Privacy Policy

Effective Date: 10/14/2026
Last Updated: 10/14/2026

1. Introduction

ShelfSpace Technologies Inc. ("ShelfSpace," "we," "us," or "our") operates the ShelfSpace platform at ourshelf.space and the marketing website at shelfspace.pro (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Service, including our accounts payable and payment services ("ShelfPay"), our accounts receivable services for vendors ("ShelfCollect"), and our AI assistant ("ShelfiQ").

This Policy covers information about the people who use the Service on behalf of retailers, vendors, and other businesses; visitors to our website; and individuals whose information we receive while providing the Service even though they do not use it themselves, such as trading-partner contacts, people who email us or reply to emails sent through the Service, business owners and control persons, businesses that owe money to a vendor using ShelfCollect ("Payers") and the people who act for them (see Section 3), and our customers' retail customers whose information appears in uploaded files. The Service is provided to businesses; information about a business (as opposed to an individual) is also governed by our Terms of Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

• Create an account — first name, last name, email address, password, business name, business type, and state
• Complete business verification and due diligence — legal business name, DBA name, business address, cannabis license number, Employer Identification Number (EIN), federal tax classification, ownership and control information (names, titles, ownership percentages, and other identifying details of owners, officers, and control persons), and, where required for payment services, government-issued identification of controlling owners and documents verifying your bank account
• Authorize payment processing — bank name, routing number, account number, account type, and your authorized signature. By providing this information, you authorize ShelfSpace to issue payment instruments on your instructions (including remotely created checks, checks bearing your authorized signature, and, if and when made available, ACH entries) as described in our Terms of Service
• Provide signatures — the authorized signature you draw or upload, which is printed on payment instruments issued on your instructions, and electronic signatures used to accept agreements and authorizations
• Submit tax documentation — W-9 equivalent data including EIN and tax classification. For affiliate representatives, taxpayer identification information needed for tax reporting
• Choose text-message security codes — your mobile phone number
• Use the Platform — product listings, inventory data, sales transactions, settlement records, purchase orders, credit memos, invoices, receivables, promotions, and other business data you enter or upload
• Upload data files — CSV and other files containing sales, inventory, returns, discounts, customer lists, and other transaction data
• Upload business documents — invoice PDFs, purchase orders, delivery receipts, and other documents uploaded for AI-powered data extraction
• Use a ShelfSpace-hosted email address — emails and attachments sent to the accounts payable or accounts receivable address ShelfSpace provides you, including from your vendors or customers, which may contain the names, email addresses, and business information of their personnel
• Connect third-party integrations — API credentials for state track-and-trace systems (e.g., Metrc), OAuth tokens for accounting platforms (e.g., QuickBooks Online), and configuration settings for connected services; and, if you ask our personnel to work in your other business systems (such as a point-of-sale back office), the sign-in details you provide for that purpose
• Use AI features — questions and conversations with the ShelfiQ AI assistant, including via the Platform, email, and the chat assistant on shelfspace.pro
• Manage contacts — names, email addresses, phone numbers, and roles of key business contacts (owners, buyers, AP/AR contacts, sales representatives), including contacts at your trading partners and Payers
• Contact us or request an evaluation — name, email address, business name, the data you provide for an evaluation, and any information you include in your communications

2.2 Information Collected Automatically

When you access the Service, we may automatically collect:

• Device and browser information — IP address, browser type, operating system, user agent string, and device identifiers
• Usage data — pages visited, features used, time spent on pages, and referring URLs
• Authentication data — multi-factor authentication method, MFA enrollment status, login timestamps, and failed authentication attempts
• Audit data — records of actions taken on the Platform, including data modifications, payment approvals, document generation, and agreement acceptance (with IP address and user agent for legal compliance)
• Error and performance data — application errors, performance metrics, and diagnostic information collected through our error monitoring service, which may include information present when an error occurs
• Email interaction data — whether emails we send are delivered, bounced, opened, or clicked, and unsubscribe requests
• Analytics — in the Platform, privacy-focused performance analytics provided by our hosting provider; on shelfspace.pro, Google Analytics, which uses cookies and similar technologies to measure site usage
• Cookies and similar technologies — we use cookies and similar technologies to maintain sessions, keep you signed in, protect against abuse, and improve user experience

