Privacy Policy

1. Introduction

This Privacy Policy describes how ShelfPic ("we", "us", or "our") collects, uses, shares, retains, and protects your personal information when you visit shelfpic.com (the "Site") or use our AI e-commerce visual content platform and related services (the "Service").

ShelfPic is an online service operated by an independent developer, not a Delaware corporation. For purposes of applicable privacy laws, the ShelfPic operator generally determines why and how personal information is processed in connection with the consumer Service and therefore acts as the controller (or equivalent regulated business). We act as a processor or service provider for a customer only where that role is established by a separate written agreement and documented instructions; uploading content by itself does not automatically create that relationship.

This Privacy Policy is incorporated by reference into the Terms of Service. Capitalized terms used here without definition have the meanings given to them in the Terms of Service.

1.1 Who This Policy Covers

This Privacy Policy applies to:

• Visitors to the Site;
• Registered Users of the Service;
• Recipients of our marketing communications;
• Individuals who contact us through support, sales, or other channels.

It does not apply to:

• Third-party websites, applications, or services linked to or integrated with the Service. Each third party operates under its own privacy policy.
• Employer-provided ShelfPic Enterprise instances (if any), which are governed by a separate Data Processing Agreement with the employer.

1.2 Privacy Contact

You may contact us at [email protected] for any privacy-related inquiry, including exercise of your rights described in Section 10. This is our privacy contact address and is not a representation that ShelfPic has appointed a statutory Data Protection Officer.

2. Information We Collect

We collect personal information in three ways:

1. Information you provide directly;
2. Information we collect automatically when you interact with the Service;
3. Information we receive from third-party sources (e.g., OAuth providers, payment processors).

2.1 Information You Provide Directly

(a) Account Information. When you register an Account, we collect:

• Your email address (always required);
• Your display name (optional);
• Your password hash (we never store plaintext passwords; passwords are hashed with industry-standard algorithms);
• Your OAuth profile data when you sign in with a third-party provider (for example Google or GitHub OAuth: email, name, profile picture URL, and stable provider identifier);
• Your profile image URL (optional);
• Your language preference and interface theme.

(b) Subscription and Billing Information. When you subscribe or purchase a Credit Pack, our payment processors (currently configured to support Creem, Stripe, and PayPal, depending on checkout availability) collect payment information directly. We do not store full card numbers, expiry dates, or CVV/CVC codes on our servers. We may receive and store from the payment processor:

• A reference to your customer record (processor customer ID);
• A reference to your subscription, order, checkout session, invoice, or payment;
• The Plan and currency you selected;
• A token or display reference representing your payment method for renewal or receipt purposes (we cannot derive card details from this token);
• Receipt and invoice metadata (date, amount, last 4 digits of payment card for display only);
• Billing country (for tax determination).

(c) Uploaded Content and AI Request Data. When you use an AI feature, we may receive and process the prompt and system instructions, images, video, audio, brand assets, reference media or URLs you provide, generation settings and parameters, selected feature or model, task and provider identifiers, generated outputs, and safety, usage, error, and diagnostic metadata. Uploaded and generated media is stored as described in Section 2.4.

(d) Communications. When you contact us via support, sales, or feedback channels, we receive:

• The content of your messages;
• Your email address and any other contact information you provide;
• Diagnostic information you choose to share (screenshots, error codes, generation IDs).

(e) Promotional and Survey Responses. When you respond to surveys, participate in beta programs, or interact with promotional features, we collect the information you choose to provide.

2.2 Information We Collect Automatically

When you interact with the Service, our systems automatically collect certain technical and usage information.

(a) Network Identifiers.

• IP address. We log the IP address of each request to the Site and Service, stored in the user table (last-known IP) and in the session table (per-session IP). IP addresses are used for security (fraud detection, account abuse detection, geographic compliance), legal compliance, and aggregate analytics.
• User-Agent string. The browser and operating system identifier sent by your client. Stored in the session table.
• Approximate location. We may derive a city- or country-level location from your IP address for billing tax determination, fraud signals, and language defaults. We do not collect precise GPS or device-precise location.

(b) Device and Browser Information.

• Browser type, version, and language;
• Operating system;
• Screen resolution and viewport size;
• Device type (desktop, mobile, tablet);
• Time zone offset;
• Referring page URL.

(c) Usage Data.

