PRIVACY NOTICE

Last Updated: July 27, 2026

When you count on Shipt to shop and deliver for you, you trust us with your personal information. This Privacy Notice (this “Notice”) describes what personal information we collect, and how we use, store, and share that information. This Notice applies when you use Shipt’s services or mobile applications, visit our websites, or interact with any other services, or where this Notice is linked or displayed (collectively, the “Services”). This Notice also tells you about the rights and choices you may have with respect to your personal information.

For purposes of this Notice, the terms “Shipt,” “we,” “our,” and “us” refer to Shipt, Inc. The terms “you,” “your,” and “yours” refer to any natural person who accesses or uses our Services. This includes individuals who use our Services in a business capacity, such as through a business account or on behalf of an organization.

This Notice does not apply to Shipt’s employees or personnel, job applicants, shoppers, or prospective shoppers. If you are a job applicant, please see Shipt’s Shipt’s Job Applicant Privacy Notice, and if you are a shopper or prospective shopper, please see Shipt’s Shopper and Prospective Shopper Privacy Notice.

WHAT WE COLLECT AND WHY

Types of Personal Information We Collect

Personal information is information that identifies, relates to, or could reasonably be linked to you, on its own or combined with other information. Depending on your interactions with us, we may collect:

• Contact information, such as your name, address(es), phone number(s), email address(es), and other ways to reach you.

• Demographic information, such as your date of birth, gender, income range, and marital status.

• Identity verification information, such as government identification information (e.g., driver’s license, passport), business verification information (e.g., tax ID), or other similar verification information.

• Transaction information, such as your electronic signature, order history, items in your cart, special requests, discounts or promotions, order dates and times, drop-off photos for deliveries, and anything else needed to place an order or provide a Service.

• Account information, such as your username, email, password, security questions, privacy settings, account number, and how you sign in. This also includes business details (like your business name and type), and any information you share when creating or managing your account. We may also receive this information from third-party platforms or sign-in services you link to our Services.

• Payment information, such as payment and billing details, which we collect through our third-party payment processor when you make a purchase or set up payments through our Services.

• Communication information, such as in-app messages, chat, SMS/text, email, or phone calls (including recordings, where applicable). This includes the date and time of your messages, how they were handled, and any feedback you share. We also collect information about your interactions with shoppers and drivers, like ratings or reviews.

• Usage and device information, such as your IP address, browser type, the website you visited before ours, your internet service provider, your searches on our Services, and how you interact with our features, ads, and marketing (including interactions like clicks, mouse movements, and scrolling).

• Geolocation information, such as order and delivery locations including the precise location of your device when precise location services are permitted and enabled on your device’s system or browser. If you have not enabled precise location, we may only infer your general location by using your zip code or your device’s IP address. Without precise location enabled, the accuracy of your deliveries and/or availability of certain content, features, or functionalities may be affected (for example, you may need to manually provide your delivery address).

• Social media information, such as when you follow us, share our content, or post comments on social media. What we collect depends on your privacy settings on that platform.

• Information from retailers and loyalty programs, such as membership status, loyalty account information, rewards eligibility, and related benefits information.

• Content you create or share, such as such as reviews, feedback, lists, survey responses, photos, recordings, or other content you share with us.

• Information you provide about others or they provide about you, such as when you use our referral program, a business account, or send a gift card or gift delivery, we may collect a name, email, delivery address, or other information you share with us. Please make sure you have permission to share information about others with us.

Some of the information identified above may be considered “sensitive personal information” under certain state laws. For example, when you provide us with government-issued identification for certain orders (e.g., alcohol delivery), account credentials, or precise geolocation information to enable accurate deliveries. Consistent with applicable law, Shipt processes sensitive personal information only as reasonably necessary to provide you with the Services, verify identity, prevent fraud, maintain security, comply with law, and for other purposes permitted by applicable law. Learn more in our Consumer Health Data Privacy Policy.

How We Use Your Information

How we use your information depends on how you interact with us. Here are the reasons we may use it:

• To provide our Services, including fulfilling your orders, creating and maintaining your account, enabling features like loyalty programs and shopper communication, fixing bugs, processing payments, checking your eligibility for products or services, running programs like gift deliveries or referrals, and displaying content you post publicly or share with others.

• To communicate with you, including sending delivery updates, order status notifications, and service-related notices, answering your questions, responding to your feedback, and connecting you with shoppers and drivers.

