Data Processing Terms

For personal data inside your workspace, you are the controller (the “business” under California law) and ShelfStep is your processor (“service provider”). ShelfStep is the controller for your own account data, billing, product usage and the emails it sends you about the service; the Privacy Policy covers those.

Only what the product does and you ask it to: store it, show it to your workspace members, use it to generate the AI guidance you request, send the emails you send, produce the printable records you print, and deliver the parts of an order the other party needs. Nothing else. In particular ShelfStep will not:

• sell it, share it for advertising, or use it for any purpose of its own;
• combine it with data from other workspaces, except to honour an opt-out that applies across ShelfStep (an address that unsubscribed from outreach);
• use it to train AI models, or allow its AI provider to.

Your instructions are the product’s features and the settings you choose. If ShelfStep ever cannot follow them, or believes an instruction breaks the law, it will tell you.

Names, company names, email addresses, roles and notes about business contacts; the text of emails sent and received through ShelfStep; inquiry and sample-request details submitted on your public sell page, including a ship-to address; order counterparties’ workspace names, contact emails and order details; and anything else you type or upload. Processing lasts as long as your workspace exists, plus the 30-day backup rotation described in the Privacy Policy.

ShelfStep uses these providers to run the service. Each is bound by its own data-processing terms and processes only what its role needs.

• Supabase — database, authentication, file storage (AWS us-east-1).
• Vercel — hosting, request logs, cookieless analytics.
• Anthropic — AI features, under commercial terms that prohibit training on your content.
• Resend — sending email and receiving replies to outreach.
• Stripe — subscription billing (your billing data, not workspace data).
• USDA FoodData Central and Tavily — receive ingredient names and product search terms only, never personal data.

If a provider is added or replaced, the Privacy Policy is updated and workspace admins are emailed at least 14 days ahead. If you object and no alternative works for you, you may delete your workspace and export first.

Anyone working on ShelfStep who can see workspace data is bound to keep it confidential. Data is encrypted in transit and at rest by the providers above; every workspace is scoped at the application layer and that scoping is checked automatically on every build; sign-in uses one-time links or Google, never stored passwords.

If someone whose details are in your workspace asks you for access, correction, deletion or a copy, the app lets you do all four yourself. If they write to ShelfStep instead, ShelfStep forwards the request to you and helps you complete it. If ShelfStep learns of a security incident affecting your workspace data, it notifies workspace admins by email without undue delay and within 72 hours of confirming it, with what is known and what is being done.

You confirm that you have a lawful basis to hold and email each contact you add or import, that you will honour their requests to stop, and that you will not upload lists you bought or scraped. You are responsible for the accuracy of what you enter and for the emails you choose to send.

Delete your workspace from the Account page at any time; export it first if you want a copy. Live data is removed immediately and backups age out within 30 days, except records ShelfStep must keep for billing and tax law, and the other party’s copy of any order you were part of, which keeps only the business details of the transaction.

Ask and ShelfStep will describe its security measures, its subprocessors’ certifications, and how the commitments above are met. Where a law you are subject to requires it, ShelfStep will cooperate with a reasonable audit, once a year, at your cost, with 30 days’ notice.

Questions about these terms: marcoksoe@gmail.com. See also the Terms of Service and Privacy Policy.