• Pages and screens you visit within the Site and Service;
• Time spent on each page, scroll depth, click patterns (aggregated into product analytics events);
• Generation requests: scene type, model selected, resolution, duration, success/failure status, error code if any, latency;
• Credit transactions: timestamp, bucket, debit/credit amount, reason code;
• Subscription events: plan change, renewal, cancellation, payment failure;
• Tool usage telemetry: which tools (AI Reshoot, Product Shorts, etc.) you use and how often.

(d) Cookies and Similar Technologies. See Section 7 and our Cookie Policy for the full list of cookies and the categories we use.

(e) Diagnostics and Error Reports. When the Service encounters an error, we may collect a stack trace, error code, and minimal context to diagnose and resolve the issue. We make a reasonable effort to scrub diagnostics of personal information before storage.

2.3 Information from Third Parties

(a) OAuth Providers. When you choose to sign in with Google, GitHub, or another OAuth provider we make available, that provider shares with us the data scopes you authorize, typically: email, name, profile picture URL, and a stable user identifier. We do not receive your provider password.

(b) Payment Processors. We receive transaction records, customer references, metadata, and webhook events from payment processors such as Creem, Stripe, and PayPal about checkout status, subscription status, renewal outcomes, refunds, chargebacks, and payment failures.

(c) AI Providers. FAL may return generated media, task status, usage, error, and diagnostic information for media-processing requests. OpenRouter may return the response produced by a routed model together with model, token-usage, status, and diagnostic metadata. Other third-party media-inference providers we engage for specific operations (for example, background removal, upscaling, image or video generation) may return the same categories of data — generated media, task status, usage, error, and diagnostic information. We do not receive personal information from AI Providers about other users.

(d) Analytics, Ads, Affiliate, and Customer-Support Providers. If you have consented to non-essential cookies or similar technologies, we may receive analytics, advertising conversion, affiliate attribution, and support-chat signals from providers configured for the Site, such as Vercel Analytics, Google Analytics, Microsoft Clarity, Plausible, OpenPanel, Google AdSense, Affonso, PromoteKit, Crisp, and Tawk.

(e) Anti-Fraud and Security Providers. We may receive risk signals from Cloudflare (bot management, DDoS protection) about the IP address or session attempting to access the Service.

2.4 Uploaded Content and Generated Content

We store the following in Cloudflare R2 or other configured S3-compatible object storage:

• Your Uploaded Content (product images, reference images, videos, audio, prompt attachments, and brand assets);
• Your Generated Content (AI-produced images, videos, audio, music, and related outputs);
• Intermediate processing artifacts (resized variants, thumbnails) required for delivery.

We store associated metadata in our PostgreSQL database (Supabase), including:

• File name, size, MIME type, dimensions;
• Upload timestamp and generation timestamp;
• Generation parameters (prompt text, model, resolution, duration, scene type, reference media URLs, and feature options);
• Foreign keys linking the asset to your Account and to the generation task;
• Storage path or delivery URL in object storage or, where copying to our storage fails or is not available, the AI Provider-hosted output URL.

Uploaded Content and Generated Content are scoped per Account in the Service UI and are not intentionally listed to other users (other than via explicit sharing features, when available). Some media may be delivered through public or provider-hosted URLs with unguessable paths so AI Providers, browsers, and download tools can retrieve them. You should treat those URLs as sensitive and avoid sharing them unless you intend the recipient to access the media.

3. Legal Basis for Processing (GDPR)

For Users in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on one or more of the following legal bases under GDPR Article 6(1):

3.1 Contractual Necessity (Art. 6(1)(b))

We process your data when necessary to perform the contract you entered into by accepting the Terms of Service, including:

• Creating and maintaining your Account;
• Fulfilling generation requests;
• Charging subscription fees and processing one-time credit purchases;
• Providing customer support related to the Service;
• Sending transactional emails (e.g., receipts, payment failures, password resets, verification emails, and account notices).

3.2 Legitimate Interests (Art. 6(1)(f))

We rely on legitimate interest for processing where the interest is not overridden by your fundamental rights, including:

• Service security and abuse prevention: detecting fraud, multi-account abuse, and rate-limit circumvention;
• Service improvement: aggregated, non-identifying analytics on feature usage and performance;
• Direct marketing to existing customers: limited product-update emails sent to active subscribers, where allowed under applicable law;
• Defending and exercising legal claims.