• To improve our Services and products, such as sending you surveys, understanding how you use our Services, improving delivery accuracy, helping you find retailers, and developing or improving features, services, and products.


• To customize and personalize our Services, such as remembering and understanding your interests and preferences like your preferred shoppers or delivery instructions, making recommendations, and tailoring your experience with our Services to your interests.

• To advertise or promote our Services, such as such as sending you messages, notices, newsletters, surveys, promotions, contests, or sweepstakes about our own or third parties’ goods and services that may be of interest to you, making special offers or promotions available to you, displaying advertising related to our Services or third parties on our Services and on third-party platforms, analyzing and measuring the effectiveness of our advertising, and otherwise developing and implementing marketing campaigns.

• As part of a corporate transaction, such as in connection with the sale of part or all of our assets or business, the acquisition of part or all of another business or another business’ assets, or another corporate transaction, including bankruptcy.

• For legal and policy compliance, such as to comply with our obligations under applicable laws and regulations, operating licenses, agreements, or policies, investigate or resolve disputes about our Services, respond to legal process or government requests.

• For safety, security, quality, and fraud prevention purposes, such as to enforce our terms and policies, verify your identity, and detect, investigate, prevent, and respond to fraud, security threats, unsafe experiences, illegal activity, or any other actions we deem necessary to protect the safety and security of you, others, and our Services.

When we use de-identified information, we keep it in de-identified form, and do not try to re-identify it, except as needed to determine whether our de-identification processes satisfy applicable legal requirements.

Retention of Personal Information

We retain your personal information for as long as necessary to provide our Services, fulfill the purposes described in this Notice, and meet our legal obligations or contractual commitments. When establishing a retention period for specific categories of personal information, we consider:

• Whether your account is active or inactive;
• The nature and length of our relationship with you;
• The sensitivity of the personal information;
• Our legal and contractual obligations; and
• Whether we have an ongoing business reason to keep the information (for example, communicating with you about ongoing Services).

Retention periods vary depending on the category of information, the purposes for which it was collected, legal obligations, fraud prevention needs, dispute resolution requirements, and business operations. When we no longer need your information, we delete or de-identify it.

HOW WE COLLECT YOUR INFORMATION

Directly from you. We may collect information when you interact with us. This includes when you create an account, place an order, participate in a survey, or communicate with us online, offline, or by phone.

Automatically when you use our Services. We may collect certain information automatically when you use our Services, like your device and browser details. Depending on your settings, we may also use cookies, pixels, and similar tracking tools to collect information about how you use our Services over time and across different websites and apps. Our vendors and third-party partners may also collect information this way.

From others. We may receive information from other parties like our business or retail partners, service providers, business customers, people setting up Services for you, or third-party platforms you use to connect with us or to your account. We may also get information from marketing partners, people who refer you to Shipt, or in connection with gift purchases, deliveries, or loyalty programs.

WHEN WE SHARE YOUR INFORMATION

Depending on how you use our Services, we may share your information in the following ways:

• With our corporate family. We may share your information with our parent company (Target Corporation), affiliates, and subsidiaries for the purposes described in this Notice, including to offer you products and services that may interest you.

• With marketing and advertising partners. This includes online ads targeted to your interests. We may share your information with third-party marketing and advertising partners to deliver advertising to you or include you in marketing campaigns, including personalized advertising based on your interactions on our Services and/or on third-party services. Please read the “Right to Opt-out of Sale, Sharing, or Targeted Advertising” section below for more information.

• With vendors and service providers. We may share your information with companies that perform work on our behalf, such as cloud storage, IT support, order fulfillment (including shoppers and drivers), payment processing, security and fraud prevention, marketing, analytics, communications, and as otherwise described in this Notice.

• With third parties or persons. We may share your information with third parties or persons, such as when you direct us to, provide consent, or as described at the time and point of the sharing, including when you allow a third-party application or platform to access your Shipt account, send or receive a gift via our Services, participate in a referral, loyalty, or co-branded program, or connect to or share with another account on our Services (such as business accounts). If you connect to a business profile, the primary account holder may be able to view and manage certain information associated with your use of that profile, such as payment methods, account or order activity, and delivery addresses. In some cases, we may make content or information publicly available upon your direction, such as reviews or feedback. As applicable, a third-party platform's use of your information is governed by its own terms and privacy policy, not this Notice. You may disconnect a third-party platform at any time through your Shipt account settings or the third party’s platform.

