Privacy

1. Who we are

ShelfSocial is run by Nisq Technologies Inc., 580 The East Mall, Etobicoke, Toronto, ON M9B 4A7, Canada ("ShelfSocial", "we", "us"). We decide how your information is used, and we are responsible for it.

Our Privacy Officer is responsible for protecting your information. Contact: support@shelfsocial.ai.

ShelfSocial is offered to shops in the United States and Canada. This policy covers the ShelfSocial iPhone app, the web app and the shelfsocial.ai website.

2. What we collect

You give us

• Your sign-in email address.
• If you invite people to help with your shop: their email addresses and the role you give each (Editor or Viewer). We use no names.
• Your shop details: shop name, shop type, country and region, time zone, opening hours and holiday hours, hashtags, and the location line you type for captions.
• Your products: name, producer, vintage, size, category, price, stock and notes, and the label text read from a product photo.
• Photos you take or pick, and the images ShelfSocial makes from them.
• Your posts, stories, captions, alt text, campaigns and schedule.
• That you agreed to send your photos and details to our AI providers, and when.
• What you write to us when you email support.

From services you connect

• Google, if you sign in with Google: your Google account id and email address. Nothing else from your Google account is stored or used.
• Instagram, when you connect it: your Instagram account id and username, the permissions you gave, and an access token that lets us post for you. For each post we publish, its Instagram id and link.
• Apple, Stripe and RevenueCat, when you buy a plan: your plan, trial and renewal dates, and whether payments went through. We also keep your credit balance and history.

Automatically

• Team activity: if your shop has helpers, a note of who did what in it (for example, who made or posted an image), shown by email address.
• Technical records of what our servers did, such as sign-ins, image jobs and posts, with your account id (and, for posts, your Instagram username). They help us run and fix ShelfSocial.
• Small files that keep you signed in: cookies on the web and a secure token on your iPhone (see Cookies below).
• How shops use ShelfSocial. In the iPhone app and the web app we note which screens you open and a few buttons you tap (such as Sign in, Make it, Post now, Schedule and Start free trial). Our servers also note when your shop reaches certain steps: you sign up, choose your shop type, connect Instagram, start a trial or a plan, make an image, or schedule or publish a post. Once you're signed in, these notes carry your shop's account id, along with the shop type, the plan, whether you used the iPhone app or the web, and your device type, system and app version. We send them to a third-party analytics tool in the United States, to see where shops get stuck so we can fix it. They never include your email, name, Instagram account, photos, captions, product details or anything you type. We don't record your screen, and nothing is stored on your device for analytics. We keep them for up to 12 months.

3. What we don't collect

• Your name, phone number or home address.
• Your location from your device. You type your region and location line. A photo file can carry details from your phone, such as when and where it was taken; ShelfSocial doesn't use them.
• Your card details. They stay with Apple or Stripe.
• Screen recordings, crash reports, or anything you type.
• Contacts, messages, or anything else on your phone. The app asks for the camera and your photos only when you choose to use them.
• We don't track you across other companies' apps or websites, and we don't show ads.

4. How we use it

We use your information only to run ShelfSocial for you:

• to sign you in and keep your account secure;
• to make images and write captions from your photos and details;
• to save your shelf, posts and schedule, and to publish to your Instagram what you send or schedule;
• to manage your plan, trial and credits, and to stop the same shop from getting more than one free trial;
• to email you a sign-in link, a reminder the day before your free trial ends, and answers when you write to us;
• to email the people a shop owner invites, on the owner's behalf, with the invite and a link to join;
• to see which screens and steps shops use and where they get stuck, so we can improve ShelfSocial;
• to find and fix problems, and to prevent misuse;
• to meet our legal duties.

We don't sell your information, we don't use it for advertising, and we don't use your photos or content to train AI models. We don't send marketing emails.

5. Why we may use it

We use your information with your consent, which you give when you sign up and use ShelfSocial, and to provide the service you signed up for. We ask for your express consent in the app before we send your photos to AI providers for the first time. In a shop with helpers, each person who sends photos to AI agrees for themselves; one person's consent never counts for another.

We also use some information because the law requires it, or for reasonable business purposes you would expect, such as keeping ShelfSocial secure and stopping free-trial abuse.

You can withdraw your consent at any time by deleting your account or writing to support@shelfsocial.ai. Without it, we can't make images or run your account.

6. How AI is used

ShelfSocial uses AI models from other companies. Each time you make an image, read a product from a photo or write a caption, we send what that step needs to one of them:

• Images: your product photo and a short description of the look you chose.
• Captions and product reads: the product photo or the made image, with your shop name and type, product details and any holiday hours.
• Who we use: AI providers we use or may use include OpenAI, Google (Gemini), Anthropic (Claude), Amazon (Bedrock), Mistral AI, Black Forest Labs and Stability AI. Which one handles a request depends on the task and on availability. We may add or remove providers as ShelfSocial changes, and we update this list when we do.

We don't send your email address or payment details to AI providers. They process what we send to give us the result, under their terms for business customers:

• Your data: we use each provider's paid business service, and only providers whose business terms say they don't use what we send to train their models. Some keep it for a short time, such as up to 30 days, to detect misuse or when the law requires it.

A person always decides what is posted: nothing goes to Instagram until you post or schedule it. ShelfSocial makes no decisions about you with AI.

7. Who we share it with

We share information only with the companies that help us run ShelfSocial, only what each needs, and only to do that job for us:

• Amazon Web Services: hosting, storage, sign-in accounts and email.
• AI providers (see How AI is used): AI images, captions and product reads.
• Google: sign-in, if you choose Continue with Google.
• Meta (Instagram): publishing your posts and stories to your account.
• Stripe: web payments. It receives your email address and our account id for your shop.
• Apple and RevenueCat: iPhone payments. RevenueCat receives our account id for your shop and your App Store purchases from Apple.
• Third-party analytics tools: which screens you open, a few buttons you tap and the steps your shop completes, with your shop's account id only.
• Google: website visit statistics (Google Analytics), only if you accept cookies on shelfsocial.ai.

What you post on Instagram is public, or shown to whoever your Instagram settings allow. Meta handles it under its own privacy policy.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of our business, where the new owner must keep this policy's promises.

8. Where your information is stored

We store your information with Amazon Web Services in the United States (us-east-1, Virginia). AI providers, analytics tools, Meta, Stripe, Apple and RevenueCat may process it in the United States or other countries.

If you are in Canada, your information is stored and processed outside Canada, and the laws there may let courts or authorities access it. We pick providers that protect information under written terms.

9. Keeping and deleting your data

We keep your information while your account is open. You can delete your account at any time in the app (Store > Delete account).

When an account is closed, we keep its data for 90 days, then delete it. An account closes when you delete it (you are signed out at once and cannot sign back in) or when your plan ends because a payment was missed or you cancelled. A closed account whose plan ended can be reopened by paying again in those 90 days. During those 90 days nothing is posted from the account, and its Instagram access token is deleted when it closes.

Posts, products and photos you delete in the app leave the app at once; their stored copies go when the account's data is deleted. Posts already on Instagram stay there until you delete them in Instagram.

Teams: invites and activity

• An invited person's email address is kept until the invite is used or ends (it expires or the owner cancels it), and for 30 days after that. If they join, their email stays as a member of the shop for as long as they are one.
• Team activity (who did what in a shop) is kept for 12 months, then deleted. Only the shop's owner can see it.
• Usage notes (screens, taps and steps, see What we collect): up to 12 months. Website visit statistics: 14 months.
• When someone is removed from a shop, they lose access at once. Their past activity stays in the owner's record for the 12 months.

What we keep longer

• If your account had a free trial: a one-way code made from your sign-in email address and from the username of any Instagram account connected during it, with a note that the trial was used. It can't be turned back into your email or username. We keep it after deletion so a new account can't start a second free trial.
• Technical records, for up to 90 days.
• Backups, for up to 35 days, after which deleted data is gone from them too.
• Payment records held by Apple, Stripe and RevenueCat, which they keep under their own policies and the law (for example, tax records).

10. Security

We protect your information with reasonable safeguards: connections use HTTPS, data is encrypted at rest, your Instagram access token is encrypted with our own key, photos are kept private, and only people who need access to run ShelfSocial have it. ShelfSocial has no passwords to steal.

No system is perfectly secure. If a breach puts you at risk, we will tell you and the authorities as the law requires.

11. Your rights

You can ask to see, correct, download or delete your information. Most of it you can change or delete in the app. For anything else, email support@shelfsocial.ai. We will confirm who you are (usually by replying to your sign-in email) and answer within 30 days. It's free.

United States, including California

• Depending on your state, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws, you may have the right to know what we collect and why, to get a copy, to correct it, to delete it, and to opt out of its sale, "sharing" for targeted ads, or profiling.
• We don't sell or share your personal information, as those laws define it, and we haven't done so in the last 12 months. We don't use it for targeted advertising or profiling, and we don't collect sensitive personal information.
• The categories we collect are listed under What we collect: identifiers (email, account ids, Instagram username), commercial information (plan and purchases), your content (photos, products and posts) and technical records. We collect them from you, from services you connect, and automatically, for the purposes under How we use it, and share them only as described under Who we share it with.
• You can use an authorised agent to ask for you. If we turn down a request, you can appeal by replying to our answer; we will tell you the result and how to complain to your state's attorney general.
• We won't treat you differently for using these rights.

Canada, including Quebec

• Under Canada's federal privacy law (PIPEDA) and provincial laws, you can ask to access and correct your information and withdraw your consent.
• In Quebec (Law 25), you can also ask for your information in a structured, commonly used format, and ask us to stop sharing it. The person in charge of protecting personal information is our Privacy Officer: support@shelfsocial.ai.
• If you aren't happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

12. Children

ShelfSocial is for adults running a business. You must be 18 or older to use it. It is not meant for children, and we don't knowingly collect information from anyone under 18. If we learn that we have, we delete it.

13. Google user data

If you sign in with Google, we receive your Google account id and email address, and use them only to sign you in and to contact you about your account. We don't use them for ads, sell them, or let people read them except as needed for security, to follow the law, or with your permission.

ShelfSocial's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

You can remove ShelfSocial's access in your Google Account settings (Security > Your connections to third-party apps and services). That stops Google sign-in; it doesn't delete your ShelfSocial account.

14. Instagram data and how to delete it

When you connect Instagram, ShelfSocial asks only for permission to read your basic profile (account id and username) and to publish posts and stories. It does not read your followers, messages, insights or other posts. Your access token is encrypted and used only to publish what you send or schedule, and to keep the connection working.

To remove your Instagram data from ShelfSocial:

• Disconnect Instagram in the app (Store > Instagram > Disconnect Instagram). This deletes the access token and connection right away and pauses scheduled posts.
• Or delete your ShelfSocial account (Store > Delete account). Everything, including post links, is deleted 90 days later, as explained above.
• Or email support@shelfsocial.ai and we will delete it for you.
• You can also remove ShelfSocial in Instagram, under Settings > Website permissions > Apps and websites. Instagram doesn't tell us when you do, so also disconnect in the app or email us if you want our copy gone.

Posts already published stay on Instagram until you delete them there.

15. Cookies and similar technology

In the iPhone app and the web app we use only what is strictly needed to sign you in, and no cookies for analytics or advertising. The website uses analytics cookies only if you accept them.

• Web app: "__Host-ss_s" keeps you signed in (8 hours). "__Host-ss_pkce" protects Google sign-in (10 minutes). "__Host-ss_ml" checks that an email sign-in link is opened in the browser that asked for it (15 minutes).
• Sign-in page: Amazon Cognito, which runs our sign-in page, sets its own cookies to complete sign-in.
• iPhone app: no cookies. Your sign-in token and a note of your last Instagram connect attempt are kept in the iPhone's secure storage (Keychain).
• The shelfsocial.ai website uses Google Analytics cookies ("_ga", "_ga_…") only if you choose Accept. Your choice is remembered in your browser, and you can change it at any time with Cookie settings at the bottom of every page. If your browser sends Global Privacy Control, we treat it as No. The iPhone app and the web app use no analytics cookies and store nothing on your device for analytics.

16. Changes to this policy

We may update this policy. We will show the new date at the top. If a change matters, we will tell you by email or in the app before it applies, and ask for your consent again where the law requires.

17. Contact

Questions, requests or complaints: support@shelfsocial.ai.

Privacy Officer, Nisq Technologies Inc., 580 The East Mall, Etobicoke, Toronto, ON M9B 4A7, Canada.