You may object to legitimate-interest processing under Section 10.

3.3 Consent (Art. 6(1)(a))

We rely on consent for:

• Non-essential cookies (analytics, ads, affiliate attribution, support chat, performance, and future marketing — see Cookie Policy);
• Marketing communications that are not strictly necessary for the contract;
• Optional features that involve additional data sharing (where presented to you with explicit opt-in).

You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

3.4 Legal Obligation (Art. 6(1)(c))

We process your data to comply with legal obligations, including:

• Retaining billing records under U.S. and EU tax law;
• Responding to lawful requests from public authorities, including law enforcement;
• Complying with sanctions and export-control regimes;
• Fulfilling mandatory reporting obligations (e.g., NCMEC reporting of CSAM under 18 U.S.C. § 2258A).

3.5 Vital Interests (Art. 6(1)(d))

In rare circumstances, we may process personal data to protect vital interests, for example to report imminent threats to life or safety to authorities.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

4.1 To Provide and Operate the Service

• Authenticate Account access (better-auth session, OAuth handoff);
• Display your Uploaded Content, Generated Content, AI chat history, and asset library to you;
• Route generation requests to AI Providers;
• Track and update your credit balance and Plan status;
• Deliver in-app notifications;
• Allow asset library export.

4.2 To Bill and Manage Subscriptions

• Initiate Plan purchases and Credit Pack orders through configured payment processors;
• Process renewals on the subscription cycle;
• Handle Plan upgrades, downgrades, and cancellations;
• Issue receipts and invoices;
• Calculate and collect applicable taxes.

4.3 To Communicate With You

• Send transactional messages (receipts, payment failures, security alerts, terms changes);
• Respond to support requests;
• Send product updates and announcements (where you have consented or where allowed under applicable law for existing customers);
• Notify you of new features that may be relevant to your Plan.

4.4 To Improve the Service

• Aggregated analytics on feature usage, error rates, chat usage, and Generation outcomes;
• A/B testing of UI variations (subject to consent where required);
• Roadmap and prioritization decisions based on aggregated user behavior.

4.5 To Maintain Safety and Security

• Detect and prevent fraud, automated abuse, and Account compromise;
• Investigate violations of the Acceptable Use Policy;
• Comply with legal process and respond to government requests;
• Defend against legal claims.

4.6 To Comply With Legal Obligations

• Retain billing records as required by tax law;
• Respond to subpoenas, court orders, and other legal process;
• Report illegal content (e.g., CSAM) to NCMEC and equivalent authorities.

4.7 No Automated Solely-Legal-Effects Decisions

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing within the meaning of GDPR Article 22. AI content moderation that determines whether to allow a generation is a safety control, not a decision producing such effects. If we introduce any such automated decision-making in the future, we will provide additional transparency, safeguards, and your right to contest the decision per Section 13.

5. Sharing and Sub-processors

We share your personal information only with the parties listed below, and only for the purposes described. We do not sell your personal information for money. Where advertising, analytics, or affiliate technologies are enabled and could be treated as "sharing" for cross-context behavioral advertising under CCPA/CPRA, we treat them as non-essential technologies and do not load them unless you accept non-essential cookies. We also honor Global Privacy Control as described in Section 16.

5.1 Sub-processors

The following Sub-processors process your personal information on our behalf, depending on the features and providers enabled for your Account or for the Site. Where applicable, we seek to enter into data processing terms, including standard contractual clauses (SCCs) for international transfers.

We will update this table as Sub-processors are added or changed. Material changes are announced at least thirty (30) days in advance via this Privacy Policy and, where reasonable, by in-product notice.

5.2 AI Providers and Training

We do not intentionally use your Uploaded Content or Generated Content to train a ShelfPic-owned foundation model unless we present a separate, explicit opt-in. ShelfPic does not, however, promise that every third-party model provider follows the same retention or training rules.

FAL processes media requests under its Terms of Service and Privacy Policy. Its terms permit it to use service-usage data—which may be derived from customer inputs but is not described as consisting of the customer input itself—to operate, improve, and develop its services and AI models.