• With business partners. We may share information with business partners to provide our Services to you, such as to fulfill your order or facilitate your delivery, for fraud, safety, or trust matters or concerns, to provide you with promotions, offerings, or opportunities, or to provide products or services we think may be of interest to you.

• With government authorities, in the event of a dispute or claim, or as legally permitted or required. We may share information when we have a good faith belief it is reasonably necessary or permitted to: (a) satisfy or comply with a law, regulation, or legal process; (b) enforce or investigate potential violations of our terms or policies; (c) detect, investigate, prevent, or respond to fraud, security, or technical concerns; (d) support auditing and compliance; or (e) protect the rights, property, or safety of Shipt, our personnel, customers, partners, or the public.

• In connection with a business transaction. If Shipt is involved in a merger, acquisition, sale, reorganization, bankruptcy, or similar transaction, we may share your information with the parties involved. Where legally required, we will notify you beforehand.

YOUR CHOICES

Here are the ways you can manage your information and exercise your choices::

Marketing Choices and Communications

You may opt out of receiving marketing emails, text messages, and push notifications you receive from us. To stop receiving our promotional emails, you can follow the instructions in the message you receive from us. If you receive promotional text messages from us, you may opt out by replying “STOP.” If you receive push notifications from us, you may opt out by going to account settings, navigating to notifications, and then using the toggle to stop receiving notifications. Even if you opt out of receiving marketing messages, you will still receive transactional communications from us because they are necessary to provide the Services to you.

Cookie and Tracking Technologies

We and our partners may use cookies, pixels, software development kits (SDKs), and similar technologies to collect information about how you use our Services. The information collected through such technologies may include or be combined with personal information to help operate or secure certain features of our websites, to enhance your experience through personalization and remembering your preferences, to help us better understand the features of our Services that you and other users are most interested in, or to provide personalized advertising or marketing to you. If you block such technologies, certain features on our Services may not work, or you may not be able to take full advantage of certain features of our Services. Personalized advertising or marketing is also known as interest-based advertising, targeted advertising, or what some states define as “sharing” or “selling” for purposes of cross-context behavioral advertising. To opt out of the “sale” or “sharing” of your personal information for targeted advertising, see “Right to Opt-out of Sale, Sharing, or Targeted Advertising” below

PRIVACY RIGHTS

Depending on where you live, and the capacity in which you use our Services, you may have certain rights over your personal information, including:

• Right to Know and Access: You may have a right to know what personal information we collect about you, where we got it, the purpose of collection, and who we shared it with (and, in some states, the specific third parties). You may also request a copy of the specific personal information we hold about you.

• Right to Portability: You may have the right to ask us to provide you with a copy of the personal information we have collected about you in a portable and, to the extent technically feasible, readily usable format that allows you to transfer it to another company.

• Right to Correction: You may have a right to ask us to update inaccurate personal information we maintain about you.

• Right to Deletion: You may have a right to ask us to delete your personal information. Deleting your information may impact your ability to use our Services. Please note, we may keep some personal information as permitted or required by applicable law.

• Right to Opt-out of Sale, Sharing, or Targeted Advertising: We may allow or enable third parties to collect personal information to deliver personalized advertisements to you on third-party platforms, which may constitute a “sale” or “sharing” of your personal information under applicable law. The advertisements shown to you are based on personal information collected from your online interactions over time and across multiple websites, devices, or online services that you visit or use. You can opt out of the sale or sharing of your personal information for targeted advertising by managing your cookie preferences and/or clicking the “Your Privacy Choices” link at the footer or account settings and following the instructions there. You can also configure certain browsers to tell websites not to share your personal information for these reasons through the “Global Privacy Control” or GPC signal. We will respond to this signal in a frictionless manner. You can learn more about GPC at https://globalprivacycontrol.org. Opting out through an opt-out preference signal applies to the browser or device on which the signal is enabled. If you are logged in to your Shipt account when we receive an opt-out preference signal, we will also apply the opt-out to your account as required by applicable law. If you choose to use an opt-out preference signal, you will need to turn it on for each supported browser or browser extension you use. If your opt-out preference is stored only in a browser cookie, you may need to submit your preference again.