2.3 Information from Third Parties

We may receive information from the following sources:

• State track-and-trace systems (Metrc) — inventory, transfer, manifest, sales, package, facility, and lab-result data, synced via API using credentials you provide
• Accounting platforms (QuickBooks Online) — chart of accounts, vendor and customer records, bills, bill payments, vendor credits, invoices, payments, attachments, payment status, and bank-account transaction reports, synced in both directions via OAuth
• Point-of-sale exports — sales, discount, return, and cost data from files you upload or that our personnel export at your request (we do not operate automated integrations with point-of-sale systems)
• Your trading partners and our other customers — information about your business and your contacts that appears in invoices, statements, accounting records, contact lists, and emails they share with us
• Public and government sources — state cannabis license registries and other state business and tax registries, U.S. government sanctions lists (including lists published by the U.S. Treasury Department's Office of Foreign Assets Control), public court records (including through CourtListener, operated by the Free Law Project), and news and other publicly available web sources
• Banks and payment partners — payment status, check clearing, returns, and information they provide in connection with their own due diligence

2.4 Consumer Information in Uploaded Files

Files that our customers upload from point-of-sale systems may contain information about their retail customers, including, for medical sales, patient or caregiver identifiers, dates of birth, and contact details. We do not need or use this information. Our ingestion processes are designed to discard consumer-identifying fields rather than store them in our database records. The original files you upload are kept in access-controlled storage as part of your business records, and raw files uploaded for an evaluation are deleted as described in Section 10. If you are a consumer and believe your information was provided to us, please contact the business you purchased from, or contact us.

3. Payers and Other Non-Account Holders (ShelfCollect)

When a vendor uses ShelfCollect to bill and collect amounts owed to it, we process information about the businesses that owe the vendor money ("Payers") and the people who work for them, whether or not they have a ShelfSpace account. We process this information on the vendor's behalf and for our own legitimate purposes of operating, securing, and improving the Service.

3.1 What We Collect

• Information vendors provide or connect — Payer business names, license numbers, addresses, billing and purchasing contacts (names, email addresses, phone numbers, and roles), invoice and line-item details, amounts owed, due dates, and payment history, which vendors enter, upload, or import from connected systems such as QuickBooks Online or a state track-and-trace system (e.g., Metrc). When a vendor connects a track-and-trace system, we use its outgoing transfer records to identify the licensed businesses it ships to, and we create records and payer profiles for those businesses on the Platform.
• Information from other Users and public sources — business and billing-contact details that other Users who transact with the same Payer provide, and license and registration details from state cannabis licensing records.
• Information you provide when you pay — the name you type as your signature, your email address, the bank name, routing number, and account number you enter, any comment or document you attach, and your authorization and attestations.
• Information collected automatically when you pay or read our emails — IP address, browser and device information, a device identifier derived from browser and device characteristics (used to prevent fraud), the date and time of your authorization, page views of a payment page, and whether a ShelfCollect email was opened (using a small image in the email).
• Your correspondence — the content of emails you send in reply to ShelfCollect messages, including attachments.
• Phone calls — when a vendor turns on ShelfCollect calls for a Payer: the phone numbers the vendor gives us, the recording and transcript of each call (including a voicemail we leave and calls you make back to us), the time and length of the call, the number that called or was called, and what you tell the assistant, such as a new billing contact or email address, a date you plan to pay, a dispute, or a request not to be called.
• Saved payment information — if you choose "save my info," your bank details are stored in encrypted form, linked to your verified email address, so you can pay faster next time. You can stop us from using them at any time with the "forget" option on the payment page or by contacting us; after that they are no longer used for new payments and are retained, encrypted and with restricted access, only as described in Section 3.3.

