Privacy Policy

1. Information we collect

• Account information: your name, email address, and a securely hashed password when you create an account, and your email address if you join the waitlist.
• Configuration data: the competitors, product listings, rules, notes, unit costs, supplier URLs you point us at, and inventory counts you set up in the Service.
• Store connection: if you connect your Shopify store, the Admin API access token you paste in. It is encrypted at rest (AES-256-GCM) and used only to read your products and to write the prices you approve — never shown again and never shared.
• Onboarding answers: your one-time answer to whether you sell on Amazon, used to tailor the desk.
• Usage data: standard technical logs such as IP address, browser type, pages visited, and timestamps, used for security and to operate the Service.
• Communications: messages you send us through the contact form, by email, or to the in-app help chat.

We do not knowingly collect payment card numbers ourselves — if paid plans are offered, payments are processed by a dedicated payment provider and card details never touch our servers.

2. How we use information

• to provide, maintain, and improve the Service;
• to send you transactional emails (such as account, password-reset, and briefing emails) and, if you joined the waitlist, exactly two follow-ups (a sample briefing and a note from the founder) — every briefing and waitlist email includes a one-click opt-out link;
• to secure the Service, prevent abuse, and comply with legal obligations.

We do not sell your personal information. We do not share it with third parties except the service providers below, or where required by law.

3. Service providers we rely on

Like most software, Shelfhawk runs on trusted third-party infrastructure. These providers process data only to provide their service to us:

• Hosting: our servers, provided by a US-based hosting provider, store the Service and its database.
• Stripe (billing): handles subscriptions and card payments. Stripe receives your email address; card details never touch our servers.
• Resend (email delivery): sends our transactional emails and the two waitlist follow-ups. It processes recipient email addresses and message content.
• OpenAI (AI processing): receives review text from the public listings you track, the content of supplier pages you point us at, and the messages you type into the help chat — used only to generate summaries and answers for you, not to train models. Your account details are not included in these requests.
• Apify (web fetching): fetches the Amazon product pages for listings you track, so we can read their public price and stock.
• Meta (advertising measurement): we run the Meta Pixel so we can tell which advertising brings people to Shelfhawk. When you visit the site, Meta receives your IP address, the page you are on, and a cookie identifier, and may link that to a Facebook or Instagram account if you have one. It is used to measure and target our advertising. See section 4 for how to refuse it.
• Etsy Open API and eBay Browse API (marketplace data): receive the listing ids or URLs you track so we can read public price and stock; on the Command plan Etsy also receives the search queries you type into rival discovery.

4. Cookies and advertising measurement

Essential cookies: a session cookie that keeps you signed in and, where applicable, a preference cookie (such as language). These are required for the Service to work.

Our own product analytics are deliberately cookie-free. We count page views and actions (for example, that a price check was run) without storing your IP address, your browser user agent, or any identifier that persists after you close the tab.

Advertising measurement. We also run the Meta Pixel, which does set a third-party advertising cookie and sends your IP address and the page you are viewing to Meta. We use it to see which advertising brings people to Shelfhawk. If you would rather not be measured this way, you can block it with any tracker-blocking browser extension or browser setting, or adjust your Meta ad preferences at facebook.com/adpreferences. Blocking it has no effect on your use of the Service.

5. Data about third parties

The Service collects publicly available information about the storefronts and listings you choose to track (for example prices and public customer reviews). This information is gathered from public sources, is attributed to those sources, and is used solely to provide the Service to you.

6. Data retention and deletion

We keep your information for as long as your account exists. You can delete your account yourself at any time from Settings → Your account inside the app: this cancels any subscription immediately and deletes your competitors, listings, inventory, store connection, settings, and personal information within thirty (30) days, except where we must retain a record to comply with law (for example invoices held by Stripe). You can also ask us to delete it at contact@shelfhawk.pro. Waitlist follow-ups stop the moment you click the opt-out link in any waitlist email; waitlist entries are deleted on request.

7. Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. Export and deletion are self-serve: Settings → Your account lets you download a JSON copy of everything we hold about you, and delete your account. For anything else, email contact@shelfhawk.pro. We will respond within the time required by applicable law.

8. Security

We take reasonable technical measures to protect your information: all traffic is encrypted in transit (HTTPS), passwords are stored only as salted hashes, the database is not reachable from the public internet, and access to production systems is restricted. No system is perfectly secure, so we cannot guarantee absolute security.

9. International transfers

Our servers are located in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States.

10. Children

The Service is not directed to children and may not be used by anyone under 18. We do not knowingly collect information from children; if you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be indicated by updating the date at the top of this page. Continued use of the Service after a change constitutes acceptance.

12. Contact

Privacy questions or requests: contact@shelfhawk.pro. See also our Terms of Service.