• Automated Decision-Making: Shipt does not currently engage in profiling that produces legal or similarly significant effects concerning you, so we do not offer an opt out of such activity. If our practices change, we will update this Notice and provide any legally required notices and choices.

How to Exercise Your Rights

• You can update and correct your account information directly in your account settings. To exercise your other rights, please submit your request via this link.
• If you have questions or need help on how to exercise your rights, please contact us at 877-557-1484 or email us at privacy@shipt.com.
• Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your personal information. We may need to verify your identity before we can fulfill your request. If you are an authorized agent, we may require proof of your written authorization or power of attorney. If we cannot verify your identity, we may request additional information or deny your request. We will respond within the time period required by applicable law, and will inform you if we need additional time.
• We will not discriminate or retaliate against you based on your exercise of any of your rights. We also do not charge a fee to process or respond to your requests unless they are excessive or repetitive. If we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Appeals

We may deny certain requests, or only fulfill some in part, as permitted or required by law. If you are not satisfied with the resolution of your request and you are a resident of a U.S. state that gives you a right to appeal a decision, you may appeal our decision denying your request. We will respond to your appeal within 45 days or the timeline permitted by applicable law. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable regulator and/or your state attorney general’s office.

NOTICE AT COLLECTION FOR CALIFORNIA RESIDENTS

This Notice at Collection is required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and any implementing regulations adopted thereunder (collectively, the “CCPA”) for California residents. The CCPA requires that we use certain category names to describe the personal information we process and describe in this Notice. Below we describe the categories of personal information we collect using the CCPA’s required category names as well as the corresponding data type described in this Notice. For more information about how we collect, use, and share personal information, please refer to the sections titled “How We Collect Your Information” and “When We Share Your Information” of this Notice for additional details.

Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information as defined under the CCPA:

• Identifiers, such as name, addresses, phones, and email addresses. This category includes certain personal information described as “contact information” and “account information” in this Notice.

• Additional categories of information considered to be Customer Records (collectively, “Customer Records”), such as name, address, phone number, credit card or debit card number, and other payment details. This category includes certain personal information described as “contact information,” “account information,” “transaction information,” “information from retailers and loyalty programs,” and “payment information” in this Notice.

• Characteristics of protected classifications under California or federal law (“characteristics of protected classifications”), such as date of birth and gender. This category includes certain personal information described as “identity verification information” and “demographic information.”

• Commercial information, such as your purchase history and other products purchased or considered. This category includes certain personal information described as “transaction information” or “information from retailers and loyalty programs” in this Notice.

• Internet or other electronic network activity information (collectively, “internet activity information”), including, but not limited to, browsing history, search history, and information regarding your interaction with an internet website, application, or advertisement. This category includes certain personal information described as “usage and device information” and “social media information” in this Notice.

• Geolocation data, such as your general location based on your IP address (such as your postal code) and, when you enable location services, the precise location of your device. This category includes certain personal information described as “geolocation information” and “usage and device information” in this Notice.

• Audio, electronic, visual, thermal, olfactory, or similar information (collectively, “audio/visual information”), such as voice recording when you contact our customer support team. This category includes certain personal information described as “content you create or share,” “social media information,” and “communication information” in this Notice.

• Professional or employment-related information, such as your business name, address, and role. This category includes certain personal information described as “account information,” “identity verification information,” and “information you provide about others or they provide about you” in this Notice.

• Inferences we may make using the categories of personal information above in the context of the Shipt service.

• Sensitive personal information, such as geolocation, account credentials, and payment information. Please note that Shipt processes limited sensitive personal information only for purposes permitted under the CCPA, and therefore does not offer a Right to Limit. This category includes certain personal information as described in “identity verification information,” “geolocation information,” “demographic information,” “payment information,” “transaction information,” “account information,” and “communication information” in this Notice.

• The CCPA requires that we tell you whether we collect any personal information that is described in California Civil Code Section 1798.80(e). The Code section includes a broad variety of categories of personal information, such as name, contact information, physical characteristics, credit card or billing information, and more. Shipt collects such information and it is already described in the categories above.

Uses of Personal Information

We use and have used in the past 12 months each of the categories of personal information for one or more of the purposes described in the section “What We Collect and Why.” Consistent with the CCPA “business purpose” categories, such purposes include:

• Providing Services: To provide our Services to you, including maintaining or servicing your account, providing customer service, processing or fulfilling orders and transactions, and more.