OpenRouter states that it does not retain prompt and response content by default unless logging or data-use options are enabled, while request metadata such as model, token counts, latency, and status may be retained. OpenRouter routes requests to underlying model providers, whose retention and training rules vary and may apply to the inputs and outputs they receive. See OpenRouter's Privacy Policy and provider data-policy documentation. We do not claim that Zero Data Retention, no-training, or equivalent controls are enabled unless we actually configure and verify them.

If a provider's posture or our configuration changes in a way that materially affects user data, we will update this Privacy Policy and notify you under Section 14.

5.3 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, your personal information may be transferred as part of the transaction. We will require any successor entity to honor the commitments in this Privacy Policy, and we will notify you of any material change in data control.

5.4 Legal Compliance and Safety

We may disclose your personal information without your consent where we believe in good faith that disclosure is necessary to:

• Comply with applicable law, court order, subpoena, or legal process;
• Cooperate with law enforcement investigations;
• Enforce the Terms of Service;
• Protect the rights, property, safety, or security of ShelfPic, our Users, or the public;
• Detect, prevent, or address fraud, security, or technical issues;
• Report content as required by law (e.g., CSAM reports to NCMEC).

5.5 With Your Consent

We may share your personal information for any other purpose with your prior consent.

5.6 Aggregated, De-identified Information

We may share aggregated, de-identified information (data that cannot reasonably be re-identified) with anyone, for any purpose, including for benchmarking, research, marketing, or industry reporting.

6. International Data Transfers

Our service providers operate in the United States and other countries and may use global edge networks. Accordingly, personal information may be transferred to and processed in the United States and other countries outside the place where you live.

6.1 Legal Mechanisms for EU/UK/Swiss Transfers

For transfers from the European Economic Area, the United Kingdom, or Switzerland to the United States or other third countries, we use the transfer mechanism applicable to the relevant provider and processing activity, where required. These may include:

• An applicable adequacy decision or certification framework;
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• The UK Addendum, UK International Data Transfer Agreement (IDTA), or Swiss adaptations, where applicable; and
• Available technical and organizational safeguards, such as encryption and access controls.

The safeguards and contractual terms available can vary by provider and service tier. We do not claim contractual training opt-outs or audit rights that have not actually been obtained.

We continue to monitor evolving guidance on transatlantic data transfers (e.g., the EU-US Data Privacy Framework) and will update our transfer mechanisms accordingly.

6.2 Transfer Impact Assessment

Where required by GDPR and supervisory-authority guidance, we will evaluate the destination, processing activity, provider safeguards, and practical risk of government access and will take additional measures where reasonably available.

6.3 Data Localization

We do not currently offer data residency in regions other than where our Sub-processors operate. If your jurisdiction requires local data residency for the categories of data you intend to upload, you should evaluate whether the Service is compatible with your obligations before subscribing.

7. Cookies and Similar Technologies

We use cookies, web storage, and similar technologies as described in our Cookie Policy. Categories include:

• Strictly Necessary cookies (e.g., authentication session, CSRF token, locale preference) — used without consent because the Service cannot function without them;
• Functional cookies (e.g., theme preference, banner dismissal) — used without consent;
• Analytics cookies (Vercel Insights and similar) — non-essential; in the EEA, the UK, and Switzerland (or where your region cannot be determined) they are not loaded unless you accept non-essential cookies, and in other regions they may load automatically unless you opt out;
• Affiliate, advertising, and marketing technologies — treated as non-essential, with the same region-based loading as analytics cookies above.

See Cookie Policy for details and instructions on managing cookie preferences.

8. Data Retention

We retain personal information only as long as necessary for the purposes set out in this Privacy Policy, subject to specific retention rules below. Where multiple rules apply, we retain to the longest applicable period.

8.1 Account Data

• Active Account: retained for the lifetime of the Account.
• Deleted Account: account deletion is requested from the settings dashboard or by emailing [email protected] (see Section 11.2 of the Terms of Service) and is processed within thirty (30) days of identity verification. Deletion is irreversible once processed: your account record and associated personal information are removed from production systems, and we cannot restore a deleted Account or its content. You should export any content you wish to keep before deleting your Account. Residual copies in backups are purged within ninety (90) days of deletion; backups are not used for any purpose other than restoration in case of catastrophic loss. Billing records are retained separately as described in Section 8.5.

