Version 3.0 · Published 27 May 2026 · Replaces version 2.0 (21 March 2024) — view archived version 2.0

About this policy

This policy explains how Cloudshelf Limited (“Cloudshelf”, “we”, “us”) collects and uses personal data, and what your rights are. Throughout this policy we refer to our subscribers as “retailers or brands” — for example, a chain of stores or a consumer brand that uses Cloudshelf inside its own (or a partner’s) retail environment.

We have written this policy so that you can quickly find the bits that apply to you. There are three “you may be one of these” sections, followed by sections that apply to everyone.

At a glance — find your section

• If you are a shopper using a Cloudshelf device in a store — see A.
• If you are a user of Cloudshelf at a retailer or brand (administrator or in-store staff) — see B.
• If we are in business contact with you (prospect, partner, vendor, investor, shareholder) or you are browsing our website — see C.

D to O cover topics that apply across the board: cookies, sub-processors, international transfers, security, retention, children, your rights under UK and EU GDPR, your rights under California law, automated decision-making, contacting us, complaining, and changes to this policy.

Who we are

Cloudshelf Limited is a company registered in England and Wales, company number 13158083. Our registered office is 36-38 Cornhill, London, United Kingdom, EC3V 3NG.

We are registered with the UK Information Commissioner’s Office (the “ICO”) under registration number ZB262450.

Our Data Protection contact: dpo@cloudshelf.ai.

Our EU Representative (Article 27 GDPR)

Under Article 27 of the EU GDPR, we have appointed an EU-based representative for individuals in the European Economic Area. Our EU Representative is Ghislain Ulrich, based in Paris, France. You can contact our EU Representative via dpo@cloudshelf.ai.

Our role: when we are a controller and when we are a processor

Cloudshelf does not have a single role across all data. For some categories we are the data controller (we decide what data is collected and what happens to it). For other categories — most notably any data about shoppers in stores — we act as a data processor on behalf of the retailer or brand, who is the controller.

The table below summarises this split.

Data we hold	Cloudshelf’s role	Controller (where different)
Retailer or brand administrator account data	Controller	—
Business contacts: prospects, partners, vendors, investors, shareholders (CRM)	Controller	—
Cloudshelf website visitors (essential cookies and server logs)	Controller	—
In-store shopper session data (products viewed, basket, purchases, answers to product-discovery questions)	Processor	The retailer or brand
In-store staff identifiers (e.g. name, staff number for commission)	Processor	The retailer or brand
Shopper email for wishlist or receipt (handled via our sub-processor Mailersend)	Processor	The retailer or brand

Why this matters. Where we act as a processor, the retailer or brand decides what is collected, what it is used for, and how long it is kept. We are bound by a written data processing agreement with that retailer or brand. If you want to exercise data subject rights in relation to that data (access, correction, deletion, and so on), the right contact is the retailer or brand themselves — but we will assist them in responding to you.

A. If you are a shopper using a Cloudshelf device in a store

What we collect about you

When you interact with a Cloudshelf device in a store, we record information about the session, not about you. This includes:

• Products you viewed.
• Products you added to a basket.
• Products you purchased.
• Answers to product-discovery questions. A Cloudshelf device may ask you a series of questions structured around the job you are trying to do (a “job-to-be-done” style of recommendation) — for example, what you intend to use a product for, or what features matter to you. We record your answers so that we can recommend the products best suited to you. We do not associate those answers with any personal information about you.
• Where you choose to associate the session with a member of staff (for example so they can receive commission), the staff member’s identifier.

We do not record your name, address, date of birth, or any other directly identifying information about you as part of this session data. The basket itself is created in the retailer or brand’s own eCommerce platform — the link between you and the basket is between you and the retailer or brand, not us.

Use of AI in product recommendations

To deliver in-store product recommendations and related features, we use AI sub-processors (currently Anthropic and OpenAI — see E). The data we send to these AI services does not contain personally identifiable information about you. The AI services are used to interpret your product-discovery answers and to surface relevant recommendations.

Wishlist and receipt emails

If you ask the device to email you a wishlist or a receipt, your email address is handled by our sub-processor Mailersend, who sends the email for us. Mailersend retains the email address and message detail for seven (7) days for QA and customer-support purposes, after which it is removed. Cloudshelf does not separately store your email address. In some configurations, the retailer or brand may instead handle the email themselves through their own systems — in those cases the retailer or brand is the controller of your email address.

