Version 1.0 · Last updated 20 August 2026
These terms govern the use of SafeShip Pakistan by member stores. By applying for membership, using the dashboard, or calling the API through our WooCommerce or Shopify plugin, your store accepts them. If you do not accept them, do not use the service.
SafeShip Pakistan (“SafeShip”, “we”, “us”) is a shared Cash-on-Delivery risk-intelligence service for Pakistani e-commerce businesses, operated by DANGO. Member stores contribute records about delivery outcomes and may search that shared database before dispatching a COD order.
SafeShip is an information service, not a decision service. We do not decide whether any order should be accepted, refused, or cancelled. That decision belongs entirely to the member store, which remains responsible for it.
Every record in SafeShip is one merchant's account of its own transaction with its own customer. We do not investigate, verify, corroborate, rate or endorse any record. We do not add, infer, or editorialise. We provide the shared place where a merchant may record what happened in its own business and where other merchants may read it.
The contributing store is the author of, and remains responsible for, what it submits. It submits under its own customer terms and privacy notice, and warrants when submitting that those terms permit it to share the incident for this purpose (see section 3 and section 5). A record is that store's statement — not ours, and not a finding by us.
Nothing in a SafeShip record is a statement by us that any person is dishonest, fraudulent, or unfit to trade with. A record describes a delivery outcome reported by one shop, nothing more. Members are told this in section 4 and must weigh it themselves.
We never advise, recommend, instruct or endorse that any store should refuse, cancel, delay or alter an order for any person. We express no view on whether a person should be traded with. We do not maintain a “do not ship” list, we do not score people, and we do not sell an opinion about anyone — we display what a member store wrote about its own transaction, and nothing else.
Where the interface highlights a match, uses a colour, or orders results by how closely they match, that is a presentation of the store's own report and of how confidently it matched your search. It is not our assessment of the person, and it is not a recommendation. Words such as “high risk” describe the strength and severity of the matching record, not a judgement of the human being named in it.
Every dispatch decision is made by the member store alone, on its own commercial judgement and under its own terms with its customer. A store that refuses an order does so on its own responsibility. If you are a consumer and a shop has declined to deal with you, that was the shop's decision, not ours — though if you believe the underlying record is wrong you can have it corrected or removed free of charge under Your Rights.
This is the most important section of these terms. A flag is a factual statement about a named person that other businesses will read and act on. Accordingly, each time you submit a record you warrant that:
You must not flag a customer for exercising an ordinary consumer right — a lawful return, a warranty claim, a complaint, a negative review, or a cancellation made before dispatch. See the Flagging Policy for the full rules.
You must disclose to your customers, at or before the point of order, that COD orders may be checked against a shared risk database, and link to this page. A ready-made notice is provided under Checkout notice for stores. Placing this notice is your responsibility as the business that collects the customer’s data.
SafeShip is provided on an “as is” and “as available” basis. The database is built from member-submitted reports. We take the care described in these terms, but we do not warrant that any record is accurate, complete, or current, and an absence of records is not a statement that a customer is safe.
Because a record is the contributing store's own statement about its own transaction (section 1.1), we do not adopt, endorse or republish it as our own. We do not verify records before they appear, and we make no representation about any person named in one. Responsibility for the content of a record rests with the store that submitted it; responsibility for any decision taken after reading one rests with the store that read it.
To the fullest extent permitted by law, our aggregate liability to a member store for any claim arising out of the service is limited to the subscription fees that store paid to us in the three months preceding the claim. We are not liable for lost profits, lost sales, refused or cancelled orders, courier charges, or reputational loss.
Nothing in these terms limits any liability that cannot lawfully be limited, and nothing in them purports to affect the rights of a person who is not a party to them. A person named in the database is not a party to these terms: their route is section 6 and the Your Rights page, both of which are free to use and do not require an account.
