Privacy Policy

This policy covers three kinds of people:

• Members — people who sign in to a ShelfStep workspace.
• Counterparties — other ShelfStep workspaces you buy from or sell to on the Market.
• Non-users — people who never sign in but whose details end up in a workspace: buyers who write to a maker through a public sell page, partners who reply to a maker’s outreach email, and contacts a maker adds or imports.

For non-user details inside a workspace, the maker who runs that workspace decides what to keep and is responsible for handling it lawfully; ShelfStep stores and processes it on their behalf. If your details are in a maker’s workspace and you want them corrected or removed, contact that maker, or email us and we will pass the request on and help.

Account: your name and email (from Google sign-in or the email you register with), your timezone (from your browser, so dates read correctly), and the workspaces you belong to. If your workspace turns on text reminders, the mobile number entered for you and whether you agreed by replying YES from that phone. If you use Continue with Google, Google gives us your name, email address and profile picture; we use the name and email to create and label your account and never use the picture. Our use of that data follows the Google API Services User Data Policy, including its Limited Use requirements.

Workspace content: whatever you enter — products, launch plans, formulas, costs, samples, contacts, notes, files, lots and deliveries, sales, complaints, listings, orders, payment terms, and outreach messages and their replies.

From non-users: when someone writes to a maker through a public sell page we store the name, company, email and message they typed, plus a ship-to address if they asked for a sample, in that maker’s workspace. When someone replies to an outreach email, the reply (sender, subject, and text) is stored in the maker’s workspace as part of that conversation. On arrival the reply’s text is also sent to our AI provider (Anthropic, listed below) to classify what it asks for — a sample, a price, a no — so the maker sees a one-line read beside it; the read is labeled as AI and the reply itself is never altered. Attachments on replies are not stored. When a shopper writes a note from a jar’s own page (the page the QR code on a label opens), we store the note and, if they give one, their email address, in that maker’s workspace as a note on that lot, and ring the maker’s notification bell; ShelfStep sends the shopper nothing.

The free checks: on the free label check, what a visitor pastes or photographs is sent to Anthropic (listed below) to be reviewed; ShelfStep keeps none of it, and Anthropic keeps it only as its entry below says. When a visitor presses Start free on a free check, what they typed there travels, signed, in a cookie for up to an hour, and lands once in the workspace they create. To limit how often one visitor can use the free checks, the jar page’s note box and the free picture and greeting pages, we count uses against a one-way hash of the visitor’s network address, never the address itself.

Documents and photos you hand to the AI: when you use a feature that reads a document — a lab or pH report, a Process Authority letter, a supplier invoice photo, a photo of a label, a recipe card — that file is sent to our AI provider (Anthropic) to be read back as text or numbers for you to check. We keep what it produced, not the file, unless you attach the file yourself.

Usage: page views and product events such as “launch created” or “tool used”, with coarse dimensions like plan or tool name. These are collected by Vercel Web Analytics without cookies and never include names, emails, or workspace content. When you create a workspace we also keep, on it, the campaign tag of the link that brought you (its utm_source and utm_campaign) and any invite, program or offer code you arrived with, so we can count which of our posts and partners bring makers. Never a name or an email: anything else in a link is dropped. For a new workspace’s first 24 hours, and only until its first step is done, we also record the page, the step and the name of the box last used (for example “batch size”), how long the page was open, and which of the companion’s standard sentences it showed — never what was typed in a box — and keep that for 30 days, to improve the first screens. Nothing is recorded for a viewer or in the demo. On any page, we count which of the companion’s standard sentences was shown, whether its link was followed, whether the page was left within 30 seconds, and whether More or Why was pressed — as daily totals per sentence only, never tied to a workspace or a person, and kept for 30 days — to learn which sentences help. For each member we keep the last page they were on, the last guided step and question they were on, when they were last in ShelfStep, and the language their pages were last shown in, so the companion can take them back to where they were; it is deleted with the member. Whoever runs ShelfStep sees, per workspace, what it paid, what its AI cost, and counts such as launches, lots and orders, on an operator page; never its content.