8.2 Uploaded Content

• User-initiated deletion: removed from production storage within seven (7) days, removed from backups within ninety (90) days.
• Inactive content (not accessed within the Plan's storage window): subject to automatic cleanup at the end of the storage window with at least seven (7) days' advance email notice.
• Account deletion: removed in the same window as account data (Section 8.1).

8.3 Generated Content

• Same retention as Uploaded Content (Section 8.2). Generated Content is treated as an output bound to the user who initiated it.
• Copies handled by AI Providers follow their own controls and retention periods.
  • FAL: Under its published defaults, request payloads may be stored for 30 days unless a no-storage control is applied; generated media is served through public URLs and follows the configured object-lifecycle setting, whose account default may allow indefinite availability. See FAL's request-storage documentation and media-retention documentation.
  • OpenRouter: OpenRouter states that it does not retain prompt and response content by default unless logging or data-use options are enabled, but it retains request metadata, and an underlying model provider may apply a different policy. See OpenRouter's data-collection documentation and provider-logging documentation.

Provider behavior can vary by model, account setting, integration method, and future policy.

8.4 Usage Logs and Telemetry

• Application logs (requests, errors, latency, upload metadata, provider task IDs, media URLs, and limited prompt or option context where needed to debug a generation): retained for ninety (90) days for security, debugging, and abuse prevention.
• Security logs (authentication events, suspected fraud signals): retained for one (1) year.
• Anonymized aggregate analytics: retained indefinitely in aggregated, non-identifying form.

8.5 Billing Records

• Invoices and tax records: retained for the period required by applicable tax, accounting, payment, and dispute-resolution laws, which may be up to seven (7) years or longer where legally required.
• Payment method tokens: retained as long as the subscription is active or until you delete the payment method.

8.6 Communications

• Support tickets and emails: retained for three (3) years after resolution for quality, compliance, and recurrence prevention.
• Marketing email logs: retained for the duration of your consent and two (2) years thereafter for compliance recordkeeping (CAN-SPAM, GDPR Art. 7(1) accountability).

8.7 Anti-Fraud and Sanctions Records

• Records that contributed to a determination of fraud, sanctions match, or AUP violation: retained for five (5) years for compliance defense.

8.8 Legal Holds

If we receive a legal preservation order or anticipate litigation, we may extend retention beyond the periods above as required by law.

9. Security

We take the security of your personal information seriously and apply industry-standard technical and organizational measures.

9.1 Technical Measures

• Encryption in transit: all traffic to and from the Service is encrypted with TLS 1.2 or higher.
• Encryption at rest: Supabase encrypts all data at rest using AES-256; Cloudflare R2 encrypts at rest using AES-256.
• Password hashing: passwords are hashed using industry-standard algorithms (Argon2-family or equivalent) before storage.
• Token-based authentication: sessions use server-side tokens with secure, HTTP-only, SameSite cookies.
• Object storage isolation: each user's Uploaded Content and Generated Content is stored under per-Account paths in our application records. Delivery may use public or provider-hosted URLs with unguessable paths where required for browser downloads or AI Provider processing; access to the asset library UI remains Account-gated.
• Rate limiting and abuse detection: applied at edge (Cloudflare) and application layers.

9.2 Organizational Measures

• Least-privilege access: production data access is restricted to personnel whose role requires it.
• Access logging: privileged access to production systems is logged.
• Regular security review: quarterly security review of access controls, dependency vulnerabilities, and incident records.
• Vendor due diligence: Sub-processors are evaluated for security posture before adoption.
• Incident response plan: documented internal plan for triage, containment, eradication, recovery, and notification of security incidents.

9.3 Your Responsibility

Even with strong technical and organizational measures, no system is invulnerable. You play a critical role in security:

• Choose a strong, unique password for your Account;
• Use a password manager;
• Enable two-factor authentication when available;
• Do not share credentials with anyone;
• Notify us at [email protected] of any suspicious activity.

10. Your Rights

Depending on your jurisdiction, you have specific rights regarding your personal information. We honor recognized data-subject rights globally, on a best-effort basis where not strictly required by law.

