Privacy Policy

Effective date: July 17, 2026 Last updated: July 17, 2026

1. Who we are

Airship is a courier management platform operated by Rocket Labs Consulting Inc., a corporation organized under the laws of the Republic of the Philippines, with its principal office at 226 Ortigas Avenue, San Juan City, Metro Manila, Philippines.

In this policy, “Rocket Labs,” “we,” “us,” and “our” refer to Rocket Labs Consulting Inc. “Airship” refers to the platform and the products described below.

This policy explains how we handle personal information across all four Airship products:

Section 4 sets out exactly what each product collects. Where this policy refers to “the Services,” it means all four products together.

2. Our role: controller and processor

This distinction determines who you should contact about your data, so please read it.

Where we act as a data processor. Airship is software that couriers license to run their own businesses. When a courier uses Airship, that courier is the personal information controller for the data in their account — package records, sender details, recipient details, rider assignments, cash records, and delivery history. Rocket Labs processes that data on the courier’s instructions, under contract, and does not use it for our own purposes.

If you are a sender, a package recipient, or a rider, the courier you are dealing with is your first point of contact for questions about your data. We will assist them, and we will respond to you directly where the law requires us to, but we generally cannot delete or alter records inside a courier’s account without that courier’s instruction.

Where we act as a data controller. We are the controller for account credentials we issue, our own service logs and crash diagnostics, billing and subscription records for our courier clients, and any correspondence you send us directly.

Recipient data. Senders using the Booking Site or Booking App may upload personal information about package recipients — names, delivery addresses, and contact numbers — including in bulk. Those recipients are not our users and have not agreed to this policy. We process that information solely to enable delivery, on behalf of the courier, and we do not use it for marketing or any unrelated purpose. Recipients who wish to exercise their rights over this data should contact the courier handling their package; if they contact us instead, we will route the request to the correct courier and tell the recipient we have done so.

3. Legal basis for processing

We process personal information under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, on the following bases:

• Contract — processing necessary to deliver the Services to our courier clients and their users.
• Legitimate interests — security monitoring, fraud prevention, service diagnostics, and product improvement, balanced against your rights and freedoms.
• Consent — for location collection on the Rider’s App, and for any optional feature we identify as consent-based at the point of collection. Consent may be withdrawn at any time; see Section 10.
• Legal obligation — retention of financial and transaction records where Philippine law requires it.

4. What each product collects

4.1 Airship Rider’s App

This product collects the most sensitive data in the platform. Read this section carefully if you are a rider.

Precise location, including in the background. The Rider’s App collects your precise device location while you are on an active shift or have accepted a delivery assignment, including when the app is closed or not in use. This is necessary so that dispatchers can see rider positions on a live map, assign nearby packages efficiently, and provide senders and recipients with real-time delivery updates.

• Background location collection begins only after you accept an assignment or start a shift, and stops when your shift ends or your last assignment is completed. It does not run when you are off shift.
• The app displays a persistent notification while background location is active.
• You will be asked for background location permission separately from foreground permission, and the app will explain the purpose before the system prompt appears. You may decline; if you do, dispatch and live-tracking features will not function, and your employer may require these features as a condition of the role. That is a matter between you and your employer.
• Location history is retained for 90 days, after which it is deleted automatically. Your position is recorded continuously while a shift or assignment is active, which means a record of your movements during working hours exists for that period and is visible to the courier that engages you.

Proof of delivery. The app captures recipient signatures and photographs of delivered packages to evidence completed deliveries. These are attached to the package record and visible to the courier operating your account. Signatures and delivery photographs are treated as personal information. They form part of the courier’s delivery record and are retained for as long as that courier’s subscription is active, plus 30 days.

Cash and collection records. Where a rider handles Cash on Delivery, the app records amounts collected, remitted, and outstanding, linked to your rider identity.

Identity and contact details. Your name, mobile number, and rider account identifier, provided by the courier that engages you.

Device and diagnostic information. IP address, device model, operating system version, app version, crash logs, and usage timestamps.

4.2 Airship Booking App and 4.3 Airship Booking Site

Both products serve senders and collect the same categories.

Account and contact details. Name, email address, mobile number, and business name where provided.

Package information. Pickup and delivery addresses, recipient names and contact numbers, package descriptions, declared values, and special handling instructions. As noted in Section 2, recipient details are personal information about third parties.

Location. The Booking App requests access to your device location to suggest a pickup address when you create a booking. This is collected only while the app is open and you are actively creating a booking. It is not collected in the background, and we do not build a location history for senders. You may decline this permission and enter addresses manually; all other features continue to work. The Booking Site does not access device location.

Financial and transaction records. Shipping fees, Cash on Delivery amounts, remittance status, and account balances with the courier. Cash on Delivery is settled in cash between the sender, rider, and courier. We do not collect, process, or store payment card numbers or bank account details, and no third-party payment processor is integrated into the Services.

Device and diagnostic information. As described in 4.1.

4.4 Airship Back Office

Staff account details. Name, email address, mobile number, role, and permissions, created by the courier operating the account.

Operational data. All package, rider, sender, recipient, and cash records within that courier’s account, visible according to the permissions the courier assigns.

Audit and access logs. Records of actions taken in the system, retained so couriers can investigate discrepancies in cash handling and package status.

5. Sensitive personal information

We do not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act — including information about race, ethnic origin, marital status, age, religious or political affiliations, health, education, genetic or sexual life, legal proceedings, government-issued identifiers such as SSS, GSIS, TIN, or PhilHealth numbers, or tax returns.