Billing: if you upgrade, Stripe, LLC collects your payment details. We never see your full card number; we store your Stripe customer id and subscription status.

Proof that you agreed to something: when you accept our terms, publish a listing, place an order, start a paid plan, or first use a regulatory AI tool, we record what you accepted, which version, when, and the IP address and browser you accepted it from. That record is what makes the agreement hold up. What you accepted, which version and when are kept, including after you delete your account (see Retention). The IP address and browser string on it are removed after 24 months, or when you delete your account if that comes first.

Guide mailing list: if you ask us to email you about a guide, we store your email address, which guide you asked from, and the IP address, browser and time of the request — the same proof-of-consent record, because it is what an email regulator asks for. Unsubscribing removes you from the list, and deleting your account deletes the signup outright.

Server logs: our hosting provider keeps short-lived request logs (IP address, browser, page) for security and debugging. Those are Vercel’s, on Vercel’s retention, and are separate from the two records above, which are ours and which we keep.

To run the service for your workspace, generate the AI guidance you ask for, send the emails you ask us to send (outreach, order notifications, payment reminders), deliver the daily briefing and other account emails to workspace admins, bill paid plans, keep the service secure, and improve the product. Improving the product uses the usage events above and counts across the service (how many launches or lots exist, which features are used) — never what a recipe contains, what anything costs, or who your buyers and suppliers are. We do not sell personal data, do not share it for advertising, and do not use your workspace content to train AI models, or let our AI providers do so.

Your recipes and formulas are confidential. Ingredients, quantities, processes, costs, suppliers and your production records are your confidential business information under section 3 of the Terms. Other workspaces and the public see only what you publish or send — a sell page shows ingredient names and allergens, never quantities or costs — and programs you join see names and counts, never your formula.

These providers process data on our behalf, only as needed to deliver the feature. Primary storage and processing is in the United States; some providers may transiently process data in other regions under standard contractual clauses. Each provider publishes its own list of the companies it relies on; the links go to those live lists.