3.2 How We Use and Share It

• To provide ShelfCollect for the vendor — sending invoices, reminders, statements, and receipts to Payers on the vendor's behalf and in the vendor's name, hosting payment pages, and creating the payment instruments that Payers authorize
• To protect payments — detecting unauthorized, duplicate, or self-dealing payments, and checking licensing, sanctions, and other compliance lists
• To match records — matching invoices and Payers to track-and-trace shipment records and to the correct licensed business
• To answer replies — responding to Payer replies using AI on the vendor's behalf (see Section 7), and routing disputes and other matters to the vendor or our personnel
• To call about invoices — when a vendor turns calls on, an automated assistant with an AI-generated voice calls the numbers the vendor provides, on weekdays during business hours, in at most one round of calls a week for that vendor (tried once more the next business day if no one answers), about that vendor's open invoices, and answers calls back to that number. Every call starts by saying it is an automated assistant and that the call is recorded. Phone numbers a vendor provides are kept for that vendor's calls only; they are not added to the shared business record described below or shown to other vendors
• To report status to the vendor — measuring whether ShelfCollect emails and payment pages are received and viewed, so vendors can see the status of their invoices
• With the vendor you are paying or corresponding with — we share with the vendor the information about your payment and correspondence, including your name and signature, the payment instrument (which, like a paper check, displays the bank routing and account numbers you entered), payment status, email and page-view activity, comments, attachments, and any dispute you raise, and the outcome of calls made for that vendor (its administrators can also hear the recording and read the transcript)
• Shared business records — business details and billing contacts for a Payer may be visible to other Users who transact with that same business, and may be used to send those Users' invoices and reminders to that business's billing contacts. We do not show one vendor the amounts another vendor is owed.
• Anyone who has a payment link — payment links work without a login. Anyone who has a link can see the invoice information on that page, and link previews may show the vendor's name, the amount due, and whether it is past due.
• Banks and service providers — the banks that process a payment instrument, and the service providers listed in Section 13, receive the information needed to do so.

3.3 Retention and Choices

ShelfCollect payment and authorization records (including banking information entered for a payment, your typed signature, IP address, and device information) are kept with the related transaction records for at least seven (7) years to document authorization and resolve disputes. Saved payment information is used until you remove it or the related installment plan ends; after that it is no longer used for new payments but may be retained, encrypted and with restricted access, for the same transaction-record period. Email-open and page-view records are kept while the related invoice is open and with its transaction records afterward.

If we hold information about you because a vendor uses ShelfCollect, you may contact us at chris@shelfspace.pro to request access, correction, or deletion, and we will respond as required by applicable law. Some information must be kept as part of the vendor's business records or to meet legal and payment-record requirements. Questions about what you owe should go to the vendor. You can stop ShelfCollect emails to your address using the unsubscribe link in any of them; this stops only that category of email to that address and does not change any amount owed.

Call recordings and transcripts are kept for up to ninety (90) days and then permanently deleted, and within seven (7) days when a call reached someone not connected to the business's bills. A short record of each call (date, time, the number called, the outcome, and any promise, dispute, or stop request) and the phone numbers saved for calls are kept with the invoice records described above. You can ask the assistant on any call not to be called again, or email us at chris@shelfspace.pro; we then stop automated calls to that number for that vendor. Stopping calls does not stop emails, and unsubscribing from emails does not stop calls; each is its own choice. The terms that apply when you pay through a ShelfCollect payment page are in Section 6B.12 of our Terms of Service.

4. How We Use Your Information

We use information to:

• Provide, operate, and maintain the Service
• Process transactions and send related information, including settlement confirmations and invoices
• Create and manage your account
• Facilitate consignment (scan-based trading) and wholesale transactions between retailers and vendors
• Calculate and process settlements and payments
• Issue, print, mail, and track payment instruments on your instructions, including applying your authorized signature to checks
• Identify and recover vendor credits on behalf of retailers (credit recovery services)
• Provide ShelfCollect for vendors, as described in Section 3
• Synchronize data with connected third-party systems (Metrc, QuickBooks Online), including writing records to them on your instructions
• Send communications to trading partners on our customers' behalf and in their business names, and interpret replies to those communications
• Perform managed services you request, including accessing your account and connected systems through our personnel
• Communicate with you, including responding to inquiries and sending service-related notices
• Tell business Users about other ShelfSpace services that may help them, by email or in the Platform. You can opt out of these messages at any time by replying to one or contacting us; opting out does not affect service-related notices
• Process and respond to email communications using AI-powered tools
• Place and answer automated, recorded calls to Payers about a vendor's open invoices when the vendor turns calls on (see Section 3)
• Extract structured data from uploaded documents using AI
• Verify business identity and licenses, screen businesses and their owners and control persons against sanctions lists, public court records, and news sources, assign risk ratings, and place and resolve compliance holds on payments, as described in Section 6
• Maintain a shared directory of vendor businesses so that each vendor is represented once across the Service
• Operate security features, including sending one-time codes by email or text message
• Monitor and analyze usage trends to improve the Service
• Detect, prevent, and address fraud, unauthorized access, and other illegal activities
• Comply with legal obligations
• Create aggregate and de-identified datasets for analytics, product improvement, and industry benchmarking (such data will not identify you or your business)
• Facilitate dispute resolution between trading partners, including sharing relevant transaction records with both parties to a dispute
• Maintain audit logs and compliance records
• Create and maintain electronic records of agreements, authorizations, and consents as permitted under ESIGN and UETA

