Privacy Policy

1. Data Controller

The data controller responsible for your personal data is the operator of Shelfiko, reachable at:

Email: contact@shelfiko.com
Website: shelfiko.com

2. Data We Collect

Data type	Examples	Purpose
Account data	Name, email, company name, password (hashed)	Account creation and authentication
Inventory data	Uploaded CSV, XLSX, PDF files	Powering AI queries about your inventory
Chat data	Questions and AI responses	Service delivery, history (30 days)
Usage data	Token usage, query counts, timestamps	Plan enforcement and analytics
Payment data	Handled entirely by Polar	Subscription billing

We do not collect sensitive personal data (e.g. health, financial, or government ID data) and do not sell or share your data with advertisers.

3. How We Use Your Data

• To provide and improve the Shelfiko service
• To authenticate your identity and secure your account
• To process your AI queries using your uploaded inventory data
• To send transactional emails (verification codes, receipts) via Resend
• To enforce subscription limits and prevent abuse
• To comply with legal obligations

4. Legal Basis for Processing (GDPR)

• Contract performance — processing necessary to deliver the service you subscribed to
• Legitimate interests — security, fraud prevention, service improvement
• Legal obligation — where required by law
• Consent — where explicitly provided (e.g. marketing emails)

5. Third-Party Services

We use the following third-party services to operate Shelfiko:

• Anthropic (Claude API) — processes your queries and inventory data to generate AI responses. Anthropic's privacy policy applies to this processing
• Polar — handles all payment processing. We do not store your card details
• Resend — sends transactional emails on our behalf
• Railway — cloud infrastructure hosting the application and database

6. Data Retention

• Chat history is automatically deleted after 30 days
• Inventory files are retained while your account is active
• Account data is retained until you delete your account
• Upon account deletion, all your data is permanently removed within 30 days

7. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request restriction of processing in certain circumstances

To exercise any of these rights, contact us at contact@shelfiko.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encrypted data storage, hashed passwords, and secure HTTPS connections. Access to personal data is restricted to authorised personnel only.

9. International Transfers

Your data may be processed on servers located outside the EEA (e.g. in the United States) through our service providers (Anthropic, Railway, Resend). Where required, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

10. Cookies

Shelfiko uses only functional cookies necessary for authentication (session tokens stored in your browser's local storage). We do not use tracking, advertising, or analytics cookies.

11. Children's Privacy

Shelfiko is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. Continued use of the Service constitutes acceptance of the updated Policy.

13. Contact

For any privacy-related questions or to exercise your rights, contact us at: contact@shelfiko.com