer touchpoints made available through the Services. AfterShip delivers the Ads Service in partnership with third-party Advertising Partner(s). These Ads Terms relate solely to the Ads Service and do not apply nor modify the terms for other Features under the Terms.
3. REVENUE SHARE OF AFTERSHIP ADS
- 3.1 Rate. User shall be entitled to the respective percentage of the Net Advertising Revenue described on the Site when enabling the Ads Service, collected by AfterShip from the Advertising Partner(s) in respect of the Ads Service delivered on User's tracking page and related post-transaction customer touchpoints (the “User Revenue Share”).
- 3.2 Collection-Based Calculation. For the avoidance of doubt, AfterShip shall calculate User Revenue Share based on amounts actually collected by Advertising Partner(s) and paid to AfterShip, and not on amounts billed, booked, estimated, or accrued. No amount of User Revenue Share shall be payable, if AfterShip does not receive amounts owed by an Advertising Partner.
- 4.1 Monthly Statement. Within ten (10) days after the end of a Collection Month, AfterShip shall provide User with a written statement setting out: (a) the total Net Advertising Revenue collected in the Collection Month; (b) the calculation of the User Revenue Share; and (c) any deductions taken pursuant to Section 3.2 (each a “Revenue Statement”).
- 4.2 Invoicing and Payment. Within fifteen (15) days of AfterShip issuing the Revenue Statement, User shall review and, if accepted, issue an invoice to AfterShip for the User Revenue Share for the relevant Collection Month (the “Review Period”). After the Review Period, the Revenue Statement shall be deemed accepted. AfterShip shall pay User the undisputed invoice amount within thirty (30) days of receipt by bank transfer to User's nominated account.
- 4.3 Disputes. User shall notify AfterShip in writing during the Review Period for any bona fide dispute with respect to a Revenue Statement by identifying the disputed amount and the basis for the dispute. Any undisputed portion shall be invoiced and paid in accordance with the foregoing section, and the Parties shall work in good faith to resolve the disputed amount within thirty (30) days.
- 4.4 Taxes and Withholding. The User Revenue Share excludes applicable indirect taxes properly stated on a valid tax invoice. User is responsible for taxes imposed on it. AfterShip may deduct and remit any withholding required by law, without gross-up; amounts so deducted are deemed paid.
- 4.5 No Interest. No interest or late-payment charges accrue on the User Revenue Share, except as required by law.
- 4.6 Set-Off. AfterShip may deduct or set off against the User Revenue Share any adjustment under Section 3.2 not previously reflected, any overpayment, or any undisputed amount due and payable by User under the Terms or a Work Order.
- 4.7 Priority. The User Revenue Share is separate from Fees. This Section 4 prevails over conflicting provisions of the Terms governing amounts payable by User to AfterShip.
As long as the Ads Service is enabled, User shall not engage any third-party post-purchase commerce monetization platform, advertising network, or similar service provider to display targeted offers, advertisements, or promotional content to End-Users on User's branded tracking page or related post-transaction customer touchpoints, other than through the Ads Service.
6. PERSONAL DATA
- 6.1 Amendment to the DPA. For purposes hereof, AfterShip acts as Data Processor on Data Controller's documented instructions, in accordance with the DPA as amended by these Ads Terms.
- 6.2 Recitals. The following Recital will be added to the DPA: “Data Controller wishes to enable the AfterShip advertising service described in these Ads Terms, under which Personal Data relating to End-Users is transmitted to one or more advertising partners designated by Data Controller for the purpose of serving advertising, including on tracking, post-purchase, and related pages.”
- 6.3 US Consumers
- 6.3.1 Section 5.1.2 of the DPA (under which Data Processor shall not Sell or Share Personal Data) is amended by adding at the end, before the semicolon: “, except as expressly permitted under, and strictly in accordance with, these Ads Terms, pursuant to which Data Controller (and not Data Processor) Sells and/or Shares Personal Data, and Data Processor transmits Personal Data to the Advertising Partners solely on Data Controller’s documented instructions and on its behalf.”.
- 6.3.2 Section 5.3 of the DPA is amended by adding the following sentence at the end: “The foregoing does not apply to the Ads Service, in respect of which the Parties acknowledge that, as between the Parties, Data Controller (as Business) Sells and/or Shares Personal Data to the Advertising Partners, and Data Processor acts solely as a Service Provider transmitting Personal Data on Data Controller’s documented instructions, as set out in these Ads Terms.”.
- 6.4 Scope and Territorial Restriction
- 6.4.1 User may only use the Ads Service with US Stores for End-Users who are US Consumers located in the United States. Data Controller shall not submit, instruct, or otherwise cause to be processed through the Ads Service any Personal Data relating to a Data Subject located outside the United States.