How long we keep session data

Session data is held in our systems for the duration of the retailer or brand’s subscription, after which standard retention rules apply (see H. Retention). When a retailer or brand disconnects their eCommerce account from Cloudshelf, all associated data is erased within 48 hours (usage records and account names aside, which we retain for our own records).

Privacy-by-design measures on shopper data

We apply two privacy-by-design measures (under Article 25 UK/EU GDPR) to shopper data:

• We never store personally identifiable information about shoppers in our database. Session data (products viewed, basket, purchases, answers to product-discovery questions, staff identifier if any) does not contain personal information about you.
• PII redaction in operational logs. Where any personally identifiable information could appear in our logs (for example in a debug trace or an error report), it is redacted before the logs are saved.

Your rights as a shopper

Because we are a processor for shopper data, the right place to exercise data subject rights (access, deletion, correction, objection, restriction, portability, and so on) is with the retailer or brand whose store you visited. They are the controller of your data. If you do not know who to contact, write to us at dpo@cloudshelf.ai and we will help you find the right party.

B. If you are a user of Cloudshelf at a retailer or brand

B1. Administrator accounts

What we hold. If you administer a Cloudshelf account on behalf of a retailer or brand, we hold your work email address, your name, your employer’s name, and your job title. We hold a record of our exchanges with you in our CRM (HubSpot). We do not store any payment-card or bank account details — payment information is processed by our payment sub-processors and is not visible to us.

Lawful basis. Contract (we need to operate the service for your employer) and our legitimate interests (running and growing our business, supporting customers).

Retention. For the duration of your employer’s subscription, plus a further period for legal, tax and audit reasons (see H).

B2. In-store and brand staff users

What we hold. If you are a member of in-store staff (or brand staff working in a retail environment), we hold your name and/or a staff number that identifies you for the purposes of associating you with a shopper session — for example so that you receive commission for a sale you assisted with. We do not collect any additional information about you in this role.

Our role. Your retailer or brand is the controller for this data; Cloudshelf is the processor acting on their instructions under our data processing agreement with them.

Retention. Tied to your retailer or brand’s subscription and log retention rules (see H).

Your rights. Direct rights requests to your retailer or brand as the controller; Cloudshelf will assist.

C. If we are in business contact with you, or you visit our website

C1. Business contacts (prospects, partners, vendors, investors, shareholders)

What we hold. Your name, business email address, telephone number, employer, role, and a record of our exchanges (held in our CRM, HubSpot). We may add publicly available business information from sources such as LinkedIn, Companies House and similar.

Lawful basis. Our legitimate interests in running and developing a business-to-business relationship with your organisation. For business-to-business marketing communications, we rely on legitimate interests as permitted under the UK Privacy and Electronic Communications Regulations (PECR Reg 22) and equivalent EU rules.

Marketing. Cloudshelf only conducts business-to-business marketing. We do not market directly to consumers, and we do not conduct B2C outreach on behalf of our retailers or brands. Every marketing email we send contains a one-click unsubscribe link. As a matter of policy we stop emailing prospects who have become non-responsive even where they have not actively unsubscribed.

Retention. We do not automatically delete business contact records. We review CRM contact records periodically and remove contacts where there has been no meaningful engagement for an extended period (see H for the precise period).

Your rights. You can ask us at any time to update, correct or remove your record, or to stop sending you marketing. Contact dpo@cloudshelf.ai.

C2. Cloudshelf website visitors

Our website at https://cloudshelf.ai targets business users only. When you visit the website, our servers automatically log technical data such as your IP address, browser type and version, time zone and platform. We use this data to run and secure the site.

We use only strictly necessary cookies on the website (see D). We do not deploy analytics, advertising or tracking cookies. We do not need, and do not display, a cookie consent banner.

D. Cookies and similar technologies

Our website uses only strictly necessary cookies — cookies that are essential to the operation of the website (for example, to remember session state, to enable security features, or to load-balance traffic). Under regulation 6(4)(a) of the UK Privacy and Electronic Communications Regulations 2003, and the equivalent exemption in Article 5(3) of the EU ePrivacy Directive, strictly necessary cookies do not require user consent.

