What happens to your recipe here

“Ingredients, quantities, processes, costs, suppliers and your production records are your confidential business information under section 3 of the Terms.” “Other workspaces and the public see only what you publish or send — a sell page shows ingredient names and allergens, never quantities or costs”.

It is kept in a database that the public key in every visitor’s browser cannot open: every table has row-level security on and grants that key nothing, and the same lockdown runs again after every change to the database. ShelfStep reaches your data only from its own server.

We “do not use your workspace content to train AI models, or let our AI providers do so”.

Delete a launch, or the whole workspace from the Account page, and it goes: “Deleted records are removed from the live database immediately.” The backups that still hold it are deleted on schedule, so “a deleted record is fully gone within 30 days”, unless a legal hold covers that record. A few records outlive a deletion on purpose, such as the record that you accepted the terms, and the policy names each one.

Read the policy, under “Retention”

ShelfStep keeps a list of every place it uses AI, 54 in all, and the build fails if a new one appears without being added to it. Of those, 47 sit beside a way to do the same job by hand; when the AI is unavailable, the feature says so in a sentence and the by-hand way is still there. The other 7 have nothing to fall back to because nothing depends on them: a launch plan written for your product, where without it you get ShelfStep’s standard plan; the advisor, whose every answer comes from pages you can open yourself; the concept picture of your product, where your own photo does the same job; two free demos on public pages and the narration on ShelfStep’s own videos.

A workspace admin can turn AI off under Account → AI features, and “from that moment nothing from that workspace is sent to Anthropic, OpenAI or Tavily — not by a feature someone presses and not by one that runs on its own — until an admin turns them back on”. Every step still works by hand; the few extras only the AI does are the ones named above.

While it is on, these AI companies may receive something from a workspace:

• Anthropic writes and reads text. It receives “the workspace content each feature works from”, which “for some includes your formula’s ingredients and amounts, or a recipe you paste or photograph”. “Anthropic deletes API inputs and outputs within 30 days unless it must keep them to enforce its usage policy or the law requires.”
• OpenAI draws pictures and handles voice. A concept picture is made from the product’s facts, and the recipe step’s picture from the names of the ingredients you type, “not your formula, your quantities, your costs, your notes, or anything about you”; a microphone recording is sent to be written down, and “If you dictate a recipe, that recording — amounts included — is what OpenAI receives.” “OpenAI may keep API data for up to 30 days to detect abuse, then deletes it.”
• Tavily searches the web for vendors and markets. It receives “the kind of vendor you asked for and your product’s name, the place you type to find markets together with your workspace’s state, or a vendor’s website address to read it”. The policy gives no deletion period for it: “Tavily says it may use search queries to improve its service, which is why nothing else is sent to it”.

Read the policy

These companies process data on ShelfStep’s behalf, only as needed to deliver the feature. It is the same list the privacy policy keeps, and “Before we add or replace a provider that handles workspace data, we update this list and email workspace admins at least 14 days ahead”.

• Supabase — database, authentication and file storage (AWS us-east-1).
• Vercel — hosting, server logs, and cookieless web analytics.
• Anthropic — AI features; receives the workspace content each feature works from.
• OpenAI — pictures and voice.
• Resend — sends outreach, order, briefing and account emails, and receives replies to outreach so they can be shown in your workspace.
• Stripe, LLC — payments and subscription management.
• USDA FoodData Central — public ingredient nutrition lookups.
• Tavily — web search for finding vendors and markets.
• Twilio — from September 30, 2026 — optional text reminders for team members who ask for them.
• Cloudflare (R2 storage) — holds a weekly copy of the database backup outside our main provider.
• Cloudflare (Turnstile) — checks that a person, not a script, is using the sign-in page, the free label check, picture and voicemail tools, Start free, the note box on a jar’s page, the claim form on a directory listing, and the question forms on a sell page.

Read the policy

Every day, ShelfStep’s server copies the whole database, compresses it and encrypts it before the copy is written anywhere. If the key that locks it is missing, no copy is made at all, never an unencrypted one. At least once a week the same encrypted file also goes to a second company, Cloudflare, so a failure at one provider cannot lose your records. Copies are deleted after 30 days.

Every night a check run from outside ShelfStep asks whether last night’s copy exists. The server that makes the copy holds only the key that locks it; the key that opens it is kept apart, never on the server.

Read the policy, under “Retention”

Every night a script run from outside ShelfStep tries what a stranger could try against shelfstep.com, holding only what a stranger can get, and a failure is reported to us. It checks that:

• the public key every visitor’s browser holds cannot read any table, or write to one;
• the file storage is private and cannot be uploaded to with that key;
• the security headers and the content security policy are in place;
• the sign-in page cannot be made to send you on to another site;
• no secret has slipped into the code your browser downloads.

An outside monitor checks every five minutes that shelfstep.com can reach its database and its file storage, and a second, independent watcher notices if that monitor itself goes quiet.

There is no public status page. If a security problem affects your workspace’s data, “we will email workspace admins without undue delay, and within 72 hours of confirming it”.

Read the policy, under “Security”

From the Terms: “ShelfStep is a planning, record-keeping and productivity tool. It is not a regulatory authority, a Process Authority, a laboratory, a lawyer, or an accountant. Regulatory paths, food-safety plans, nutrition estimates, label reviews and similar outputs are starting points that you must verify with the appropriate professional or agency before relying on them.”

And where ShelfStep lists funding: “ShelfStep does not lend money, and nobody on this list pays ShelfStep to be here.” Each funder there makes its own decision, and what the page shows “is what they publish, not an offer and not advice”.

What it does do, path by path, is on one page.

Read the Terms

About your data: privacy@shelfstep.com. A security problem: security@shelfstep.com.