- 6.4.2 Data Controller is solely responsible for applying reliable geolocation or equivalent controls to comply with this Clause 6.4, and warrants that Personal Data submitted to Ads Service is limited to US Consumers. Where Data Processor detects or reasonably suspects that Personal Data relating to non-US Data Subjects is being processed through the Ads Service, Data Processor may suspend the Ads Service, in whole or in part, without liability.
- 6.5 Roles of the Parties. In respect of the Ads Service:
- 6.5.1 Data Controller is the Business and the controller that determines to Sell and/or Share Personal Data to the Advertising Partners, selects the Authorized Data Points, and receives the consideration arising from the Ads Service;
- 6.5.2 Data Processor acts solely as a Service Provider, transmitting Authorized Data Points to Advertising Partners designated by Data Controller, in accordance with these Ads Terms. Data Controller’s selection in Schedule 1 constitutes a valid documented instruction. Data Processor does not determine the purposes of the Sale or Share and does not Sell or Share Personal Data for its own account; and
- 6.5.3 Data Controller acknowledges that an Advertising Partner may act as a Business or third party in its own right in respect of certain Personal Data, including data derived from, or collected following, an End-User’s engagement with an offer. As between the Parties, Data Controller is solely responsible for the lawfulness of the Sale and/or Share of Personal Data through the Ads Service, including the lawfulness of each Authorized Data Point that it elects to transmit.
- 6.6 Data Controller Obligations. Data Controller represents, warrants, and covenants that, on an ongoing basis and at its sole cost, as the Business and controller it shall:
- provide all notices required under US Data Protection Laws at or before the point of collection, including notice that Personal Data is Sold and/or Shared and the categories of Personal Data Sold and/or Shared;
- maintain a privacy policy that discloses the Sale and Sharing of Personal Data and identifies the Advertising Partners (and AfterShip) in its privacy disclosures or a vendor or sub-processor list;
- provide End-Users with a clear method to contact Data Controller regarding privacy questions, requests, and complaints;
- post and maintain, in a clear and conspicuous manner on each applicable digital property, a functioning “Do Not Sell or Share My Personal Information” mechanism, and any other opt-out link or mechanism required under US Data Protection Laws;
- establish, operate, and honour a compliant opt-out process, and recognize and honour opt-out preference signals, including the Global Privacy Control (GPC), as valid requests to opt out of the Sale and Sharing of Personal Data;
- obtain and maintain records of any opt-in consent required under US Data Protection Laws and provide such records to Data Processor on request;
- ensure that any cookie banner or consent-management mechanism it operates appropriately covers the tracking technologies used by the Ads Service;
- conduct and document any data protection assessment or risk assessment required under US Data Protection Laws before instructing Data Processor to enable the Ads Service;
- not submit, instruct, or otherwise cause to be transmitted through the Ads Service any Personal Data relating to a consumer who has exercised, or who is the subject of, an opt-out (including a GPC signal), and communicate each such opt-out to Data Processor without undue delay so that transmission may be suppressed; and
- ensure that it holds all rights, authorizations, and lawful bases necessary to disclose each Authorized Data Point to the Advertising Partners for advertising purposes.
- 6.7 Prohibited Data and Product Categories
- 6.7.1 Data Controller shall not submit, select, instruct, or otherwise cause to be transmitted through the Ads Service any Sensitive Personal Information, sensitive data, or any Personal Data that reveals, or from which a recipient could reasonably infer, any sensitive characteristic.
- 6.7.2 Data Controller may transmit only the Authorized Data Points set out in Schedule 1, in accordance with the Restrictions stated in that Schedule. No data element outside Schedule 1 may be transmitted through the Ads Service.
- 6.7.3 Data Controller shall not authorize, and Data Processor shall not transmit, any product data falling within a Prohibited Product Category (Schedule 2). Schedule 2 applies to the contents of any order, cart, or product field — product name, SKU, category code, or tag alike; the field label is irrelevant. Where an item is ambiguous, the default is to suppress it.
- 6.7.4 Data Controller is solely responsible for screening and excluding prohibited data before transmission. Data Processor is under no obligation to monitor or inspect the content of Personal Data submitted by Data Controller, but may, without obligation, filter, suppress, or decline to transmit any data element it reasonably believes may breach this Clause 6, and may suspend the Ads Service where it reasonably believes a breach has occurred.
- 6.8 Authorized Data Points and Data Minimization
- 6.8.1 Data Controller shall comply with the Restrictions set out in Schedule 1, which are binding obligations under these Ads Terms, including the requirements to transmit email addresses and mobile telephone numbers only as hashed match keys, to transmit age only as an age band and to exclude any consumer under 18 years of age, and to transmit ZIP codes as five-digit ZIP only.