• Supabase — database, authentication and file storage (AWS us-east-1). Subprocessors
• Vercel — hosting, server logs, and cookieless web analytics. Subprocessors
• Anthropic — AI features; receives the workspace content each feature works from. The advisor receives, with each question, the launch you are looking at — its steps, its ingredients and allergens, and counts of samples, orders, complaints and held lots — and a list of your other launches by name, plus the recent turns of that conversation; when a question needs more (costs, lots, sales, who has a sample, a buyer, a complaint, a supplier), it looks up only that. Other features receive what they need, which for some includes your formula’s ingredients and amounts, or a recipe you paste or photograph. All of it is sent under commercial API terms that do not use it to train their models. Anthropic deletes API inputs and outputs within 30 days unless it must keep them to enforce its usage policy or the law requires. Subprocessors
• OpenAI — pictures and voice. Pictures: generates concept pictures of a product, in your workspace and on the free “See your product” page. Receives the product’s name, what one unit is (for example “8 oz jar”), the one-line description typed, your workspace logo if you uploaded one (so the picture can carry it), and up to three lines of your own label copy — the product name, the net-contents line and one short line such as a “Contains” statement — so the mock-up reads like your label; not your formula, your quantities, your costs, your notes, or anything about you. In a workspace the picture is kept there and shown only to your team, unless you download it. On the free page the picture is not stored; we keep only a one-way hash of your network address, to limit how many free pictures one visitor can make. Since September 26, 2026, the recipe step also draws a picture of your ingredients as you list them: it receives the names of the ingredients you type, and a count where you counted whole ones (“2 garlics”) — never an amount in weight or volume, your method, your costs, or your product’s or business’s name — and the picture is kept with that launch, shown only to your team, and deleted with the launch. Voice: when you press a microphone button, that recording is sent to be written down as text, with your workspace’s product names so they are spelled right. If you dictate a recipe, that recording — amounts included — is what OpenAI receives. OpenAI may keep API data for up to 30 days to detect abuse, then deletes it. ShelfStep does not store the recording — only the text (on the market-day form, a recording made with no signal waits in your browser until it can be sent, and is removed once it has been), which you check before it is saved, and which is kept in our record of AI output like any other AI result. “Listen to this step” sends only ShelfStep’s own step text; that audio is kept so it can be replayed. The other read-alouds send the words on your screen, which can be your own: “Say it” reads the companion’s line, which can name your buyers and partners and a figure from your records; the hands-free walk and Practice the pitch read out a question and then read back the answer you gave. Their audio is not kept on our servers; your browser holds it until the tab is closed. On the free voicemail greeting page, the business name, hours and email you type are turned into speech; neither the words nor the audio are stored, and we keep only the same one-way hash to limit free greetings. OpenAI does not use data sent through its API to train its models unless a customer opts in, and we have not. Where ShelfStep’s own voice service is not available, the recipe and market-day microphones use your browser’s built-in speech recognition instead, and say so beside the button: your browser’s maker handles that recording (Chrome sends it to Google), and ShelfStep receives only the words you keep. While a workspace has turned its AI features off, no microphone is shown at all.
• Resend — sends outreach, order, briefing and account emails, and receives replies to outreach so they can be shown in your workspace. Subprocessors
• Stripe, LLC — payments and subscription management. Service providers
• USDA FoodData Central — public ingredient nutrition lookups. Receives each ingredient’s name, one lookup at a time; never amounts, costs or which product it belongs to.
• Tavily — web search for finding vendors and markets. Receives the kind of vendor you asked for and your product’s name, the place you type to find markets together with your workspace’s state, or a vendor’s website address to read it; not your formula, your costs, your notes, or anything else you wrote about the product. Tavily says it may use search queries to improve its service, which is why nothing else is sent to it — so do not put recipe details in a product’s name.
• Twilio — from September 30, 2026 — optional text reminders for team members who ask for them. ShelfStep never texts a number first: a team member texts JOIN from their own phone, gets the terms back, and nothing else is sent unless they reply YES. Replying STOP ends it immediately. Reminders arrive at most once a day, and only on a day when something is due; message and data rates may apply; replying HELP returns our support email and phone number. Twilio receives that mobile number and the text of each reminder — the workspace name, that steps are due or an order is waiting — never your formulas, costs, customers or documents. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Announced to workspace admins on September 13, 2026, as the notice below promises. Subprocessors
• Cloudflare (R2 storage) — holds a weekly copy of the database backup outside our main provider, so a failure at one company cannot lose your records. Private, locked against changes, and deleted on the same 30-day schedule as the main backup.
• Cloudflare (Turnstile) — checks that a person, not a script, is using the sign-in page, the free label check, picture and voicemail tools, Start free, the note box on a jar’s page, the claim form on a directory listing, and the question forms on a sell page. While one of those pages is open, Cloudflare receives your IP address and technical details about your browser and device, and tells ShelfStep only whether the check passed; ShelfStep keeps nothing from it. Turnstile privacy addendum

A workspace admin can turn ShelfStep’s AI features off under Account → AI features; from that moment nothing from that workspace is sent to Anthropic, OpenAI or Tavily — not by a feature someone presses and not by one that runs on its own — until an admin turns them back on, and AI output already recorded is kept as described under “What our AI features produced”.

Before we add or replace a provider that handles workspace data, we update this list and email workspace admins at least 14 days ahead, as the Data Processing Terms promise. Twilio is the first provider added under that promise: admins were emailed on September 13, 2026, it is listed above as taking effect September 30, 2026, and no text is sent before that date.

