Effective 2026-11-04. The Service was renamed from Legal to Ship (legaltoship.com) to State Law Check (statelawcheck.com); nothing else in this policy changed.
Privacy Policy
This policy explains what personal data State Law Check collects through statelawcheck.com, the API and the Shopify app, why, who else handles it, and how long we keep it.
We collect as little as we need to run the Service. We don't sell personal data, and we don't use it for advertising.
What we collect
Account email. When you sign up or sign in, we store your email address, your plan, and the time we last emailed you a sign-in or confirmation link. If you sign in with Google, we receive your email address from Google to identify your account; we don't receive your Google password or contacts.
Sign-in cookie. After you sign in we set one cookie, lts_session, that keeps you signed in to your account page for up to 7 days. It is only sent to our account endpoints. We don't use advertising or analytics cookies.
API key metadata. For each key we store its name, when it was created, whether it is active or revoked, whether it is a test key, and its plan. Our cloud provider counts requests per key to enforce quotas.
Check inputs (decision log). When you call the API with a key, we keep a log of each check: the request you sent (for example ZIP code or state, product category and attributes, carrier), the ruleset version, the decisions, and the rules and citations behind them. This lets you show later why an order was or wasn't shipped. The log is tied to your key.
IP address. We use your IP address to apply rate limits and prevent abuse, for example capping sign-up attempts per address per day. Counters are stored under a one-way hash, not the raw address, and expire within a few days. Our hosting provider's request logs, which may include IP addresses, are kept for about a month for security and troubleshooting.
Approximate location. Our content delivery network tells us the country and state your request came from. We use this only to pre-fill the "From" field on the lookup page. We don't store or log it.
Shopify store data. If you install the Shopify app, we store your shop domain, the access token and permissions Shopify grants the app, the install date, your app subscription status, and, for each product, its Shopify ID and title, our classification, your review decisions and the resulting shipping rules. We read product descriptions and other listing details from Shopify when classifying a product but don't keep them. We don't store your customers' personal data.
Payment. Paid API plans are billed by Stripe. Stripe collects your card details; we never see or store card numbers. We store your Stripe customer ID and subscription status. Shopify app charges are billed by Shopify.
CAPTCHA. Sign-up forms use Cloudflare Turnstile to tell people from bots. Turnstile collects signals from your browser and device under Cloudflare's privacy policy; we receive only a pass or fail result.
Alert preferences. If you turn on law-change alerts, we store the product topics and states you chose and send alert emails to your account email.
Rule feedback. If you report a rule as wrong, we store the rule, the kind of problem, any change you asked for, your note and, if you give one, a way to contact you, under your account, workspace or Shopify store. Reports from the website without an account aren't tied to a person; their rate limits use the hashed IP counters described above. Please leave customers' personal data out of reports; notes with email addresses are refused.
Messages. If you email us, we keep the message and our reply.
How we use it
- To run the Service: answer lookups and checks, sign you in, issue keys, sync and classify Shopify products.
- To send account email: sign-in links, confirmations, billing notices, and law-change alerts you asked for.
- To bill paid plans and enforce plan limits.
- To keep the Service secure and stop abuse, including scraping and quota evasion.
- To fix problems and improve our rules and classification. We don't use your data to train third-party AI models.
- To meet legal obligations.
Who processes it
We use these service providers. Each gets only what it needs for its job.
- Amazon Web Services (United States, us-east-1 region): hosting, database, file storage, content delivery and sending email. All our stored data lives here.
- Stripe: payment for paid API plans.
- Anthropic: AI classification on paid plans. When our own rules can't confidently classify a product, we send its listing text (title, description and specifications) to Anthropic's API. We don't send your email or other account details with it.
- Cloudflare: Turnstile CAPTCHA on sign-up forms.
- Google: optional Google sign-in.
- Shopify: if you use the Shopify app, Shopify shares store data with us and handles app billing.
We may also disclose data if the law requires it, to protect the Service or others from harm, or as part of a sale or transfer of the business.
How long we keep it
- Decision log: 90 days, then deleted automatically.
- Rate-limit counters: a few days, then deleted automatically.
- Request and error logs: about 30 days.
- Sign-in and confirmation links: valid for 1 to 24 hours.
- Account, keys and alert preferences: until you ask us to delete your account. Revoked keys stay listed on your account until then.
- Shopify store data: deleted when you uninstall the app or Shopify asks us to erase your shop's data (rule feedback included).
- Rule feedback: until you ask us to delete your account; reports from the website, and our review notes, as long as they help us maintain the rules.
- Billing records: as long as tax and accounting law requires.
Shopify data requests and deletion
We follow Shopify's mandatory privacy webhooks. When you uninstall the app, or Shopify sends a shop erasure request, we delete your shop record, access token and stored product data. Because we don't store your customers' personal data, customer data requests and customer erasure requests have nothing for us to return or erase; we acknowledge them. When you delete a product in Shopify, we delete our copy of it.
Your rights and deletion requests
You can see your keys and alert settings on your account page, revoke keys, and turn alerts off at any time.
To get a copy of your data, correct it, or delete your account, email support@statelawcheck.com from the address on your account. We will confirm the request and act on it within 30 days. Deleting your account revokes your keys and removes your account, keys and alert preferences; your decision log then expires on its normal 90-day schedule unless you ask us to delete it sooner. Depending on where you live, you may have further rights under laws such as the GDPR or state privacy laws, and you may complain to your local data protection authority.
Security
Data is encrypted in transit (HTTPS) and at rest. API keys are shown once and stored by our cloud provider; sign-in links work once and expire. Access to our systems is limited and permission-scoped. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you as the law requires.
Where data is stored
We store data in the United States. If you use the Service from elsewhere, your data is transferred to and processed in the United States.
Children
The Service is for businesses and is not meant for anyone under 18. We don't knowingly collect data from anyone under 18. If you think we have, email us and we will delete it.
Changes
We will post updates on this page with a new date, and email account holders about material changes before they take effect.
Contact
Privacy questions and requests: support@statelawcheck.com.