Privacy

What ShelfSocial stores, why it is stored, how long it stays, and who else sees it. This describes the service; it is not a summary of a longer document kept somewhere else.

1 · What we collect

Because you signed in

You sign in with Google, or with a link we email you. From Google we receive your name and email address and a stable account identifier, and nothing else. We never see your Google password.

Because you asked to be told when we open

While the product is closed, our website offers a form instead of a sign-up button. If you use it we keep the email address you typed, the Instagram handle if you gave us one, which page you were on, and the date. That is the whole record — there is no account behind it, and we send one email to confirm it and one when we open. Nothing else. Reply to either and we will remove you; how long it stays otherwise is in section 5.

Because you set the shop up

Your shop’s name, location, time zone, website, the voice you want captions written in, the hashtags you want appended and the words you never want used. All of it is optional except the shop’s name, and all of it exists to be put into the content we make for you.

Because you turned on notifications

If you agree to notifications on a phone or a computer, your browser gives us a subscription — an address at Google, Apple or Mozilla that they will deliver a message to, and two keys that let only us send to it. It identifies the browser, not you: we never receive a device identifier, a phone number, or a location from it. We also record which kind of device it is — iPhone, Android, desktop — because notifications do not work the same way on all of them and we need to know how many people we can actually reach.

Turning notifications off in your browser or your phone’s settings stops them at once. We delete the subscription the first time a delivery comes back saying it is gone.

Because you connected Instagram

The account’s identifier and handle, and an access token, encrypted with a key we hold separately from the database. The token is what lets us publish. We also record whether the connection is healthy, so we can tell you before a post fails rather than after.

If you allow it, we also read back how the posts we published did — how many people saw each one, and what they did with it. Only posts we published for you: we never read the account as a whole, so anything you post yourself is invisible to us, and we never read follower counts or follower growth. How long we keep those figures is in section 5.

Because you used it

The photographs you upload, the images and captions we generate from them, your campaigns and schedule, and a ledger of every credit charged or refunded, with a reason. The ledger exists so a charge can always be explained to you.

We also record how you use the product — which screens you open, which steps you finish and where you stop. It is how we find the parts that are confusing and fix them. It is tied to your shop, so we can tell one shop’s difficulty from another’s; it is not tied to anything you do elsewhere on the internet, and nothing is stored on your device to do it. How long we keep it is in section 5.

2 · What we do not do

We do not train AI models on your photographs or your content — and neither do the AI providers we use. We only send content to providers whose terms commit them not to use it for model training. They are named in section 3.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — including as those terms are defined under California law. We have never done so and we do not do so for anyone, of any age.

Some things leave us that are not strictly needed to run your account, and we would rather name them than bury them: Google’s reCAPTCHA, on the sign-in form and when you ask us to delete your account (section 3 — Google may use what it collects to improve reCAPTCHA and its own services, which is their condition for providing it free); Google Analytics on our public website, and only if you agree to it; the record of how the product is used, described in section 1; and, if you joined the early-access list before we opened, your email address passing through Resend so the confirmation could reach you. None of them is advertising, and none of them is sold.

We do not read your Instagram inbox or your followers. The permissions we ask for are the ones needed to publish and to read back what was published.

We do not post anything you have not approved.

3 · Who else processes it

We use other companies to run the service. Each sees only what it needs to do its job. The table below is the current list. We will give notice in the product before adding a new one that handles your content.

About reCAPTCHA. It runs for everyone who uses the emailed-link form, and again if you ask us to delete your account, whether or not you have a Google account. It sends Google your IP address and how you interacted with that page so it can tell a person from a script, and it sets its own cookie to do so. It runs on those two pages and nowhere else — reading any other page on this site sends Google nothing.

About Resend. It delivers our email. It receives the address a message is going to and the message itself, and it tells us whether the message arrived, bounced, or was reported as spam.

About PostHog. It runs in a mode that stores nothing on your device: no cookie, and nothing kept in your browser between visits.

About the AI providers. They receive the photographs and product details needed to generate an image, a video or a caption. We send what the job requires and no more. None of them uses that content to train models — we use paid or commercial tiers specifically so that this is true, and we keep a record of the terms we relied on. Everything they return is machine-generated and may be inaccurate; reviewing it before publishing is your responsibility, and clause 5 of the terms sets that out in full.

About Stripe. Card numbers are entered on their systems. We never see or store them.

4 · Where your data is

Your account, your content and your photographs are stored in the United States, in AWS us-east-1.

Images sent for generation are processed by the providers in section 3, in the United States and in the European Union. Data sent to a provider outside Canada is subject to the laws of the country it is in, and may be accessible to authorities there under those laws. We tell you this because Canadian privacy law expects us to, not because we know of any such request — we have never received one.