5. How We Share Your Information

We do not sell personal information for money, and we do not sell, rent, or use information from the Platform for targeted advertising. Our marketing website uses third-party analytics cookies, described below under "Website analytics," which some state laws may treat as "sharing" personal information. We share information only as described below.

• With your trading partners — retailers and vendors see the information needed to transact with each other, such as business names, contact details, product and delivery records, settlement, payment, and credit memo details, and communications about them. Access is limited as described in "Trading partner data limits" below.
• Communications sent on a customer's behalf — when we send an email for a customer, the recipient sees the content of that email, and replies are received by us.
• Shared vendor directory — business names, license numbers, business addresses, business contact details, and remittance details for vendor businesses are kept in a directory shared across our customers, so that customers who do business with the same vendor see consistent information. Customers' commercial terms, pricing, and transaction data are not part of the directory.
• Payees and payers — payment instruments and remittance details necessarily disclose the payer's name, address, bank name, routing and account numbers, and authorized signature to the payee and to the banks that process the item.
• Check printing and mailing — to print and mail checks you request, we share your business name and address, bank name, routing and account numbers, authorized signature, and payee name, address, and payment details with our check printing and mailing provider, which uses them only to print, mail, and account for those checks.
• Banking and payment partners — to process electronic payments where we make them available, and for due diligence, we share your business, ownership, license, bank-account, and due-diligence information and documents with our banking partner, which may access them through a restricted, read-only interface and uses them to provide payment services and to meet its own legal, regulatory, and payment-network (NACHA) obligations.
• Compliance reviews — as described in Section 6, we send names of businesses and of their owners and control persons as search terms to public-record and web-search services, and we share review results with our banking partner.
• Service providers — we share information with the companies described in Section 13 that host, store, secure, transmit, and process data on our behalf, under terms that limit their use of it to providing services to us.
• Website analytics — on shelfspace.pro (not in the Platform), Google Analytics collects information such as IP address, pages viewed, and cookie identifiers through cookies and scripts, and uses it under its own terms. You can limit this collection by blocking third-party cookies or using browser privacy controls, and you may contact us to opt out where state law gives you that right.
• Referral representatives — if you were referred by an independent representative, we share your business name, account status, and the fee amounts needed to calculate the representative's commission.
• Our personnel — our employees, contractors, and agents may access information, including personal information, as described in Section 8.
• Legal and regulatory — we may disclose information if required by law, regulation, legal process, or a governmental or cannabis-regulatory request (including state cannabis regulatory audits), may report or block transactions as required or permitted by sanctions and anti-money-laundering laws, and may disclose information to protect the rights, property, or safety of ShelfSpace, our customers, or others.
• Disputes — in a payment, credit memo, or settlement dispute, we may share relevant records, audit logs, and communications with the parties to the dispute and with mediators or arbitrators.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, information may be transferred as a business asset, subject to this Policy.
• With your consent — for any other purpose with your consent.
• De-identified and aggregated data — we may share data that cannot reasonably be used to identify you or your business for industry analysis, benchmarking, and research.