10.1 Rights for EU/UK/Swiss Residents (GDPR)

You have the following rights under GDPR Articles 13-22:

• Right of access (Art. 15): confirm whether we process your personal data and obtain a copy.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): request deletion in defined circumstances.
• Right to restriction of processing (Art. 18): limit processing in defined circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests, direct marketing, or research/statistical purposes.
• Right to withdraw consent (Art. 7(3)): withdraw consent for processing previously based on consent.
• Right not to be subject to automated decision-making (Art. 22): not be subject to a decision based solely on automated processing producing legal or similarly significant effects (see Section 4.7).
• Right to lodge a complaint with a supervisory authority (Art. 77): file a complaint with the data protection authority in your country of residence, place of work, or place of alleged infringement.

10.2 Rights for California Residents (CCPA/CPRA)

You have the following rights under the CCPA and CPRA:

• Right to know: what categories of personal information we have collected about you, the categories of sources, the categories of third parties to whom we have disclosed personal information, the business or commercial purpose for collecting and sharing, and the specific pieces of personal information we have collected.
• Right to delete: request deletion of your personal information, subject to statutory exceptions (e.g., to complete a transaction, to detect security incidents, to comply with legal obligations).
• Right to correct: request correction of inaccurate personal information.
• Right to opt-out of sale or share: we do not sell personal information, and we do not share personal information for cross-context behavioral advertising as defined under CPRA, so there is currently nothing to opt out of. If our practice changes, we will provide a "Do Not Sell or Share My Personal Information" link and otherwise comply.
• Right to limit use of sensitive personal information: we limit our use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination: we will not discriminate against you for exercising these rights — we will not deny service, charge different prices, or provide a different level of quality of service.

10.3 Rights for Other Jurisdictions

Where similar rights are available under the laws of your jurisdiction (e.g., PIPEDA in Canada, LGPD in Brazil, POPIA in South Africa, PDPA in Singapore, Australia Privacy Act, China PIPL, UAE Personal Data Protection Law), we honor those rights to the extent required by law and apply best-effort equivalence where not strictly required.

10.4 How to Exercise Your Rights

To exercise any of the rights above:

• Email [email protected] with the subject line "Privacy Rights Request" and the right you wish to exercise;
• For California residents, you may also submit requests to the same email and we will treat the request under CCPA/CPRA;
• We may require you to verify your identity before fulfilling the request (typically by confirming control of the registered email or completing a brief identity-verification flow). Verification ensures that we do not disclose your data to an impersonator.

10.5 Response Time

• GDPR requests: we respond within one (1) month of receipt; we may extend by two further months for complex requests, with notice to you.
• CCPA/CPRA requests: we respond within forty-five (45) days of receipt; we may extend by forty-five further days when reasonably necessary, with notice to you.
• Other jurisdictions: we respond within the period required by applicable law, or, where no specific period is mandated, within forty-five (45) days.

10.6 Authorized Agents

You may authorize an agent to make requests on your behalf. We require:

• A signed permission from you, or a power of attorney; and
• Verification of your identity, as described in Section 10.4.

We may deny requests submitted by an agent that cannot provide such authorization.

10.7 No Fee for Standard Requests

We do not charge a fee for fulfilling standard rights requests. We may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive, particularly if it is repetitive, in accordance with GDPR Article 12(5) and equivalent provisions.

11. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction, if higher — for example, 16 in some EU member states). We do not knowingly collect personal information from children under the age of 13.

If you are a parent or legal guardian and you believe a child under 13 has provided personal information to us, please contact [email protected] and we will take steps to delete the information from our systems.

11.1 COPPA Compliance

We comply with the United States Children's Online Privacy Protection Act ("COPPA"). If we learn that we have collected personal information from a child under 13 in the United States without verifiable parental consent, we will delete that information promptly.

11.2 Age Gate

Account registration includes a representation that you are at least 18 years of age, consistent with the Terms of Service. We do not provide a separate child-account flow.

12. Data Breach Notification

We have implemented an incident response plan to detect, contain, investigate, and remediate security incidents involving personal information.

12.1 Authority Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Where notification cannot be made within 72 hours, we will document the reasons for the delay.

12.2 Affected Individuals

Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR Article 34. Notification will be made by email to the address on file with your Account.

In the United States and other jurisdictions, we will provide notification consistent with applicable breach notification laws (e.g., state-specific laws in the U.S., the FTC Health Breach Notification Rule where applicable).

12.3 Information We Will Provide

Breach notifications will include, to the extent known and required by law:

• The nature of the breach, including categories and approximate number of data subjects and records affected;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and mitigate its possible adverse effects;
• Contact information for further inquiries (typically our privacy contact email).