5 · How long we keep it

6 · Cookies

Ours: one cookie, for signing you in. It is cryptographically signed, cannot be read by JavaScript, and holds your account identifier and email. Two short-lived companions exist only while you are signing in — one during the Google redirect, one while an emailed link is outstanding — and both are cleared the moment they are used.

Google’s: one, set by reCAPTCHA, so it can tell a person from a script. It is present on the sign-in page, and on the account page if you open the deletion sheet. We do not set it, cannot read it, and it is only ever present because of the robot check described in section 3.

Analytics, on this website only, and only if you agree. If you accept when we ask, Google Analytics sets its own cookies so we can see how people find the site. Decline and it never loads, nothing is set, and nothing about that choice changes what the site does. You are asked before anything is set, not after.

Nothing at all is set inside the product. We do measure how the product is used — section 1 says so plainly and section 3 names who receives it — but it is done without storing anything on your device, so there is no cookie to accept or refuse and we do not ask you for one.

There is no advertising cookie anywhere, on the product or on this website, and nothing here is used to follow you around the internet.

7 · How we protect it

Data is encrypted in transit and at rest. Your Instagram token is encrypted separately, with a key held outside the database, so that access to the database alone does not yield it. Access to production systems is limited to the people who need it, requires multi-factor authentication, and is logged. We review these controls periodically.

No system is perfectly secure, and we will not claim otherwise.

8 · If something goes wrong

If your data is involved in a breach that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada without unreasonable delay, and any other regulator the law requires. We will tell you what happened, what was affected, and what to do about it.

9 · Your rights

You can see and correct your shop details, your products, your content, your schedule, your credit ledger and your Instagram connection from inside the product, on the account screens.

Beyond that you may ask us to:

• give you a copy of the personal information we hold about you;
• give you that copy in a structured, commonly used, machine-readable format, or send it directly to another organisation where that is technically feasible;
• correct anything inaccurate;
• delete your account and your data;
• tell you more about how we handle it.

Write to support@shelfsocial.ai and we will respond within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, if you are in Quebec, to the Commission d’accès à l’information (cai.gouv.qc.ca). You do not need our permission to do so.

10 · If you are in California or another US state with privacy legislation

You have the right to know what we collect, to get a copy, to correct it, to delete it, and not to be discriminated against for exercising any of those rights. Section 1 sets out what we collect and why; section 5 sets out how long we keep it; section 9 explains how to exercise the rights, and the same address works. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of.

11 · What deletion does, and what it does not erase

Your shop goes at once. Your products, your photographs, your generated pictures and Reels, your campaigns, your credits and your Instagram token stop being reachable through the service the moment your account is deleted. Your card is removed straight away and you are not billed again.

What outlives the account, and why:

• A one-way fingerprint of your Instagram handle, and one of your email address. Not the handle or the address themselves: a cryptographic hash of each, salted, from which neither can be recovered. The record holds nothing else — not your content, not your token. Without the first, deleting an account and signing up again would mint a fresh free trial on demand, indefinitely. The second is there for you: it is how we recognise that it is you coming back, so that during those 90 days you can reconnect your own Instagram account without asking us. Anyone else is refused. After 90 days both are deleted.
• And nothing at all is kept if you never started a paid plan. The 90 days exist to stop a free trial being minted on demand. If you never took one, there is nothing to protect against, and your handle is released the moment your account is deleted.
• The stored image files. They become unreachable immediately, as above, but erasing the underlying files from storage takes up to 90 days rather than happening in the same instant.
• A billing record held by Stripe — an email address and a customer reference, with no card — so that a refund or a card dispute raised in that window can still be answered. It is deleted after 90 days.

One thing is kept for longer, and it is not ours to erase: the invoices and payment records held by Stripe. Tax law requires that transaction records be retained for several years.

Posts already published to Instagram stay on Instagram. Deleting your account here does not remove them, and we have no way to. We would rather tell you all of this plainly than let you discover it.

12 · Age

This service markets alcohol. You must be of legal drinking age where you are to use it — 19 in Ontario, 18 or 19 elsewhere in Canada depending on the province, 21 in the United States.

Separately, and as a matter of privacy law: this is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 13, or under 16 in Quebec. If we learn that we have, we delete it.

13 · Where we operate

ShelfSocial is offered in Canada and the United States. It is not offered to shops in the European Economic Area, the United Kingdom or Switzerland, and we do not knowingly accept sign-ups from them.

14 · Changes and contact

We will give notice in the product before a material change takes effect.

Nisq Technologies Inc., 580 The East Mall, Toronto, ON M9B 4A7, Canada.

Privacy questions, and anything else, go to support@shelfsocial.ai. The terms of service sit alongside this.