• Audit: Auditing related to a current interaction and concurrent transactions, or compliance with applicable laws or standards.

• Security and Integrity: Detecting security incidents, maintaining integrity, and protecting against malicious, deceptive, fraudulent, or illegal activity.

• Debugging: Debugging to identify and repair errors that impair existing intended functionality.

• Transient Use: Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with our business, provided that your personal information is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction.

• Advertising and Marketing: To provide advertising and marketing to you, including cross-context behavioral advertising.

• Research and Development: Internal research that Shipt performs to improve and develop its products and services.

• Quality Assurance and Product Improvement: Activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Shipt, and otherwise to improve, upgrade, or enhance such services or devices.

In the past 12 months, we have disclosed the categories of personal information listed above to service providers and contractors for the business purposes listed above, or at your direction. We have also disclosed certain categories of personal information to third-party advertising and marketing companies for cross-context behavioral or targeted advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA, such as performing our services, detecting security incidents, and verifying your information.

Categories of Personal Information Sold or Shared and Notice of Right to Opt-Out of Sharing or Selling

Cross-context behavioral advertising or targeted advertising may be considered a “sell or share” under the CCPA. Shipt discloses personal information with third parties to enable personalized advertising on our Services or other companies’ websites, apps, or properties. Such disclosure may be considered “sales” or “sharing” of personal information under the CCPA. In the last 12 months, the following categories of personal information may have been disclosed to advertising and marketing partners: personal identifiers, commercial information, internet and other electronic network activity information, inferences, protected characteristics (i.e., gender), and geolocation data (i.e., only non-precise location data derived from your IP address). You have a right to opt out of “sharing” and “selling” by clicking the “Your Privacy Choices” link in the footer or in your account settings.

Retention

We keep the above categories of personal information only as long as necessary to provide you with Services and as described in the section titled “Retention of Personal Information” in this Notice.

Shine the Light

Under California Civil Code Section 1798.83-84, California residents who have an existing business relationship with us may request information about our disclosure of certain categories of personal information to third parties for the third parties’ direct marketing purposes, if any. To make such a request, please contact us at privacy@shipt.com. Please be aware that not all information sharing is covered by these California privacy rights requirements and only information on covered sharing will be included in our response. This request may be made no more than once per calendar year.

NOTICE OF FINANCIAL INCENTIVE

Some U.S. states require that we provide you with specific information about the financial incentives we offer. From time to time, we may offer financial incentives in connection with the collection or use of personal information. We will ask you to provide information about yourself in connection with these programs (such as your name, email address, and/or telephone number). The financial incentives we offer to consumers are reasonably related to the value of the consumer’s personal information. We calculate this in good faith based on our reasonable determination using factors that include expenses we incur to collect, store, and keep personal information. We also consider the expenses related to providing the financial incentive program.

The material terms of the financial incentive program will be presented to you at the time you sign up. Participation in any financial incentive program is optional, and you may withdraw from participating in financial incentives at any time by following the instructions provided at the time you sign up. Withdrawal may impact your ability to receive additional rewards or promotions.

SECURITY MEASURES

We have implemented commercially reasonable measures designed to secure your information from accidental loss and from unauthorized access, use, alteration, and disclosure. We cannot guarantee that your information will not be accessed, disclosed, altered, or destroyed by a breach of any of our security safeguards. Please use the security features available to you, including those available through our Services.

CHILDREN’S PRIVACY

Our Services are meant for adults. We do not knowingly collect personal information from children under the age of 13, and we do not direct our Services to anyone under the age of 18. We do not knowingly sell or share the personal information of consumers under 16 years of age. If you are a parent or legal guardian and believe that we have collected information from or about such an individual, please contact us at privacy@shipt.com.

THIRD-PARTY WEBSITES AND LINKS

When you leave our Services, other companies' privacy policies apply. We are not responsible for the privacy practices of third parties, and we encourage you to review their policies before providing them with your information.

UPDATES

We may update this Notice from time to time, and will indicate the date the last changes were published. If the changes are significant, we will notify you or obtain consent as required by law. Unless otherwise indicated, any changes to this Notice will apply immediately upon posting to our Services.

CONTACT US

For any questions or concerns about this Notice, you can contact us in one of the following ways:

Send an email to:

privacy@shipt.com

Call us at:

877-557-1484

If you need this Notice in an alternative format due to a disability, please contact us using the information above.