Trading partner data limits. A vendor can see data about its own products and its own relationship with a retailer, including sales, inventory, settlement, credit, and payment history for its products. A vendor cannot see: (a) sales or inventory data for products supplied by other vendors; (b) a retailer's aggregate financial performance, margins, or overall revenue; (c) a retailer's retail customer data; or (d) the commercial terms of a retailer's relationships with other vendors. We may provide vendors with aggregated market data, such as category-level trends, that does not identify specific retailers or competing vendors.

6. Compliance Reviews and Screening

To protect the Service and to meet our obligations and those of our banking partner, we review businesses that use our payment services, at onboarding and periodically after that. A review may include: checking cannabis licenses against state registries; screening the business and its owners, officers, and control persons against U.S. government sanctions lists; searching public court records for criminal, civil, and bankruptcy matters; searching news and other publicly available web sources, including through AI-assisted web searches; and assigning an internal risk rating. We keep the findings, their sources, and the decisions made.

• Who decides. Automated screening may place a temporary hold on payments, for example on a possible sanctions match. A ShelfSpace team member reviews the findings, and a person, not an AI system, decides whether a hold based on a possible sanctions match or on review findings is lifted or kept. Some temporary holds end automatically when their stated period ends or when the condition that triggered them clears.
• How results are used. Review results are used only to decide whether and how we provide payment services and other features to a business, to comply with law, and to manage fraud and compliance risk. They are shared with our banking partner, which may view them through a restricted interface for its own due-diligence and anti-money-laundering obligations, and with authorities where required. We do not sell review results or provide them to anyone for any other purpose.
• Not consumer reports. We do not obtain consumer reports from consumer reporting agencies for these reviews, and review results are not used to make decisions about any individual's eligibility for credit, insurance, employment, or housing.
• Your opportunity to respond. Where law permits, before a hold or refusal based on public-record, court-record, or news information about a business or one of its owners, officers, or control persons becomes final, we tell the business the general nature and source of that information and give the business and the affected individual an opportunity to dispute its accuracy or completeness. We correct our records if the information is shown to be inaccurate. An individual may also contact us at chris@shelfspace.pro to ask what information about them we hold from a review.

7. AI Processing

ShelfiQ and our document and email processing are powered by Anthropic's Claude models, accessed through Anthropic's commercial API under terms and a Data Processing Addendum that prohibit Anthropic from using the data we send to train its models. We send Anthropic the data needed for each task, which may include your questions, business data from your account, uploaded documents, and the content, sender details, and attachments of emails received by the Service, including replies from Payers to ShelfCollect emails and emails sent to ShelfSpace-hosted accounts payable and accounts receivable addresses.

ShelfCollect calls are handled by Retell AI, which connects the call, runs the voice assistant, and records and transcribes the call; the assistant's replies are generated by an AI language model that Retell runs for us, and its voice is generated by ElevenLabs. We copy each recording and transcript into our own storage and then delete the call data held by Retell, which keeps it for no more than thirty (30) days in any case.

For compliance reviews, AI-assisted web searches are run using the names of businesses and of their owners and control persons, and the results are stored as evidence for a human reviewer, as described in Section 6.

Our personnel may also use AI-assisted tools to operate and support the Service.

Many emails sent through the Service that may be answered by our AI assistant include a notice that replies may be processed by AI. Replies sent in a customer's business name may or may not include that notice, and our assistant will not deny being an AI assistant if asked. We retain AI conversations and email correspondence as described in Section 10.

8. Data Security

We implement commercially reasonable technical and organizational security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest, with additional encryption of bank account numbers and integration credentials
• Multi-factor authentication for user accounts
• Row-level security so that users can access only their own organization's data, and role-based access controls for our personnel
• Audit logs of changes to records, including financial and banking records, which users and our staff cannot edit or delete
• Encrypted backups stored with a separate provider
• Periodic review of our security practices

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Personnel access. Authorized ShelfSpace personnel may access information, including personal information, as needed to provide, support, secure, and investigate the Service, including by viewing or operating a customer's account as an administrator to provide support and managed services the customer requests, to investigate fraud or errors, and to meet legal obligations. Such access is subject to confidentiality obligations and is role-restricted, and actions our personnel take in a customer's account are logged. Access to credentials, encryption keys, and security codes is restricted.