- 6.9 State-Specific Obligations
- 6.9.1 California (CCPA). Data Controller acknowledges that the transmission of Personal Data to the Advertising Partners for Cross-Context Behavioral Advertising constitutes Sharing, and that any exchange of Personal Data for monetary or other valuable consideration constitutes a Sale, under the CCPA. Data Controller shall: (a) provide the “Do Not Sell or Share My Personal Information” link and mechanism; (b) honour the Global Privacy Control as a valid opt-out request; (c) not Sell or Share the Personal Data of a consumer who is less than 18 years of age; and (d) provide the notice at collection and privacy-policy disclosures required by the CCPA and other similar state laws. In respect of each US Consumer protected by a US Data Protection Law that provides a right to opt out of processing for Targeted Advertising or the sale of personal data, Data Controller shall: (a) provide and honour such opt-out; (b) recognize any universal opt-out mechanism required by the applicable law; and (c) conduct and document any data protection assessment required for processing for Targeted Advertising or for the sale of personal data.
- 6.9.2 Data Controller is solely responsible for monitoring the enactment, amendment, and entry into force of US and US States Data Protection Laws, and for adjusting its compliance accordingly.
- 6.10 Offers delivered within a tracking email or SMS. Where an offer or advertisement is delivered within a tracking email or SMS, Data Controller remains responsible for compliance with all applicable messaging laws, including the CAN-SPAM Act (including the primary-purpose test) and the Telephone Consumer Protection Act, and for obtaining and maintaining any required marketing consent and providing a functioning unsubscribe or opt-out mechanism.
- 6.11 Data Processor Obligations and Suppression
- 6.11.1 Data Processor shall, in accordance with the opt-out instructions and signals communicated to it by Data Controller, suppress the transmission of Personal Data relating to opted-out consumers through the Ads Service.
- 6.11.2 Data Processor shall not retain, use, or disclose Personal Data transmitted through the Ads Service for any purpose other than performing the Ads Service on Data Controller's documented instructions and as permitted under US Data Protection Laws.
- 6.11.3 Data Processor shall enter into a written agreement with each Advertising Partner that imposes the contractual terms required of recipients under US Data Protection Laws.
- 6.12 Representation, Warranties and Indemnity
- 6.12.1 Data Controller represents and warrants ongoing compliance with these Ads Terms.
- 6.12.2 Notwithstanding anything to the contrary in the Terms or the DPA, Data Controller shall fully indemnify, defend, and hold harmless Data Processor and its Affiliates from and against any and all actions, demands, liabilities, claims, damages, losses, penalties, fines, and expenses, including reasonable attorneys’ fees and court costs, arising out of, resulting from, or in connection with: (a) Data Controller’s breach of these Ads Terms; (b) Data Controller’s failure to provide any required notice or opt-out, or to obtain any required consent; (c) the transmission through the Ads Service of Sensitive Personal Information, product data falling within a Prohibited Product Category, or Personal Data relating to a consumer who has opted out; or (d) any claim that the Sale or Sharing of Personal Data through the Ads Service, as instructed by Data Controller, was unlawful. This Clause 6.12 is treated in the same manner as Section 1.4.5 of the DPA and is unaffected by Section 10 of the DPA.
- 6.13 Amendment to Schedule B of the DPA
- 6.13.1 With respect to the Ads Service, Schedules 1 and 2 of these Ads Terms shall be added as an addendum to Schedule B of the DPA and User expressly authorizes each Advertising Partner as an Authorized Subprocessor, in addition any other Authorized Subprocessor set forth in the DPA. For purposes hereof, the Advertising Partner(s) are:
- 6.13.2 Solely in respect of the Ads Service, Schedule B of the DPA is further supplemented as follows:
- relates to a business, activity, or category restricted under the AfterShip Acceptable Use Policy (available at https://www.aftership.com/legal/aftership-acceptable-use-policy), including by way of illustration:
alcohol;
tobacco, vaping, e-cigarettes, and nicotine products;
cannabis, CBD, THC, and hemp products;
firearms, ammunition, and weapons;
gambling and games-of-chance products and services; and
adult or pornographic content;
or
- reveals or permits the inference of any sensitive characteristic of an End-User, including by way of illustration products related to:
health, medical, or pharmacy use (including prescriptions, over-the-counter medications, medical devices, diagnostic and testing kits, diabetic and incontinence supplies, condition-specific supplements, and weight-loss or hair-loss treatments);
pregnancy, fertility, or reproductive health (including baby and infant products, maternity goods, contraceptives, and menstrual products);
mental-health, anxiety, therapy, or addiction-recovery use;
sexual wellness or sex life, or items revealing sexual orientation or gender identity (including LGBTQ+-specific and gender-affirming products);
religious or philosophical belief (including religious texts and faith-branded items);
race, ethnicity, or national origin;
political opinion or union membership;
the presence or age of a minor in the household; or
financial vulnerability (including debt-relief, payday-loan, pawn, or credit-repair products and services).