Do not enter such information into free-text fields such as delivery instructions or package descriptions. If you do, it will be stored as part of the package record and we cannot separately safeguard it.

6. How we use information

We use personal information to operate and provide the Services; route, dispatch, and track deliveries; enable communication between senders, riders, dispatchers, and recipients; calculate fees and reconcile cash collections; generate reports for the courier operating the account; diagnose errors and maintain service stability; detect and prevent fraud, abuse, and unauthorized access; and comply with legal obligations.

We do not sell personal information. We do not use personal information for advertising, and we do not share it with data brokers.

7. Sharing and disclosure

We share personal information only as follows:

With the courier operating the account. This is the core function of the platform. Riders should understand that their location, delivery history, and cash records are visible to their employer.

With third-party service providers who process data on our behalf under contract and may not use it for their own purposes:

We do not use third-party analytics, advertising, or behavioural tracking services in any of the four products. Error diagnostics and crash logs are collected by our own systems and stored on AWS infrastructure under our control; they are not sent to any external analytics provider.

Where we send SMS notifications about bookings or deliveries, the recipient’s mobile number is transmitted to Amazon Web Services solely to deliver that message.

With third-party logistics partners (3PL). Where a courier forwards a package to a partner carrier, the package and recipient details necessary for delivery are transmitted to that partner. The partner handles that data under its own policy.

Where legally required. In response to a lawful order, subpoena, or government request, or to establish or defend legal claims.

On a change of control. If Rocket Labs is party to a merger, acquisition, or asset sale, personal information may transfer to the successor entity, which will remain bound by commitments no less protective than those in this policy. We will notify affected users before any such transfer takes effect.

8. Data storage and international transfer

Personal information is stored on Amazon Web Services infrastructure located in Singapore (ap-southeast-1). Because this is outside the Philippines, the transfer is an international one under the Data Privacy Act and is covered by our data processing agreement with AWS. Where data is transferred outside the Philippines, we ensure the transfer is subject to contractual safeguards requiring a level of protection comparable to that under the Data Privacy Act, and we remain accountable for that data under Section 21 of the Act.

9. Retention

We retain personal information only as long as necessary for the purposes described in this policy.

Rider location history is deleted automatically 90 days after collection.

Package, delivery, and financial records belong to the courier operating the account. We retain them for as long as that courier’s subscription is active because the courier requires them for reporting, cash reconciliation, and its own statutory record-keeping. Couriers are responsible for determining how long they must keep these records under Philippine tax and accounting law, and for exporting them before their subscription ends.

Where a courier terminates its subscription, we retain that courier’s account data for 30 days to allow export, after which it is deleted.

10. Your rights

Under the Data Privacy Act of 2012, you have the right to be informed about how your data is processed; to object to processing, including withdrawing consent; to access your data and know its sources, recipients, and purposes; to correct inaccurate or outdated data; to erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary; to damages for inaccurate, incomplete, outdated, false, or unlawfully obtained data; to data portability, receiving your data in a structured, commonly used, machine-readable format; and to lodge a complaint with the National Privacy Commission.

To exercise any of these rights, contact our Data Protection Officer using the details in Section 14. We will acknowledge your request within five (5) working days and respond substantively within fifteen (15) working days. Where a request is complex or requires coordination with the courier operating your account, we may extend this period once, and will tell you the reason and the expected timeframe before the initial period expires.

If we act as processor rather than controller for the data in question — see Section 2 — we will forward your request to the responsible courier and tell you that we have done so.

11. Account and data deletion

You may request deletion of your account and associated personal data at any time.

Online request: https://airship.me/delete-account

By email: privacy@airship.me

On receiving a verified request we will delete your account and associated personal data, except where we are legally required to retain it — principally financial and transaction records under Philippine tax and accounting rules. Where we retain records for that reason, we retain only what the obligation requires and delete the remainder.

If you are a rider or a sender whose account was created by a courier, deletion of your account may require that courier’s involvement, and we will coordinate with them.

12. Security

We protect personal information using encryption in transit, access controls limiting staff access to what their role requires, audit logging of administrative actions, and [LIST YOUR ACTUAL MEASURES — encryption at rest, MFA on admin accounts, regular backups, vulnerability testing].

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects within 72 hours of knowledge of the breach, as required under the Data Privacy Act.

13. Children’s privacy

The Services are business tools not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. Parents or guardians with concerns may contact our Data Protection Officer.

14. Contact us

Rocket Labs Consulting Inc. 226 Ortigas Avenue, San Juan City, Metro Manila, Philippines

Data Protection Officer Email: dpo@airship.me Phone: +(63) 917-537-8250

You may address correspondence to “The Data Protection Officer” at the address above. The individual currently designated as our Data Protection Officer is registered with the National Privacy Commission.

General privacy enquiries: privacy@airship.me

You may also lodge a complaint with the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City, Metro Manila — privacy.gov.ph.

15. Links to other sites

The Services may link to sites we do not operate, including third-party logistics partners’ tracking pages. We are not responsible for their privacy practices, and we encourage you to review their policies.

16. Cookies and similar technologies

The Booking Site and Back Office use cookies only where strictly necessary for authentication, session management, and security. We do not use analytics, advertising, or tracking cookies, and accordingly we do not display a cookie consent banner — strictly necessary cookies do not require consent.

The mobile applications do not use cookies. They may use device identifiers through Google Play Services as described in Section 7.

Note that our marketing website at airship.me is built on WordPress and may set cookies through plugins or embedded content independently of the Services described in this policy.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version at this URL and revise the “Last updated” date. Where changes are material — for example, a new category of data collection — we will provide notice through the Services or by email at least 14 days before the change takes effect.