Privacy

Shelf is operated by AutoValue Limited, a company registered in Nigeria (RC 9739878). AutoValue Limited is the data controller for everything described here.

Questions, corrections and deletion requests: support.shelfamber@gmail.com.

An email address and password to sign in, the shop's name, what it sells, the word it counts stock in, and whether it sells on Instagram, WhatsApp or both. If the shop chooses to give them, its Instagram handle and a phone number to reach it on. Then its own records: products, prices, stock counts, sales, customers it chooses to save, and photographs of its products.

This is the shop's own business data. It is stored so the shop can use it, and it is not sold, rented, or shared with anybody for advertising — not now and not as a later change of mind, because there is no advertising business here to change our mind for.

A shop can connect its Instagram professional account so that customer messages arrive in Shelf. Connecting is done through Instagram's own authorisation screen. We never see or ask for an Instagram password.

With permission granted, we receive and store the messages customers send that account, the Instagram-scoped id Meta gives each customer, the display name where Meta provides one, and any replies sent from Shelf. We ask Meta for two permissions and no others: reading the account's basic profile, and reading and sending its messages. We do not request permission to publish posts.

A shop can disconnect at any time from Settings, and can revoke Shelf's access from inside Instagram. Messages already received stay in the shop's own records, because they are the evidence of what was said to a customer and an order dispute is exactly when they are wanted.

A shop can connect its own WhatsApp business number. Shelf then receives the messages customers send to that number and replies to them, in the same way it does on Instagram. Shelf sees the customer's WhatsApp number, their WhatsApp profile name, and what they write to that shop. Pictures and receipts a customer sends are copied into private storage that only that shop can open, because the link WhatsApp gives expires.

The number stays on the shop's own WhatsApp Business app. Messages the shop sends from that app are recorded here too, so the thread the shop reads is the whole conversation.

To have your messages removed, ask the shop you wrote to. If you cannot reach them, contact us and we will help.

If you send a direct message to a shop that uses Shelf, that shop receives your message here, and it can see your Instagram display name and the conversation. It is the same information the shop would see in Instagram itself. The shop, not us, decides what to do with it.

To have your messages removed, ask the shop you wrote to — they control their own records. If you cannot reach them, contact us and we will help.

No AI writes a reply. Replies about price and stock are worked out here, from the shop's own rows, by ordinary arithmetic. That is why they can be trusted to send themselves.

Customers' messages are read with the help of Anthropic. When a customer writes to a shop, the text of their message and the recent messages in that conversation, including the shop's own replies, are sent to Anthropic for one purpose: to pick what the customer meant from a fixed list, such as a price question, a request for pictures, or one of the shop's own products. This happens for most messages. It does not happen for a plain greeting, for a photograph (see below), or while a customer is in the middle of placing an order. The customer's name, Instagram id and WhatsApp number are not sent with it, though anything they typed in those messages is. What comes back is a choice from that list, not a sentence.

A photograph a customer sends also leaves. When somebody sends a picture and asks whether the shop has it, that image is sent to Anthropic for one purpose: to work out what is in it — the kind of product, the colour, the pattern — so it can be compared against the shop's catalogue. There is no other way to answer “do you have this?” from a picture.

Nothing about the customer goes with the image. Not the sender's name, not their Instagram id, not the message it arrived with, not the rest of the conversation. What comes back is a description, including any words written on the picture, and the matching against real products happens here. When that leaves a few similar products, the customer's picture is sent once more alongside the shop's own photographs of those few, so the one that is the same item can be picked out. The shop is never told a photograph matched something it does not sell.

Questions a shop owner asks about their own business reach no model at all. That screen is a set of buttons, and each answer is a sum of rows the browser already holds: orders, stock movements, and what customers asked for and did not get. No figure on it is estimated, predicted, or written by anything that could invent one.

Instagram and WhatsApp access tokens and payment provider keys are encrypted with AES-256-GCM before they are written, and the encryption key is held separately from the database. Someone holding a copy of the database would not hold anything usable.

Those tables also have no read policy at all, so they cannot be read through the application by anyone, including the shop that owns them. Shelf's own servers use them to send messages and confirm payments, and nothing else does.

If you have a Shelf account, we email you to confirm your address and to reset your password when you ask. We may also send occasional updates about Shelf and Amber: new features, changes to the service, and things you need to know as a shop on it. Every update has an unsubscribe link, and once you use it you get no more updates. Sign-in emails still arrive, because without them you cannot get into your account.

People who message a shop that uses Shelf are never added to any of our lists. Their details belong to that shop.

Our emails are sent through Resend, which receives your email address and name for that purpose only.

Shelf runs on Vercel (hosting) and Supabase (database and file storage). Instagram and WhatsApp messaging are provided by Meta, and our emails are sent by Resend. Payment confirmation, where a shop switches it on, uses that shop's own provider account. Anthropic is used only as described above.

These providers process data so that Shelf can work. They are not given data for their own purposes, and no data is sold to anyone.

We count page views to know which screens are used. The tool we use sets no cookies, builds no profile, and stores no identifier that could pick you out later. There are no advertising trackers on this site.

A shop's records are kept for as long as the shop uses Shelf. Stock movements, sales and messages are deliberately append-only — they are a ledger, and a ledger that can be edited cannot settle an argument — so individual entries are corrected by adding a correction rather than by rewriting history.

When a shop closes its account, its data is deleted on request. Ask and we will do it.

Under the Nigeria Data Protection Act you may ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and object to how it is used. Ask us and we will answer.

If this policy changes in a way that matters, the date at the top changes and shops are told. It will not be quietly rewritten.