Privacy Policy
SendShelf is operated by BPMV Group LLC. This policy describes what the service stores, what it deliberately does not, and what you can ask us to do with it. It is written from the actual database schema rather than from a template, so the lists below are exhaustive rather than illustrative.
What we store
Three things, and nothing else.
Your account. Your email address, the display name you chose, and a bcrypt hash of your password. We never store the password itself and cannot recover it. We also record which invite code your account was created from, when the account was created, and its current state — pending, active or suspended — along with a log of every change to that state, who made it and why.
What you type about your products. For each product: the ASIN, the product title, brand, category, list price, an image URL and a listing URL if you enter them; how you acquired it; what you paid; the purchase date, the return-by date, whether you kept or returned it and on what date; your script, your product description and your notes; the video URL and publication date; and, if a video was rejected, the reason and how many times. We also keep the full history of every status change with a timestamp, which is what makes the board able to tell you how long things take.
Your settings. Default return days, the two urgency thresholds, your work-in-progress limit and your timezone.
That is the whole of it. There is no hidden telemetry, no event stream and no profile built from your behaviour, because none of those exist in the code.
What we do not do
We never ask for or store your Amazon credentials. There is no field anywhere in the application to type one into, no "connect your account" flow, and no browser extension. We cannot mishandle a credential we have no way to receive.
We make no automated requests to Amazon. Not to fetch a product title, not to check a price, not for anything. This is enforced by a test that fails our build if any HTTP client appears in the backend at all — see ourcompliance page, which explains the mechanism.
We do not sell, rent or share your data. Not with advertisers, not with data brokers, not with anyone. There is no third party to share it with, because there is no integration that would carry it anywhere.
We run no advertising and no third-party analytics. This site serves no third-party scripts of any kind — in fact it serves no JavaScript at all — and the application loads nothing from any origin but its own. There is no Google Analytics, no pixel, no tag manager and no session recorder.
Cookies
This marketing site sets no cookies at all. The application sets none either: the token that keeps you signed in is held in your browser's local storage and is sent only to our own API. Nothing we set is readable by any other site, and there is nothing here for a consent banner to be about.
Where it is kept
On a single server we rent from Hetzner, in their Ashburn, Virginia datacentre in the United States. Your data is not replicated to other regions.
Everything travels over TLS — the site and the application are HTTPS only. The database is on a private network with no route from the public internet; it is reachable only from the application container on the same host.
The database is backed up nightly to that same server, and backups are kept for 30 days before being deleted automatically.
Hetzner is the only third party with any custodial relationship to your data, as the operator of the hardware it sits on. We use no other processors: no email service, no error-tracking service, no analytics vendor, no CDN.
Who can see it
Other creators cannot see anything of yours. Every query in the application is scoped to your own workspace, and that scoping is enforced by build-time rules and a dedicated test suite rather than left to care.
An operator reviewing accounts sees far less than you might expect. The account-approval screen shows an email address, a display name, an account state, a role, a workspace name and a signup date. It cannot show another creator's products, costs, scripts, notes or ledger — those are not in the query and there is no screen that would render them.
But we should be plain about the limit of that. We run the server, so we hold direct database access, and direct database access can read anything. What the paragraph above describes is what the software will show — not a technical impossibility. We do not read your product records, and we have no business reason to; we would only reach into the database to fix a fault or to answer a request from you. We would rather say that clearly than imply a guarantee the architecture does not provide.
How long we keep it
For as long as your account exists. We do not currently expire or archive old records on our own — a product you added two years ago is still there.
When data is deleted, it is gone from the live database immediately and from backups within 30 days, as those backups age out. We do not surgically edit old backups; the honest answer to "how long after I delete something" is up to thirty days.
Your rights
An export. You can export your cost ledger as a CSV from the application yourself, at any time, without asking us. For a copy of everything else — your products, your scripts and notes, your full status history — email us and we will put it together by hand. There is no self-service button for the full export yet.
Deletion. Email us and we will delete your account and everything in it. There is no self-service delete button yet, so this is a manual step on our side rather than an instant one; we will confirm when it is done. Remember the 30-day backup window above.
Correction. Almost everything we hold is something you typed, and you can edit it in the application. For your email address, or anything you cannot reach, email us.
Questions. Any of the above, or anything this page does not answer:hello@sendshelf.com. We are small; you will be talking to the person who runs the service.
Children
SendShelf is a business tool and is not directed at children. You must be at least 18 to hold an account — see the terms of service. We do not knowingly collect information from anyone younger.
Changes to this policy
If we change it, we will change the effective date at the top and describe what changed. For anything that materially affects what we store or who can see it, we will email account holders rather than relying on you to re-read this page.
Contact
BPMV Group LLC — hello@sendshelf.com