Whoever runs ShelfStep can see the list of workspaces and, for each one, its members’ names, email addresses and roles. That is how billing, support and abuse handling work. It does not include your workspace content — products, formulas, costs, contacts, files and orders are not on that screen. Anyone working on ShelfStep who can see any of this is bound to keep it confidential.

Nobody at ShelfStep reads your workspace content as a matter of course. We would rather be plain about the limits of that promise than let you assume a barrier that is not there: we run the database, so technical access to what is in it is possible, and it has to be — somebody has to be able to restore a backup or repair a record that has broken. What governs it is therefore a rule rather than a wall. We open your workspace content only when you ask for help that cannot be given without it, when we are investigating abuse or a security problem, or when the law requires it. Not out of curiosity, not to study how you use the product, and not to look at your formulas, your costs or your buyers.

Support access is yours to open. If you want us to look at something in your records, a workspace admin grants read-only access from the Account page for 1, 4 or 24 hours. It ends on its own, you can end it sooner, and it shows launches, lots, orders and recent activity — never formulas, costs or notes. Every time we look is recorded and listed on your Account page, and the first look under a grant rings your notification bell. Without a grant, nothing in the product shows us your content. Direct database access remains possible for an emergency such as restoring a backup or containing a security incident; if we ever use it on your workspace, we tell your admins what we did and why.

Your workspace members see everything in the workspace, including who logged which record.

The open internet sees a listing once you publish it: its public sell page shows the product, price, case pack, lead time, ingredients and allergens from your formula, your workspace name and location, your logo if you uploaded one, the shelf life and storage you recorded, whether your lots are lot-coded and backed by receiving records, the contact email you chose for the listing only if you turned on “print this email on the sell page” (off by default; the inquiry form relays messages to it), your other published listings, and a preview image when the link is shared. Anyone can send an inquiry or a sample request from that page. Unpublishing removes the page. Draft listings are visible only to your workspace.

Anyone you give a Record link to. If you turn on the buyer-facing Record for a product, its link (/r/…, and the same page as data) shows your maker name and location, the ingredient list and allergens you declared, whether lots are coded and how many, your receiving and pH or kill-step record counts, which ingredients are on the FDA traceability list, your mock-recall result, whether your FDA registration and licences are on file, and the date you attested to the listing. It never shows lot codes, prices, costs, receipts, holds or your address. Anyone with the link can open it; turning the Record off, or resetting the link, stops it.

A program you join sees your workspace name, counts and your ticks on that program’s requirements, and, if you agreed to it when you joined or later, how far your plan has got (the stage and how many steps are done) and the month of your first lot, your first fulfilled order and your last visit — never your formula, costs, prices, contacts, receipts, lot codes, documents, orders or messages. If the program runs a public catalogue page, your published listings and logo appear on it.

Anyone, if you turn on your maker page (Account, off by default): your workspace name, city and state, the story you write, your publicly listed products and their photos, the buyer quotes you published, and the day your first product was published, on your page and on the makers’ wall. Turning it off takes the page down from the next visit.

Anyone who scans the QR code on your label, if you put one on it: the jar’s page shows the product and who made it, the ingredients and allergens as declared, where it was made as the label says, how to store it, and, when the code on the jar is one of your lots, that lot’s made-on and best-by dates. Never a price, a buyer, a supplier or a cost.

A co-packer, lab or Process Authority you ask for a quote sees, through the link in your request, the packet: the product and pack, the volumes you expect (a co-packer only), the process as your Process Authority’s letter states it, the label, allergens, storage and shelf life, your state and where you make it today, and your recipe as shares of the batch and your Process Authority letter only if you ticked them. Never grams or costs.

A store you sold to sees, through the Order again link in its order emails, its last order — product, case size, cases and unit price — and can send it again.

Other ShelfStep workspaces see published listings on the Market. When an order is placed, buyer and seller each see the other’s workspace name, the order details, the contact email on the order, the lot code that shipped, payment terms, and payment status; those details appear on the invoice, packing slip, statement and order emails.