6.8.2 Data Processor shall transmit only Personal Data originating from Data Controller’s own End-Users and shall not combine Personal Data transmitted through the Ads Service by any other data controller.
| AfterShip Authorized Subprocessor(s) | |||||
|---|---|---|---|---|---|
| Name | Purpose | Data Shared with Subprocessor | Processing Location | International Transfer Mechanism | Additional Safeguards (links to subprocessor resources) |
| Disco Technology Inc. | Advertising Partner for AfterShip Ads | End User information. | United States | SCCs | https://www.disconetwork.com/ |
| Processing Details | AfterShip Ads |
|---|---|
| Description and Nature of Processing Activities and Services | The Ads Service, under which AfterShip transmits the Authorized Data Points selected by Data Controller to Advertising Partner(s) selected by Data Controller through the Site for the purpose of serving advertising. |
| Categories of Data Subjects | End-Users. |
| Categories of Personal Data | The Authorized Data Points selected by Data Controller under Schedule 1, subject to the Restrictions set out therein and these Ads Terms. |
| Frequency of Processing and Transfer | Continuous while the Ads Service is enabled. |
| Duration of Processing | For the period during which the Ads Service is enabled and any limited period thereafter required for reconciliation, suppression, consumer-rights requests, deletion, security, or compliance with applicable law. |
| Recipients | The Advertising Partners selected by Data Controller through the Site. |
The data elements set out below are the Authorized Data Points. Data Controller may instruct the transmission of these data elements only in accordance with the Restriction stated in the corresponding row, which is a binding obligation under these Ads Terms. A dash (—) means that no additional Restrictions apply beyond those set out in the body of these Ads Terms.
| Data Point | Restriction |
|---|---|
| Identifiers and Contact | |
| First name | — |
| Last name | — |
| Title / honorific | — |
| Email address | Transmitted only as a hashed match key. |
| Mobile / phone number | Transmitted only as a hashed match key. |
| Client customer ID / cart ID | — |
| Cookie ID / device ID / session ID | — |
| Age | Transmitted only as an age band. The data of any End-User under 18 years of age must not be transmitted. |
| Gender | Must not be used to target offers for housing, credit, employment, or any other purpose implicating anti-discrimination law. |
| Address and Location | |
| Billing / shipping city | — |
| Billing / shipping state | — |
| Billing / shipping ZIP code | Five-digit ZIP code only; ZIP+4 must not be transmitted. |
| Country | — |
| City / State / DMA (derived) | — |
| Order and Transaction | |
| Order ID / number | — |
| Order value / amount / subtotal | — |
| Total tax / total shipping | — |
| Currency / language | — |
| Order date / timestamp / order recency | — |
| Order status | — |
| Coupon / promo code; discount rate / amount | — |
| Historical promo-code usage rate | — |
| Cart and Item | |
| Item price / quantity / number of items | — |
| Product name / SKU | Transmitted only after screening against Schedule 2 (Prohibited Product Categories); the screen applies to product name, SKU, category, and tag alike. |
| Product category (major / minor / IDs) | Transmitted only after screening against Schedule 2; the screen applies to category fields as well as to product names. |
| Product tags (e.g., “is organic”, “is pet food”) | Any tag that maps to a category set out in Schedule 2 must be suppressed. |
| Customer Profile and Behaviour | |
| Customer type / has account / is returning / last visited | — |
| Is loyalty / loyalty tier | — |
| Purchase frequency / reorder rate / AOV | — |
| Lifetime value (LTV) | — |
| Web and Engagement | |
| Page views, impressions, clicks, conversions, time-on-page | — |
| Page type | — |
| Referrer / page URL; campaign identifiers | — |
| Website URL | — |
| Device and Technical | |
| Device type | — |
| Operating system / user-agent | — |
| OS version; browser type and version | — |
| Messaging and Subscription | |
| Email / SMS subscription status; send / open / click events | Where an offer is delivered within a tracking email or SMS, the obligations in Clause 6.10 apply. |
For the avoidance of doubt, and without limiting any other provision of these Ads Terms, the data points listed below are not Authorized Data Points and must not be transmitted through the Ads Service. The list is illustrative and not exhaustive: date of birth; full or street-level billing or shipping address; raw or full IP address; precise geolocation; margin; payment type; credit-card BIN or other payment-card data; inferred audience segments; and any product falling within a Prohibited Product Category.
This screen applies to the contents of any order, cart, or product field — product name, SKU, category code, or tag alike. The field label is irrelevant; if the item falls within any prohibited category below, it is suppressed before transmission. When an item is ambiguous, the default is to suppress. The lists below are illustrative and not exhaustive.
Data Controller shall not authorize, and Data Processor shall not transmit through the Ads Service, any product data that: