Data Processing Terms

For personal data inside your workspace, you are the controller (the “business” under California law) and ShelfStep is your processor (“service provider”). ShelfStep is the controller for your own account data, billing, product usage and the emails it sends you about the service; the Privacy Policy covers those.

Only what the product does and you ask it to: store it, show it to your workspace members, use it to generate the AI guidance you request, send the emails you send, produce the printable records you print, and deliver the parts of an order the other party needs. Nothing else. In particular ShelfStep will not:

• sell it, share it for advertising, or use it for any purpose of its own;
• combine it with data from other workspaces, except to honour an opt-out that applies across ShelfStep (an address that unsubscribed from outreach);
• use it to train AI models, or allow its AI providers (Anthropic and OpenAI) to.

These limits apply to all of your workspace content, not only to personal data in it. Your recipes and formulas — ingredients, quantities, processes, costs and suppliers — and your production records are your confidential business information under section 3 of the Terms of Service.

Your instructions are the product’s features and the settings you choose. If ShelfStep ever cannot follow them, or believes an instruction breaks the law, it will tell you.

Names, company names, email addresses, roles and notes about business contacts; the text of emails sent and received through ShelfStep; inquiry and sample-request details submitted on your public sell page, including a ship-to address; order counterparties’ workspace names, contact emails and order details; and anything else you type or upload (“Customer Data”). Processing lasts as long as your workspace exists, plus the 30-day backup rotation described in the Privacy Policy, which covers the off-site copy too.

ShelfStep uses these providers to run the service. Each is bound by its own data-processing terms and processes only what its role needs.

• Supabase — database, authentication, file storage (AWS us-east-1). Their subprocessors
• Vercel — hosting, request logs, cookieless analytics. Their subprocessors
• Anthropic — AI features, under commercial terms that prohibit training on your content. Receives the workspace content a request needs, which for some features is a formula with quantities, an inbound reply, or a document the member hands it (lab or pH report, Process Authority letter, supplier invoice photo, label photo, recipe card). Their subprocessors
• OpenAI — generating an optional concept image of a product from its name, unit, one-line description, the workspace logo when one is uploaded, and up to three lines of the maker’s own label copy; writing down a member’s voice recording as text when they press a microphone button (the recording is not stored; the text is Customer Data); and reading ShelfStep’s own guided-step text aloud. A pictures request never includes the formula; a dictated recipe is sent as the recording the member made. Under OpenAI’s API terms the data is not used to train its models and abuse-monitoring logs are kept up to 30 days.
• Resend — sending email and receiving replies to outreach. Their subprocessors
• Stripe, LLC — subscription billing (your billing data, not workspace data). Their service providers
• USDA FoodData Central — receives ingredient names, one lookup at a time, for nutrition estimates. No amounts, costs or personal data.
• Tavily — receives the kind of vendor being looked for with a product name, the place a maker types to find markets together with the workspace’s state, or a candidate vendor’s website address. No ingredients, formula, notes or personal data.
• Twilio — from September 30, 2026 — optional text reminders. Receives the mobile number of a member who agreed by replying YES from that phone, and the text of each reminder (workspace name, that steps are due or an order is waiting). No formula, costs, customers or documents. Announced to workspace admins September 13, 2026. Their subprocessors
• Cloudflare (R2) — stores a weekly copy of the database backup, private and locked against changes, deleted on the same 30-day schedule as the main backup. Added September 13, 2026.
• Cloudflare (Turnstile) — the bot check on sign-in, the free picture and voicemail tools, and the question forms on a sell page. Receives the visitor’s IP address and browser details for that check, and no Customer Data. Added September 15, 2026.

If a provider is added or replaced, the Privacy Policy is updated and workspace admins are emailed at least 14 days ahead. If you object and no alternative works for you, you may delete your workspace and export first.