People you email from ShelfStep receive the message you wrote, from an address that routes replies back into your workspace.

Anyone with a link you create: share links show a read-only launch summary until you stop sharing; the calendar subscription link shows your dated steps, sample follow-ups, lot best-by dates and invoice due dates to any calendar app that has the link. Treat these links like passwords.

We use: a sign-in session (set by Supabase Auth, refreshed while you keep using ShelfStep and expired once you stop), ss_org to remember which workspace you are in (a year), ss_tz for your timezone (a year), ss_next to return you to the page you wanted after signing in (30 minutes), ss_terms to carry your agreement to these terms across a Google or emailed-link sign-up (15 minutes), ss_lang for the language you chose (a year), ss_market_place for the town you last searched for markets (a year), ss_redeem to carry an offer code through sign-up (an hour), ss_from and ss_utm to remember which of our pages, tagged links or codes brought you until you create a workspace (a week), ss_via to remember that you arrived from a maker’s sell or jar page carrying their invite code, and which page, until you create a workspace (a week), ss_handoff to carry what you typed into a free check to the workspace you create when you press Start free (an hour, used once), ss_launch_full to remember on this device which members asked to see a launch page in full (a year), ss_launch_chosen to remember which launch pages you opened on purpose during this visit (until you close the browser), and ss_demo while you use the demo workspace (a week). Your browser also holds small flags (dismissed tips, text size, the guide you last read) and, if you log a market day while offline, that day’s sales stay in your browser until it can send them. No advertising or cross-site tracking cookies.

Step videos. Some guided steps can show a video from YouTube, Vimeo or Loom. Nothing loads from those companies until you press play; from then on they receive your IP address and browser details under their own privacy policies. YouTube videos use its privacy-enhanced mode, and Vimeo videos its do-not-track setting.

Workspace data stays as long as the workspace exists. Deleted records are removed from the live database immediately. A daily backup of the database is kept for 30 days in private storage and then deleted, and the weekly off-site copy is deleted on the same 30-day schedule, so a deleted record is fully gone within 30 days — unless a legal hold (below) covers that record. If you delete your workspace or account we remove it immediately, keeping only what billing and tax law require (Stripe invoices) for as long as that law requires.

Five things outlive an account deletion, on purpose, and we would rather say so than have you find them: the record that you accepted our terms (the date, which version, and the email it was accepted under — the IP address and browser details recorded alongside it are deleted), which also covers any text-message agreement or STOP you sent; any email opt-out you made, because an opt-out that vanished would let a later list add you back; the other party’s copy of any order you were part of, which keeps only the business details of the transaction — the same carve-out as the DPA; and a one-way note that your email address has already used its free trial, so the same address cannot claim it again; and your email on the record of AI output shown in a workspace you belonged to (next paragraph), because that record cannot be edited. Everywhere else in those workspaces — uploads, payments, records you logged, program records and the like — your name and email become “former member”, and a listing or program contact address that was yours passes to another admin. A quote you left on another maker’s sell page keeps the name you wrote but not your email. Guide mailing-list signups are deleted outright.

What our AI features produced. We keep a record of each AI output shown in your workspace — the text, which model produced it, when, and which member asked — for up to three years, so that a question about something the AI said can be answered with what it actually said. It is deleted with your workspace, or after three years; deleting your own account does not change it. Deleting a launch also deletes the AI output recorded for a launch from the day this took effect — step drafts, document and recipe reads, label reviews, dictated text and the like; output recorded before then, and output not about one launch (the daily briefing, or an advisor question asked away from a launch), stays until your workspace is deleted or three years pass. The advisor separately keeps your recent conversation with it so follow-up questions make sense; a question about a launch and its answer stay in that conversation, even after the launch is deleted, until you start a new one (“New”) or the workspace is deleted. We do not keep the prompt itself, only a fingerprint of it.

Legal holds. If we receive a legal claim, a demand, or an official request, or reasonably expect one, we may preserve the records relevant to it — including records you ask us to delete — for as long as the matter requires, and we tell you when that stops a deletion. Preserved records are used for that matter and nothing else.

Demands for your data. If a government agency, court or other party demands workspace content from us, we send them to you where we can, disclose only what the law requires, and tell your workspace admins first unless the law forbids it or there is an emergency involving risk of serious harm. A private party in a lawsuit is asked to get it from you. Section 3 of the Terms says the same.

You can view and edit most of your data inside the app. From your Account page you can export your whole workspace as a file, delete the workspace, or delete your account yourself — deletions take effect immediately. If you signed in but never set up a workspace, or only have invitations or a name-only role, the page you land on after signing in has a Delete my sign-in option. Email us to correct something you can’t change yourself. If you are in a region with specific privacy rights (for example the EU/UK or California) we honor access, correction, deletion and portability requests, and we do not “sell” or “share” personal information as those terms are defined in California law. We answer within 30 days.

If you are outside the United States, using ShelfStep means your data is transferred to and processed primarily in the United States by the providers above, with any transient processing elsewhere covered by their standard contractual clauses.

Data is encrypted in transit and at rest by our providers. Every workspace’s data is scoped to that workspace at the application layer, and that scoping is checked automatically on every build. Access is restricted at the database layer as well, so workspace data cannot be reached except through the application. That restriction is enforced by the database itself and verified automatically, rather than taken on trust.

Sign-in is handled by Supabase Auth — Google, an emailed one-time link, or an email address and password. If you set a password, Supabase stores it hashed; ShelfStep never sees it or stores it.

If we discover a security problem affecting your workspace data, we will email workspace admins without undue delay, and within 72 hours of confirming it.

No system is perfectly secure. If you think something is wrong, or you have found a vulnerability, write to security@shelfstep.com and we will look at it properly. Reports made in good faith are welcome, and we will not pursue anyone for making one.

ShelfStep is for adults running food businesses: accounts are for people 18 or older, and the service is not directed at children. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

