Shipixen

GDPR overview

Implementation is thin and almost entirely implicit. The word GDPR appears nowhere on the site — not in the terms, not in the privacy policy, not in the archived HTML. What the privacy policy does offer is a set of rights that map onto the regulation: access, deletion, correction, portability, restriction of processing, withdrawal of consent and a right of appeal, plus the option to complain to a local data protection authority. On international transfers it commits to recognised mechanisms, naming the European Commission's Standard Contractual Clauses or the UK equivalent for any transfer out of Europe. Beyond that, nothing: no Article 27 EU representative, no named data protection officer, no published Data Processing Agreement and no subprocessor list. Privacy requests go to the general support mailbox. The policy was last updated on 1 October 2023.

Who owns the data?

Ownership splits cleanly in two. The generated code belongs to the buyer outright: Shipixen states that the license applies to the app and not to its output, that every site produced is yours to keep forever as a zip file and a git repository, and that commercial use is permitted. Personal data is a separate matter and remains the vendor's to process. The privacy policy describes an ordinary collection — name, address, phone, email, order and account details, usage data — used by Shipixen, shared with service providers and marketing partners, and potentially transferred in a merger or bankruptcy. Anything posted publicly, such as a review, leaves the vendor's control entirely.

Reuse rights

For the generated code, reuse is unrestricted and needs no permission: a valid license allows an unlimited number of sites, the code is yours to keep, and commercial use is expressly allowed. Deployment is equally open — Shipixen pushes to Vercel during generation, but any host supporting Next.js is acceptable. Personal data follows the opposite logic and is used by the vendor, not the user: Shipixen relies on it to deliver the service, process payments, run marketing and advertising, detect fraud and provide support, on the basis of contract performance and legitimate interest. Cookies serve analytics and third-party ad targeting. The policy does state that sensitive personal information is neither used nor disclosed to infer characteristics about the user.

Data retention & training

Hosting summary

Shipixen names one host and commits to nothing more. The terms of service state that the website runs on Vercel Inc., and the privacy policy lists Vercel among the third parties supporting the site and its services. No jurisdiction is guaranteed. The privacy policy warns that personal data may be transferred, stored and processed outside the user's country of residence, explicitly including the United States, and that transfers out of Europe rely on recognised mechanisms such as the European Commission's Standard Contractual Clauses or the UK equivalent. The domain resolves to a Vercel anycast node located in the United States. No choice of hosting region is offered and no data residency guarantee is made. One distinction matters here: the code Shipixen generates is not hosted by Shipixen at all. It lives wherever the buyer deploys it — Vercel and Netlify are one-click targets, but any Next.js-capable host will do, including a local machine started from the zip download.