Anyone working on ShelfStep who can see workspace data is bound to keep it confidential. Data is encrypted in transit and at rest by the providers above; every workspace is scoped at the application layer and that scoping is checked automatically on every build; access is restricted at the database layer as well, so workspace data cannot be reached except through the application, and that restriction is verified automatically rather than assumed; sign-in uses Google, an emailed one-time link, or an email address and password, with any password stored hashed by Supabase Auth and never held by ShelfStep.

ShelfStep personnel do not access customer workspace content in the ordinary course. Technical access exists, because restoring a backup or repairing a damaged record requires it; it is used only to provide support you have requested, to investigate abuse or a security incident, or where the law requires it. Support that needs your content is given through a grant a workspace admin opens from the Account page: read-only, limited to 24 hours at most, revocable at any time, restricted to launches, lots, orders and activity (not formulas, costs or notes), with every access recorded and visible to the workspace. Direct database access outside a grant is reserved for emergencies such as restoring a backup or containing a security incident, and any such access to your workspace is reported to its admins. The same commitment appears in the Privacy Policy, in plainer words.

Security incidents. If ShelfStep becomes aware of unauthorised access to, or loss or disclosure of, your workspace data, it will notify your workspace admins by email without undue delay and in any case within 72 hours of confirming it, with what is known at that point: what happened, what data was involved, what ShelfStep has done, and what you may need to do. Updates follow as the picture fills in. ShelfStep will help you meet any notification duty of your own arising from the incident.

Demands from authorities or litigants. If ShelfStep receives a subpoena, warrant, court order or other demand for Customer Data, it will refer the requester to you where it can, disclose only what the law compels, and notify your workspace admins before disclosing unless the law prohibits it or an emergency involves risk of serious harm. It may object to a demand it believes is overbroad or unlawful.

Change of ownership. If ShelfStep LLC merges, is acquired or sells the service, these terms bind the successor for Customer Data already held.

If someone whose details are in your workspace asks you for access, correction, deletion or a copy, the app lets you do all four yourself. If they write to ShelfStep instead, ShelfStep forwards the request to you and helps you complete it. If ShelfStep learns of a security incident affecting your workspace data, it notifies workspace admins by email without undue delay and within 72 hours of confirming it, with what is known and what is being done.

You confirm that you have a lawful basis to hold and email each contact you add or import, that you will honour their requests to stop, and that you will not upload lists you bought or scraped. You are responsible for the accuracy of what you enter and for the emails you choose to send.

Delete your workspace from the Account page at any time; export it first if you want a copy. Live data is removed immediately and backups, including the off-site copy, age out within 30 days, except records ShelfStep must keep for billing and tax law, and the other party’s copy of any order you were part of, which keeps only the business details of the transaction.

Deleting an account also leaves four records standing, and the reason for each: a one-way note that the address has already used its free trial, so an offer meant once per person cannot be claimed again by deleting and starting over; the clickwrap record that the person accepted these terms (date, version, and the email it was accepted under — the IP address and browser string recorded with it are deleted), because ShelfStep would otherwise be asserting an agreement whose proof it destroyed; any email opt-out they made, because a suppression that disappeared on deletion would allow a later list to mail them again; and the person’s email on the record of AI outputs in a workspace they belonged to, because that record cannot be edited (next paragraph). In the rest of a workspace’s records the person’s name and email are replaced with “former member”, and a listing or program contact address that was theirs passes to another admin of that workspace. Guide mailing-list signups are deleted.

ShelfStep keeps a record of AI outputs produced in a workspace (the text, the model and the time) for up to three years for accountability; it is deleted with the workspace. Where ShelfStep receives or reasonably anticipates a legal claim or an official request, it may preserve the records relevant to it beyond a deletion instruction, for as long as the matter requires and for no other purpose, and tells the customer when a deletion is refused for that reason.

Ask and ShelfStep will describe its security measures, its subprocessors’ certifications, and how the commitments above are met. Where a law you are subject to requires it, ShelfStep will cooperate with a reasonable audit, once a year, at your cost, with 30 days’ notice.

Questions about these terms: legal@shelfstep.com. See also the Terms of Service and Privacy Policy.