Privacy Notice

Last updated: June 10, 2026

Shelfsnap is operated by Matthew Schmidt ("we", "us", "our"). This notice explains what personal data we collect when you use the Service, why we collect it, and the rights you have over it. For the personal data described here we act as the data controller.

1. Data we collect

Account data — name, email address, password hash, and authentication identifiers (e.g. Google sign-in ID).
Profile data — optional display name, avatar image, and preferences you set in Settings.
Content you create — photos you upload, AI-extracted list items, list titles, cover images, and notes.
Usage and telemetry — pages viewed, features used, errors encountered, approximate location derived from IP.
Device data — browser type and version, operating system, device identifiers, IP address.
Support messages — anything you send us through the support form or by email.

Payment card data is collected and processed by our payment provider Paddle, not by us — we only receive subscription status and customer identifiers.

2. Why we use it and our legal basis

Provide the Service (contract performance) — account creation, sign-in, list extraction, list storage and display.
Secure the Service (legitimate interests) — abuse and fraud prevention, rate limiting, audit logging.
Improve the Service (legitimate interests) — error monitoring, anonymized usage analytics, debugging.
Customer support (legitimate interests / contract).
Service announcements and product updates(legitimate interests; you can opt out in Settings).
Legal obligations — tax, accounting, lawful requests.

3. AI processing

When you upload a shelf photo, the image is sent to our AI provider through the Lovable AI Gateway to extract a list of items. Images and derived lists are stored in your account so you can revisit them. We do not use your photos to train third-party models.

4. Who we share data with

Hosting and infrastructure — Cloudflare, Supabase (database, auth, storage).
AI inference — Lovable AI Gateway and its underlying model providers, for the sole purpose of extracting list items.
Email delivery — Brevo, for transactional and account emails.
Merchant of Record — Paddle, for the sale of the product, subscription management, payments, tax compliance, and invoicing.
Professional advisers — legal, accounting, and similar advisers where necessary.
Authorities — where required by law or to protect rights, property, or safety.

Some of these providers are located outside the UK/EEA. Where personal data is transferred internationally we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

5. How long we keep data

We keep account and content data while your account is active. If you delete your account, we delete or anonymize associated personal data within 30 days, except where we are required by law to keep it longer (for example, invoicing and tax records typically kept for up to 7 years by Paddle).

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent. UK/EEA users have these rights under GDPR and the right to complain to a supervisory authority. We respond to verified requests within one month. Email privacy@shelfsnap.io to make a request.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, encryption at rest where supported by our providers, row-level access controls, audited admin access, and the principle of least privilege.

8. Cookies

We use only the cookies and similar storage strictly necessary to operate the Service — for example, your authenticated session and your sidebar/theme preferences. We do not use marketing or third-party advertising cookies.

9. Children

Shelfsnap is not directed to children under 13 (or under 16 in the UK/EEA). We do not knowingly collect personal data from children.

10. Changes

We may update this notice. Material changes will be announced in-app or by email. The "Last updated" date above always reflects the latest version.

11. Contact

Privacy questions: privacy@shelfsnap.io.