Data Breach Notification. If a security breach affects your personal information, we will notify you without undue delay and as required by applicable law. Notification will be provided via email to the address associated with your account and, where appropriate, through an in-platform notification. Breach notifications will describe, to the extent known and permitted by law, the nature of the breach, the types of information affected, steps we are taking in response, and steps you can take to protect yourself.

9. Sensitive Financial Information

We collect and store certain sensitive financial information necessary to operate the Service, including:

• Banking information — bank name, routing number, and account number, used for payment processing between trading partners and for collecting our fees
• Tax identification — Employer Identification Number (EIN) and federal tax classification, used for tax reporting and W-9 compliance
• Authorized signatures — the signature you designate for checks, stored in access-controlled storage and applied to payment instruments issued on your instructions, and electronic signatures used to accept platform terms and authorize transactions
• Payment authorizations — records of your consent to payment instruments, including timestamps, IP addresses, and user agent strings associated with each authorization event
• Identity documents — government-issued identification of controlling owners, collected only where required for payment services, stored in access-controlled storage, and shared only with our banking partner, with the service providers that host and store it for us, and as required by law
• Payer banking information — bank name, routing number, and account number entered on a ShelfCollect payment page, used to create the payment instrument the Payer authorizes. It is stored in encrypted form with the payment record and, for an installment plan or where the Payer chooses "save my info," retained to make future authorized payments. Access is restricted and logged

Banking and tax information is stored in our secured database with row-level security policies so that users can access only their own organization's data. Bank account numbers and integration credentials are encrypted at the application level, and access to the encryption keys is restricted. We keep audit logs of changes to sensitive financial data.

10. Data Retention

We keep information for as long as your account is active and afterward for as long as needed for the purposes below. Because the Service keeps financial records that other parties rely on, we generally do not permanently erase records from our active database. Instead, when a record is deleted in the Service or an account is closed, we mark it as deleted and remove it from use; it is then retained, with access restricted, for the periods below.

• Transaction, settlement, payment, credit memo, invoice, and receivable records, and uploaded business documents and data files — at least seven (7) years, for tax, financial record-keeping, and dispute purposes. These records are shared with, and relied on by, your trading partners.
• Payment instruments and payment instructions — images of issued checks, remittance records, and instruction and approval logs: at least seven (7) years.
• Agreement, signature, authorization, and consent records — for as long as the agreement or authorization could be relevant to a legal claim, and at least seven (7) years; banking and payment authorization records at least two (2) years after the authorization ends, as required by payment-network rules.
• Audit logs — retained indefinitely as a record of changes.
• Compliance review records (screenings, findings, sources, and decisions) — at least five (5) years after the review, or longer if our banking partner or law requires.
• Identity and due-diligence documents — for the life of the payment relationship and at least five (5) years after it ends, or longer where required by law or our banking partner.
• AI conversations and email correspondence — for the life of your account and the transaction-record period above, because they may form part of the record of a credit memo, payment, or dispute.
• Call recordings and transcripts — up to ninety (90) days, then permanently deleted (not kept with restricted access), as described in Section 3.3. Call outcome records and the phone numbers saved for calls are kept with the related invoice records.
• Account and contact information — for the life of the account and the transaction-record period, because it identifies the parties to retained records.
• ShelfCollect records about Payers — as described in Section 3.3.
• Evaluation uploads — raw files uploaded for an evaluation are deleted automatically, generally within thirty (30) days and sooner once the evaluation data has been processed. File names and other file details, and the evaluation results, may be kept.
• Integration credentials — used only while the integration is active. When you disconnect an integration, we stop using its credentials and, where the provider supports it, ask the provider to revoke our access; the encrypted credentials may be kept with the connection record. You can also revoke access directly with the provider.
• Email suppression records — kept indefinitely so that we continue to honor your unsubscribe request.
• System and webhook logs — generally about thirty (30) days; logs of inbound email processing are kept with the related correspondence.
• Backups — encrypted database backups are kept for up to thirty-five (35) days, and monthly backups for up to about thirteen (13) months, then deleted. Backup copies of stored documents and files are kept separately and may be retained for as long as the related records, or longer. Information deleted from the active database may remain in backups until they expire.
• De-identified and aggregated data — may be retained indefinitely.

11. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request deletion of your personal information. Because of the retention needs in Section 10, we fulfill a deletion request by deactivating your user account, removing your information from use in the Service, and, where feasible, de-identifying personal fields that are not needed for retained records. Records that we must keep, or that your trading partners rely on, are retained with restricted access for the periods in Section 10.
• Data portability — request a copy of your data in a structured, commonly used format
• Email — unsubscribe from marketing or other optional email categories using the link in any such email. Security and essential account emails cannot be unsubscribed while your account is active.
• Text messages — switch to another authentication method in your account settings

To exercise these rights, contact us at chris@shelfspace.pro. We will verify your identity, and your authority to act for a business account, before acting on a request, and respond within the time required by applicable law. If we decline a request, you may appeal by replying to our decision. Payers and other people who do not have an account may also use these rights as described in Section 3.3.

12. State Privacy Rights

Residents of California and certain other states may have rights under state privacy laws, to the extent those laws apply to us, including the rights to know, access, correct, and delete personal information, to opt out of the sale or sharing of personal information or its use for targeted advertising, and not to be discriminated against for exercising these rights. We do not sell personal information for money; the website analytics described in Section 5 are the only way information may be shared with third parties for their own purposes, and you may opt out of them as described there. We do not use personal information to make decisions that produce legal or similarly significant effects about individuals through solely automated processing. To make a request, or for an authorized agent to make a request on your behalf, contact chris@shelfspace.pro.

13. Service Providers

We use the following service providers to process information on our behalf. Each receives the information needed for its service.

• Supabase — database hosting, authentication, and file storage
• Vercel — application and website hosting, and privacy-focused performance analytics
• Anthropic — AI models for ShelfiQ, document extraction, email processing, the website chat assistant, and compliance web searches (see Section 7). For details, see Anthropic's Privacy Policy
• Resend — sending and receiving email, and email delivery and engagement events
• Retell AI — placing and answering ShelfCollect calls, the voice assistant, call recording, and transcription (see Section 7)
• ElevenLabs — generating the voice of the ShelfCollect call assistant from the assistant's text
• Twilio — delivery of one-time security codes by text message
• Sentry — error monitoring and diagnostics, which may capture information present when an error occurs
• Cloudflare — security and bot protection (Turnstile) and encrypted backup storage
• GitHub — source-code hosting and the automated jobs that create our encrypted backups
• Upstash — rate limiting on our website forms and chat, which processes IP addresses
• Check printing and mailing provider — printing and mailing of paper checks, using the payee, payer, bank, signature, and amount information on each check
• Banking partner — processing of electronic payments, where we make them available, and related due diligence, as described in Section 5

We also exchange information with the following services, which process it under their own terms:

• Google Analytics — usage measurement on our marketing website (shelfspace.pro), as described in Section 5
• Metrc — the state track-and-trace system you connect
• Intuit QuickBooks Online — the accounting platform you connect; we also use QuickBooks for ShelfSpace's own accounting, including records of the fees we charge you. See Intuit's Privacy Policy
• CourtListener (Free Law Project) — public court records searched during compliance reviews
• U.S. Treasury (OFAC) and state licensing and tax agencies — public sanctions lists and license and business registries, which we download or query
• Google (Google Fonts and YouTube) — some pages load fonts from Google and embedded help videos in YouTube's privacy-enhanced mode, which receive your IP address and browser information when they load or play

We are not responsible for the privacy practices of third-party services you choose to connect. We will update this list when we add or change a service provider that processes personal information, and will provide a current list on request.

14. Where Data Is Processed

ShelfSpace is based in the United States, and we store our primary database in the United States. Some of our service providers operate global infrastructure, and information may be processed or routed in other countries to deliver the Service, for example when a request is served by a nearby network location. Where that happens, the information remains subject to this Policy and to our providers' data-protection commitments.

15. Do Not Track

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no uniform standard for interpreting DNT signals, the Service does not currently respond to DNT signals. We will update this section if a uniform standard is established.

16. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete that information promptly.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Effective Date" above, and for material changes we will also notify account holders by email or in the Platform. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

18. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

ShelfSpace Technologies Inc.
Email: chris@shelfspace.pro (privacy requests) · support@shelfspace.pro (support)
Website: shelfspace.pro