If this policy changes materially we email workspace admins at least 30 days before the change takes effect and note it here; a change never lets us use data we already hold in a way this version does not allow unless you agree to it. If ShelfStep changes hands, the new owner is bound by this policy for data already in ShelfStep. Updated September 13, 2026 (nothing already allowed was widened): recipes and formulas are named as confidential; what each AI provider receives and how long it keeps it is stated; Cloudflare is listed for the off-site backup copy; how we answer demands for your data is described; the age line now matches the Terms’ 18+ rule; and this 30-day notice replaces “for significant changes”. September 14, 2026: Twilio listed, effective September 30, 2026, following the September 13 notice to workspace admins. Also on September 14, after a review of the whole product: mobile numbers and the documents you hand to the AI are named in what we collect; the concept-picture entry now says it receives your logo and up to three lines of your label copy; the Record link and program catalogue are described; three more cookies and the offline market-day queue are listed; the trial note that outlives deletion is named; and the briefing is called daily, which is what it is. September 15, 2026 (nothing already allowed was widened): what the advisor receives is described exactly; step videos, and voice recordings kept offline on the market-day form, are described; the demo cookie’s lifetime is stated; and the Supabase and Vercel subprocessor links were updated after those pages moved. Also on September 15: what happens to your name and email in a workspace’s records when you delete your account is spelled out, including the AI output record that keeps it, and deleting a sign-in without a workspace is described. Also on September 15: Cloudflare Turnstile is listed, the check that a person is using sign-in, the free tools and the question forms on a sell page. September 17, 2026 (nothing already allowed was widened): what the advisor receives is narrowed to the launch you are looking at, with anything more looked up only when a question needs it. September 18, 2026 (nothing already allowed was widened): deleting a launch now deletes the AI output recorded for it, and the advisor’s conversation history is described. September 21, 2026 (nothing already allowed was widened; this narrows what we may do): the Twilio entry now states in the words US carriers require that we do not sell or share SMS opt-in data or personal information with third parties for marketing purposes — which was already true, and already said of personal data generally, and is now said of text opt-ins specifically. September 24, 2026 (nothing already allowed was widened): the Twilio entry now also states how often reminders arrive, that message and data rates may apply, and what HELP and STOP do — the three disclosures US carriers require a privacy policy to carry before a text campaign is approved. September 26, 2026: the campaign tag and code a new workspace arrived with are named in what we collect, and the two cookies that carry them to sign-up are listed (one of them, ss_from, was already set and is now named). Also on September 26 (this widens what one provider receives): the OpenAI entry now names the recipe step’s picture of your ingredients, which sends OpenAI the ingredient names you type and a count of whole ones, and never amounts, your method, costs or your product’s name. Also on September 26 (this adds to what we collect): for a new workspace’s first 24 hours, until its first step is done, the page, the step and the name of the box last used, how long the page was open and which of the companion’s standard sentences it showed are recorded and kept for 30 days, to improve the first screens — the names of the steps and boxes only, never a value or any text typed. Also on September 26 (nothing already allowed was widened; this narrows what we may do): a workspace admin can turn ShelfStep’s AI features off, and while they are off nothing from that workspace is sent to an AI provider. September 28, 2026 (this adds to what we collect): which of the companion’s standard sentences a page showed, whether its link was followed, whether the page was left within 30 seconds and whether More or Why was pressed are counted as daily totals per sentence, never tied to a workspace or a person and never anything typed or read, and kept for 30 days, to learn which sentences help. Also on September 28 (this adds to what we collect): the companion remembers, for each member, a few things about how they work, so it can say their product’s name and speak to their way of working — the names they gave their products and the kind they chose, what they pack in (jar, bottle, bag or pouch, ounces or grams, how many to a case), how often they used voice, typing, documents, Bring, More or Why in the last 30 days, whether they usually finish a step in one sitting, the hours of the day they usually open ShelfStep (no dates), and the offers they turned down. It is learned only from what they do in ShelfStep, never from an AI reading their work, never sent to an AI provider, and never kept for a viewer or the demo. Each member sees all of it, and can clear any of it or all of it, on Account under “What ShelfStep remembers about how you work”; it is deleted with the member or the workspace. The daily totals above also count an offer turned down for the third time. Also on September 28 (this adds to what we collect): some of the companion’s standard sentences can be said in two or three wordings, each written and approved in advance; which wording a page showed and whether its link was followed are counted as running totals per wording and per group of workspaces — the plan and the language — never tied to a workspace or a person and never anything typed or read, to learn which wording helps. No AI writes or chooses the wording, and a viewer and the demo always see the usual one. September 29, 2026 (this names what features shipped between September 23 and 28 already collect or send; nothing new is collected from today): a shopper’s note and email from a jar’s page; the free label check sending what a visitor pastes or photographs to Anthropic; the count kept against a one-way hash of a visitor’s network address; four more cookies (ss_via, ss_handoff, ss_launch_full, ss_launch_chosen); Turnstile on the free label check, Start free and a jar’s page; the read-alouds that send your own words and your buyers’ and partners’ names to OpenAI; what a program, the maker page and makers’ wall, a jar’s page, a quote request and the Order again link show; and the last page, step and visit kept per member, and the per-workspace counts the operator page shows. Also on September 29 (this names what was already so, and narrows it): where ShelfStep’s voice service is not available, the microphones use your browser’s own speech recognition, which your browser’s maker handles; with a workspace’s AI features off, no microphone is shown. Notice given late, September 29, 2026: the changes dated September 26 to 29 above took effect before we gave the 30 days’ notice this policy promises. We emailed that notice to workspace admins on September 29, 2026, and the 30 days run to October 29, 2026. Questions or requests: privacy@shelfstep.com. See also the Terms of Service.