12.4 Records

We maintain internal records of all personal data breaches, including those not requiring authority or individual notification, to demonstrate compliance and improve incident response.

13. Automated Decision-Making and Profiling

As stated in Section 4.7, we do not subject you to decisions producing legal or similarly significant effects based solely on automated processing.

13.1 Content Moderation

We use a combination of application checks, AI Provider safety systems, abuse signals, and manual review to help enforce our Acceptable Use Policy. Not every upload is pre-screened before storage, and provider-side safety systems may block or refuse a generation before output is produced. A positive trigger may block a specific generation but does not, by itself, terminate your Account. Repeated or serious violations are reviewed before Account-level action is taken where feasible (see Section 11 of the Terms of Service and the enforcement process in the Acceptable Use Policy).

13.2 Fraud Detection

We use automated signals (IP reputation, multi-account heuristics, payment-card velocity) to flag suspected fraud. Confirmed determinations that result in Account suspension or termination are reviewed by a human and are subject to your right to appeal (email [email protected]).

13.3 No Personalized Pricing

We do not use personal information to set personalized pricing. All Users see the same published Plan prices for their currency and jurisdiction.

13.4 Your Right to Object

You have the right to obtain human intervention, to express your point of view, and to contest automated decisions (where they produce legal or similarly significant effects). Contact [email protected].

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is reflected in the effective_date and version fields in the document frontmatter at the top of this page.

14.1 Notice of Material Changes

For changes that materially affect:

• The categories of personal information we collect;
• The purposes for which we use personal information;
• The categories of third parties with whom we share personal information;
• Your rights or how to exercise them,

we will provide at least thirty (30) days' notice by email to your registered address, by a prominent in-product banner, or both.

14.2 Continuing to Use the Service

Your continued use of the Service after the effective date of revised Terms constitutes your acknowledgement of the revised Privacy Policy. If you do not agree to the revised Policy, you must stop using the Service and may cancel your subscription per Section 11 of the Terms of Service.

14.3 Non-Material Changes

Non-material changes (formatting, clarification, typo correction, Sub-processor list updates with no change in data category or purpose) may take effect upon posting without thirty (30) days' notice. The version field is incremented for all changes.

14.4 Version History

For significant historical versions, we maintain a changelog upon request to [email protected].

15. Marketing Communications

We send marketing emails (product updates, feature announcements, occasional promotions) only:

• to existing customers, where allowed under the legitimate-interest basis of GDPR Article 6(1)(f) and CAN-SPAM in the United States; and
• to prospects who have provided affirmative consent to receive marketing.

15.1 Opting Out

Every marketing email includes an unsubscribe link. Clicking the link removes you from the marketing list within ten (10) Business Days. You may also email [email protected] to be removed.

Opting out of marketing does not affect transactional emails (receipts, security notices, payment failures, terms changes), which you continue to receive while you maintain an active Account.

15.2 SMS and Other Channels

We do not currently send marketing SMS or push notifications. If we introduce such channels, separate opt-in will be obtained.

16. California-Specific Disclosures

In addition to the rights described in Section 10.2, the following disclosures are made for California residents under CCPA/CPRA.

16.1 Categories of Personal Information Collected (Last 12 Months)

16.2 Sources

• Direct from you (account form, content uploads, support communications);
• Automatically from your device (IP, browser, usage);
• Third parties (OAuth providers, payment processor, security providers).

16.3 Purposes

See Section 4.

16.4 Third Parties

See Section 5.

16.5 Sale and Sharing

We do not sell personal information for money. If advertising, affiliate, or analytics technologies enabled on the Site are considered "sharing" for cross-context behavioral advertising under CCPA/CPRA, we treat them as non-essential, load them only after cookie consent where required, and honor recognized opt-out signals such as Global Privacy Control.

16.6 Retention

See Section 8.

16.7 Shine the Light

California Civil Code § 1798.83 ("Shine the Light") permits California residents to request information about a business's disclosure of personal information to third parties for the third parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes without your consent.

17. Contact

For any privacy-related question, request, or complaint:

• Email: [email protected]
• Operator: the independent developer operating ShelfPic
• Privacy contact: [email protected]

If we cannot resolve your concern, you have the right to lodge a complaint with your local data protection supervisory authority, particularly in the EU/UK/Switzerland.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.