In short:
- This website uses no cookies, no analytics and no ads, and loads nothing from third parties.
- The app stores what it needs to work in your store: its settings, a copy of the public catalog and anonymous usage counters.
- We don't collect personal data about your store's customers.
- We don't sell data or share it with advertisers.
1. Who is responsible
| Owner | [Full name or company name] |
|---|---|
| Tax ID | [NIF / CIF] |
| Address | [Full postal address] |
| Contact | [email protected] |
In this policy, “InShelf”, “we” and “the app” refer to the owner and their InShelf – 3D Bookshelf Display app for Shopify. The Spanish version of this policy is the reference text.
2. Data processed by this website
The inshelf.app website is informational. It has no forms, asks for no sign-up and sets no cookies. The fonts and the demo's 3D engine are served from the same domain, so your browser doesn't connect to third parties when you visit it.
- Server logs. Like any website, its hosting provider records technical data about each visit (IP address, date, requested page and browser) to serve it and protect it from abuse. We don't use them to identify you or for statistics.
- Language preference. If you pick a language or dismiss the language suggestion, your browser remembers it in
localStorage(keyinshelf-lang). It never leaves your device. - Email. If you write to [email protected], we'll use your address and what you tell us only to reply.
3. Data processed by the Shopify app
When a store installs InShelf, we store:
- Store identity: its
myshopify.comdomain and the install and uninstall dates. - Billing: the plan, the Shopify subscription ID, the billing currency and the start date of the free trial. Payments are handled by Shopify: we never see card or bank details.
- Settings: the store's currency and price format, the bookshelf design, the app admin language and onboarding progress.
- Sync status of the catalog and, if it fails, the error message.
- Credentials: the Shopify access tokens and granted scopes, so the app can read the catalog on the store's behalf. They're offline tokens, so we don't store names or emails of store staff.
- Catalog: a copy of the public information about products and collections (title, author, description, image, price, availability, page count, ISBN and similar data), the same the store already shows on its website.
- Statistics: only daily counters aggregated per store and per product (bookshelf opens, books viewed, add-to-cart actions and “view details” clicks). We don't store IP addresses, customer IDs, cookies or user agents.
- Free trial record: so each store gets only one trial, we keep a cryptographic hash (SHA-256) of its domain and the trial start date. It contains no personal data and is kept after uninstalling for this purpose only.
- Support: if the store writes to us from the app, the email includes its domain and a technical summary (plan, theme, number of books and sync status) so we can help.
4. Data about store customers
InShelf doesn't collect personal data about store customers and doesn't request access to Shopify's protected customer data. Shopify adds the logged-in customer's ID to some requests; the app ignores it and never stores it. The cart uses the store's own tools: we don't see or store its contents. The bookshelf sets no cookies; it only saves the colors extracted from book covers in the browser's localStorage (key inshelf:colors:v1) so it loads faster next time. It contains no personal data.
If you're a customer of a store that uses InShelf, that store is responsible for your data. For any question, contact the store; it can contact us if needed.
5. Why we use data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the app: syncing the catalog, showing the bookshelf, applying the plan and design | Performance of the contract with the store (Art. 6(1)(b)) |
| Billing through Shopify and managing the free trial | Performance of the contract and legal obligations (Art. 6(1)(b) and 6(1)(c)) |
| Showing aggregated statistics to the store | Performance of the contract (Art. 6(1)(b)) |
| Answering emails and providing support | Legitimate interest in handling your request (Art. 6(1)(f)) |
| Technical server logs of the website | Legitimate interest in the website's security (Art. 6(1)(f)) |
For the store's catalog, we act on the store's instructions. We don't use data for profiling, we make no automated decisions and we don't share it with anyone unless required by law.
6. Providers that help us
- Shopify — the platform the app runs on, including billing for the plans.
- Railway — hosting for the app server and its PostgreSQL database.
- Google Workspace — email for
@inshelf.app. - Cloudflare — hosting for this website (Cloudflare Pages) and the domain's DNS.
Some of these providers may process data outside the European Economic Area. When they do, they use the safeguards required by the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
7. How long we keep data
- When the app is uninstalled, its sessions and access tokens are deleted.
- 48 hours later, Shopify sends us the
shop/redactnotice and we delete all of the store's data, except the anonymous free trial record. - Daily statistics are kept for 120 days.
- Support emails are kept for as long as the relationship lasts and, afterwards, for as long as needed to handle possible claims.
- A store can ask us to delete or export its data at any time.
8. Security
All traffic is encrypted with HTTPS. We verify the signature of the webhooks Shopify sends and of the requests that come through the store's app proxy. Access to the database is restricted.
9. Your rights
You can ask us to access, correct, delete or export your data, or to restrict or object to its use. Write to [email protected] saying which right you want to exercise; we'll reply within one month.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.
If you live in California (CCPA/CPRA), you have the right to know what personal information we collect and to ask us to delete it. We don't sell or share personal information.
10. Changes to this policy
If what we do with data changes, we'll update this page and its date. If the change is significant, we'll also announce it inside the app.