You remain the author of the records you submit. If a third party brings a claim against us — for defamation, breach of privacy or data-protection law, or otherwise — arising from a record your store submitted in breach of these terms, or from a disclosure your own customer terms did not permit, you agree to indemnify us against that claim and the reasonable costs of defending it. This does not apply where the claim arises from our own handling of the data rather than from your submission.
We will tell you promptly about any such claim, will not settle it in your name without asking you first, and will give you the chance to take over the defence.
Plan pricing, quotas, and any overage terms are shown in your dashboard under Billing and form part of these terms. We may change pricing on reasonable notice; changes do not apply to a period already paid for. Access may be suspended while an invoice is overdue.
We may suspend or terminate an account immediately for breach of sections 3, 4, or 5, for submitting records that cannot be substantiated, for sharing access outside your business, or where required by law. You may close your account at any time by contacting us. On termination, records your store has already contributed remain in the database subject to the retention rules in the Privacy & Data Policy, because other members have relied on them — but you may ask us to review them.
We may update these terms. Material changes will be notified by email to the address on your account and announced in the dashboard. Continuing to use the service after the stated effective date constitutes acceptance.
These terms are governed by the laws of the Islamic Republic of Pakistan, and the courts of Pakistan have exclusive jurisdiction over any dispute arising from them.
This policy explains what personal data SafeShip Pakistan holds, why we hold it, who can see it, how long we keep it, and what a person named in the database can do about it. It is written to be read by consumers as well as by member stores.
DANGO operates the SafeShip Pakistan platform. The member store that submits a record is responsible for the accuracy of that record and for telling its own customers that COD checks are carried out. We are responsible for the platform, for the safeguards described here, and for handling correction and deletion requests.
| Category | What it contains |
|---|---|
| Customer identifiers | Name, phone number, delivery address, city, and email address as supplied by the member store for a specific order. |
| Delivery outcome | What happened with the order — for example refusal on delivery, repeated non-collection, or a false address — recorded as a tag and a short factual note. |
| Evidence references | Order reference, courier name, tracking ID. |
| Member store data | Business name, contact details, login credentials, billing records, API tokens. |
| Activity records | Searches and changes made by each member account, with timestamp and IP address. |
| Match-comparison snapshots short retention |
When a search produces a match, the search terms the store sent — phone, delivery address, email — stored beside the record they matched and the scores the engine gave, so an incorrect match can be examined and the engine corrected. Erased automatically after 14 days by default, and never kept longer than 90. |
We do not collect browsing or shopping behaviour, we do not build profiles of people who have not been flagged, we do not hold payment card or bank details of consumers, and we do not hold national identity card numbers. The permanent database contains no record of ordinary customers — only specific reported delivery incidents.
The one deliberate exception is the match-comparison snapshot described above. Where a search matched a flagged record, the terms the store sent are held briefly so that a match the store or the customer believes is wrong can actually be checked rather than taken on trust. It is short-lived by design, it is visible only to that store and to us, it is never used to create a record or to assess anyone, and searches that match nothing — the large majority — leave no snapshot at all.
The purpose is narrow and singular: to let a Pakistani business assess the risk of dispatching a Cash-on-Delivery order, where the business bears the full cost of the goods and the courier charges if the order is refused. This is a legitimate interest of the businesses concerned, and it is a long-established commercial practice for parties to share information about counterparty risk.
We balance that interest against the interests of the person named by limiting the data to what is necessary, restricting who can see it, requiring evidence, keeping it out of public view, providing a free correction route, and deleting it after a fixed period. Member stores are additionally required to notify their own customers at the point of order.
No system is perfectly secure. If a breach affecting personal data occurs, we will act to contain it and notify affected member stores, and the relevant authority where required.
If you are a consumer and believe you have been recorded, you may ask us to confirm whether we hold a record about you, to correct it, or to remove it. There is no charge. Full instructions are on the If you’ve been flagged tab. We take these requests seriously: an inaccurate record harms a real person and is of no value to our members either.
We use a single session cookie to keep members logged in, and a preference cookie for the light or dark theme. We do not use advertising or cross-site tracking cookies.
