Privacy policy

1Who we are

Shelfcast is made by Portside Labs, LLC (“Portside Labs”, “we”, “us”), 414 Falcon Ave, Miami Springs, FL 33166,United States. This policy covers the Shelfcast app for Shopify, this website (shelfcast.co) and our help center (help.shelfcast.co).

2Whose information this covers

Merchants and their staff

The store that installs Shelfcast, and the staff members who open it in the Shopify admin. For this information, Portside Labs decides how it’s used.

The store’s suppliers

Merchants add the businesses they buy from, often with a contact person’s name, email address and phone number. We hold that information on the merchant’s behalf and use it only to run Shelfcast for them, for example to email a purchase order the merchant chose to send.

The store’s customers

Shelfcast reads the store’s orders to count how many of each product sold, but it doesn’t request or keep any customer’s name, email, address or other details.

3Information we collect

About the store, from Shopify

• The store’s name, myshopify domain, Shopify ID, contact email, currency and time zone.
• The plan the store picked through Shopify, its trial and billing dates.
• Access tokens that let Shelfcast work with the store, stored encrypted.

About staff members who use the app

• The name, email address, Shopify user ID, admin language and permissions Shopify shares when a staff member opens Shelfcast.
• Their name is recorded against what they do in Shelfcast, such as creating a purchase order, receiving stock or completing a count, so the store can see who did what.

About products, stock and locations, from Shopify

• Products and variants: titles, vendor, type, status, image link, SKU, barcode, price and unit cost.
• Stock at each location: available, on hand, committed and incoming quantities, plus a daily record of available stock so forecasts can tell when a product was out of stock.
• Locations: their names, addresses and whether they’re active.
• A history of stock changes: changes made through Shelfcast, and changes to available stock made anywhere else in Shopify.

From orders, for forecasting

Shelfcast asks Shopify for the store’s recent orders, reads only the date, the products and the quantities on each, and keeps the total units sold per product per day. It doesn’t keep the orders themselves, and it doesn’t request customer names, emails, addresses or payment details. The file Shopify provides is deleted as soon as it’s been read.

Entered by the merchant

• Suppliers: business name, contact name, email addresses, phone, website, address, currency and terms.
• Supplier products, purchase orders, stock counts, settings and email templates, and the contents of files the merchant imports. Imported files are deleted once they’ve been processed.

While you use the app

To keep you signed in and protect forms, the app stores a session with your IP address and browser user agent for up to two hours after your last activity (see Cookies and browser storage).

When you visit this website or the help center

Both sites are static pages served by Cloudflare. We don’t use analytics, advertising or tracking scripts, and we don’t set cookies. Cloudflare processes your IP address to deliver the pages and protect them from abuse. Fonts are served from our own sites, not from Google.

When you email us

We keep your message and our reply so we can help you, and for as long as the conversation is useful.

What we don’t collect

• Customer names, emails, phone numbers or addresses.
• Payment card or bank details. Shopify bills you for Shelfcast.
• Your Shopify password.

4How we use information

• To run Shelfcast: syncing your catalog and stock, forecasting demand, suggesting reorders, and creating, sending and receiving purchase orders.
• To make the stock changes you ask for in Shopify, and record them in your inventory history.
• To email purchase orders to the suppliers you choose, with your store’s name as the sender and your store’s email for replies.
• To check which plan your store is on and apply it.
• To answer support requests, fix problems and keep the service secure.
• To meet legal obligations.

We don’t sell information, use it for advertising, or share it with data brokers. We don’t use your data to train machine learning models. Forecasts are worked out with fixed arithmetic on your own sales.

Our legal bases, where the law asks for one, are performing our contract with the merchant, our legitimate interest in running and securing the service, and complying with the law.

5Who we share it with

Service providers

These companies process information for us, under contract, only to provide their service:

Your suppliers

When you send a purchase order, the supplier receives what you send: the order’s products, quantities and delivery address, a link to a printable copy, and a CSV of its lines.

When the law requires it

We disclose information if we have to by law, or to protect the rights, property or safety of our users, the public or Portside Labs. Where we’re allowed to, we tell the affected store first.

If the business changes hands

If Portside Labs or Shelfcast is sold or merged, information may move with it, under this policy’s protections. We’ll tell installed stores before that happens.

6Cookies and browser storage

The app uses only what it needs to work. This website and the help center set no cookies.

Because we only use strictly necessary storage, we don’t show a cookie banner.

7Where information is stored

Shelfcast’s app and database run in the United States (Ohio). If you use Shelfcast from outside the United States, your information is transferred there. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for those transfers.

8How long we keep it

When a store uninstalls

Shelfcast deletes the store’s access tokens immediately and stops syncing. 48 hours later Shopify sends us a request to erase the store’s data, and we delete everything Shelfcast holds for it: staff, catalog, stock, sales totals, suppliers, purchase orders, counts, history and imports. Backups age out within 7 days after that. Export anything you want to keep before uninstalling; thehelp center explains how.

When a customer asks a store to erase their data

Shelfcast doesn’t store customer data, so there’s nothing for us to erase. We still answer Shopify’s customer data and erasure requests.

9Security

• Everything travels over HTTPS.
• Shopify access tokens are encrypted at rest, and expire and refresh automatically.
• Every request from the Shopify admin carries a signed token that we verify, and every webhook’s signature is checked.
• Links to printable purchase orders, labels and exports are signed and expire.
• Each store’s records are kept separate, and every request is checked against the store it belongs to.

No system is perfectly secure. If a breach affects your information, we’ll tell you without undue delay and as the law requires.

10Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent where we relied on it. We don’t sell or share personal information for advertising, so there’s nothing to opt out of. We won’t treat you differently for using these rights.

How to make a request

Email support@portsidelabs.io. We’ll confirm who you are, usually through the store’s Shopify account, and answer within 30 days. You can also complain to your local data protection authority.

If you’re a supplier contact

Your details were added by the store you supply, which decides how they’re used. Contact that store first; we’ll help them with your request.

If you’re a merchant

You can export your suppliers, supplier products, purchase orders and adjustment history as CSV files fromImport and export in the app at any time.

11Children

Shelfcast is a business tool for Shopify merchants. It isn’t meant for children, and we don’t knowingly collect information about anyone under 16.

12Changes to this policy

When we change this policy, we’ll update the date at the top of this page. Before a change that materially affects how we use your information takes effect, we’ll email the contact address of every installed store.

13Contact us

Questions about this policy or your information:

14US state privacy disclosures

Some US state laws ask for this summary of the categories of personal information we’ve collected in the last 12 months. The sources, purposes and recipients are described above.