Privacy Notice — Shelfmade

This Privacy Notice explains how Super Kind Company ("we", "us", "our") collects, uses, and protects personal data when you use Shelfmade ("Service"). Super Kind Company is the data controllerresponsible for personal data processed through the Service.

1. Personal data we collect

Account data — email address, password (hashed), display name, and optional profile avatar.
Library content — books, authors, ISBNs, locations, loans, notes, ratings, and reading status that you add.
Usage and device data — pages visited, features used, browser type, device identifiers, IP address, and timestamps. Used to keep the Service running and to improve it.
Support communications — messages you send us by email.
Subscription metadata — your plan tier, status, renewal date, and provider customer/subscription identifiers (we do not store full card data; payments are handled by Paddle).

2. Why we use it

To create and operate your account (contract performance).
To provide the Service — store your library, run searches, scan books, lend tracking, AI features (contract performance).
To prevent fraud, abuse, and security incidents (legitimate interest).
To improve the product, fix bugs, and develop new features (legitimate interest).
To respond to support requests (contract performance / legitimate interest).
To send transactional emails (account confirmations, receipts, security alerts) — required to deliver the Service.
To send occasional product updates where you have opted in (consent — withdrawable at any time).
To comply with legal obligations (legal obligation).

3. Who we share data with

We share personal data only with the categories of recipients below:

Hosting and database providers — to host the Service and store your library data.
Paddle, our Merchant of Record, which handles checkout, subscription billing, payment processing, tax compliance, invoicing, and customer service for purchases. Paddle's privacy practices are described at paddle.com/legal/privacy.
Email delivery providers — to send transactional emails.
Analytics and error monitoring — to understand usage and detect bugs.
Professional advisers — legal, accounting, and tax advisers, when needed.
Authorities — where disclosure is required by law or to protect our rights and the safety of users.

We do not sell your personal data.

4. International transfers

Some of our service providers are located outside the UK/EEA. When we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or recognised adequacy decisions.

5. Retention

We keep personal data only as long as needed for the purposes above. If you delete your account, your library, loans, and profile are removed promptly. We may retain limited records (such as billing history) where required by law.

6. Your rights

Subject to applicable law, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
request deletion ("right to be forgotten");
restrict or object to certain processing;
receive a portable copy of your data (e.g. a CSV export);
withdraw consent for marketing at any time;
lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at hello@shelfmadeai.com. We aim to respond within one month.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, and regular review of our infrastructure, to protect personal data against unauthorised access, loss, or alteration.

8. Cookies

Shelfmade uses essential cookies and similar storage required to keep you signed in and to remember your preferences. We may use limited analytics cookies to understand product usage. You can manage cookies in your browser settings; disabling essential cookies will break sign-in.

9. Children

Shelfmade is not directed to children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal data from children.

10. Changes

We may update this Privacy Notice from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be notified by email or in-app.

11. Contact

Super Kind Company — hello@shelfmadeai.com.