Material changes to this policy will be announced in the dashboard and emailed to member stores. The version and date at the top of this page always reflect the current text.
The value of SafeShip depends entirely on records being accurate. One store flagging a customer out of frustration damages a real person, misleads every other member, and exposes all of us. These are the rules, and they are enforced.
In every case: a real order at your store, with an order reference and, where available, courier and tracking details.
Write what a courier docket would show, not what you feel. Neutral and factual survives scrutiny; an insult does not, and it is the sentence that turns a lawful record into a defamation claim.
| Write this | Not this |
|---|---|
| Refused delivery on 12 Aug, parcel returned by Leopards, tracking LX8842. No contact after three calls. | Fraudster, total time-waster, everyone should block this guy. |
| Address on order was incomplete; courier could not locate. Customer unreachable on the number given. | Fake address, obviously a scammer. |
This page is for customers, not stores. If a shop has told you that you appear on a shared COD risk database, or you think you may have been recorded in error, here is exactly what to do. It is free, and you do not need an account.
When a Pakistani online store ships an order Cash on Delivery, the store pays for the goods and the courier before it receives any money. If the parcel is refused, the store loses both. SafeShip lets member stores record specific delivery incidents and check that shared record before shipping.
It is not a credit score, it is not a public blacklist, and it is not searchable by the public. Only verified member businesses can look up a number, only in connection with an order they are actually handling, and every lookup is logged.
We do not advise shops to refuse anyone, we do not keep a “do not ship” list, and we do not score or rate people. We show a shop what another shop wrote about its own delivery. If a shop declined your order, that was that shop's own decision under its own terms. What we can do is make sure the underlying record is accurate — and remove it, free, if it is not.
A record describes what happened with a specific order — for example that a parcel was refused on delivery, or that an address could not be found. Member stores are expressly forbidden from recording you for returning an item, making a warranty claim, complaining, leaving a bad review, or cancelling before dispatch. If a store has recorded you for any of those, the record breaches our rules and we will remove it.
Email support@dango.pk with the subject “Customer record request” and include:
We will only discuss a record with the person the phone number belongs to, so we may ask you to verify the number. That is to protect you, not to obstruct you.
Tell us and we will look again, with a different reviewer where possible. If you remain dissatisfied, nothing on this page limits any right you have to pursue the matter with the store concerned or through the courts of Pakistan.
An inaccurate record is no use to our members either — it makes them refuse good orders. We have no interest in keeping a record that cannot be backed up, and stores that submit unsupportable records lose the right to submit at all.
Member stores must tell their own customers that COD orders may be risk-checked. This is the single most useful thing you can do to put your store on solid ground — it turns an undisclosed check into a disclosed one. Copy the text below into your checkout page, order confirmation, or privacy policy.
Under data-protection principles, the business that collects a customer’s data is the one that owes them notice. That is your store, not SafeShip. A one-line disclosure at checkout costs you nothing, is invisible to honest buyers, and is the difference between a documented, disclosed risk check and an undisclosed one.
Cash on Delivery orders may be verified against SafeShip Pakistan, a shared COD risk database used by verified Pakistani stores, before dispatch. See safeship.dango.pk/legal.php for details and how to correct a record.
COD verification. To reduce losses from refused Cash-on-Delivery parcels, we may check the name, phone number, email address and delivery address you provide against SafeShip Pakistan, a shared risk database operated by DANGO and accessible only to verified Pakistani merchants. Where a delivery incident occurs with your order — for example a parcel refused on delivery or an address that cannot be located — we may record that incident in the same database. We do not record lawful returns, warranty claims, complaints, or cancellations made before dispatch. You may ask what is held about you, and ask for it to be corrected or removed, free of charge, by writing to support@dango.pk. Full details: https://safeship.dango.pk/legal.php
COD orders are risk-checked before dispatch. Learn more: safeship.dango.pk/legal.php
Adjust the wording to match your store’s tone — what matters is that the customer is told, before ordering, that a check may happen and where to go if they disagree with a record.