We do not deploy analytics cookies, advertising cookies, or other cross-site tracking technologies on our website. We do not allow third parties to set non-essential cookies through our website. Should this change in the future, we will deploy a cookie consent mechanism that satisfies UK/EU PECR/ePrivacy requirements and update this policy.

On the Cloudshelf in-store devices and the retailer or brand environments that integrate with Cloudshelf, functional storage may be used to operate the in-store experience (for example to remember a basket within a session). This functional storage does not identify you as an individual and is governed, where it processes any data about you, by the retailer or brand’s own policy as controller.

You can block or delete cookies via your browser settings — note that blocking strictly necessary cookies may stop parts of our website from working.

E. Disclosures, sub-processors and recipients

We use third party services (“sub-processors”) to deliver Cloudshelf. Categories include:

• Cloud infrastructure and hosting.
• Email delivery (transactional emails such as wishlists and receipts).
• CRM and marketing automation.
• Error monitoring, structured logging and observability.
• AI processing — providers of large language model services used to deliver in-store product recommendations and related features. Where AI sub-processors are used in the shopper flow, the data we send them does not contain personally identifiable information about the shopper.
• Payment processing (we do not see or store payment-card or bank account details).
• eCommerce platform integrations (e.g. Shopify, Salesforce Commerce Cloud).
• Professional advisers — auditors and legal advisers.

Our maintained list of named sub-processors, including the data they handle, their location, and the safeguards in place, is published at https://trust.cloudshelf.ai/subprocessors. Key sub-processors include Google, Microsoft Azure, HubSpot, Axiom, Mailersend, Anthropic and OpenAI.

Where a retailer or brand integrates Cloudshelf with their own eCommerce platform (such as Shopify or Salesforce Commerce Cloud), the retailer or brand is responsible for the data stored in that platform. You should consult that platform’s own privacy notice.

We may also disclose personal data: to a buyer in the event we sell our business or our company; to other companies in our corporate group as defined in the UK Companies Act 2006; where required by law or to protect rights, property or safety; and to combat fraud or credit risk.

F. International transfers

Cloudshelf is established in the UK. Some of our sub-processors are established outside the UK and the EEA, principally in the United States. Where we transfer personal data outside the UK or the EEA, we rely on one or more of the following safeguards:

• Adequacy: transfers to countries the UK or EU has determined to provide an adequate level of protection for personal data.
• The EU-US Data Privacy Framework (DPF), and the UK Extension to the DPF, where the recipient is DPF-certified.
• The UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with any supplementary measures we judge to be appropriate.

You can find the specific safeguard applied to each sub-processor on the sub-processor list at https://trust.cloudshelf.ai/subprocessors. If you would like more information about any specific transfer, contact dpo@cloudshelf.ai.

G. Security

We take data security seriously. Our measures include physical, electronic and managerial safeguards; restricted access on a legitimate-business-need basis; encryption of data in transit; and PII redaction in our logs as a privacy-by-design measure under Article 25 UK/EU GDPR. For shopper data we also apply a stronger commitment: we never store any personally identifiable information about shoppers in our database (see A).

Cloudshelf has been SOC 2 certified since 2024. We practise data minimisation, retaining only personal data that is necessary. You can find our trust portal — covering our current security practices and certifications — at https://trust.cloudshelf.ai.

If we experience a personal data breach affecting your data, we will notify you and the relevant supervisory authority in accordance with applicable law.

H. How long we keep your data

We retain personal data only for as long as necessary. The table below sets out our standard retention periods. Where the period depends on operational circumstances, we describe the criteria.

Data category	Retention period
Retailer or brand administrator account data	For the duration of the subscription, plus 6 years following account closure for legal, tax and audit reasons.
Business contact records in CRM (prospects, partners, vendors, investors, shareholders)	Retained until the contact is no longer relevant to our business. We review CRM contact records every 24 months and remove records where there has been no meaningful engagement for 24+ months.
Marketing opt-out records	Retained for 6 years as evidence of opt-out, in line with PECR / ICO expectations.
In-store shopper session data (products viewed, basket, purchases, answers to product-discovery questions) and in-store staff identifiers	Retained for the duration of the retailer or brand’s subscription. When a retailer or brand disconnects their eCommerce account from Cloudshelf, associated data is erased within 48 hours (with usage records and account names retained on our side). Shopper data does not contain personally identifiable information about shoppers (see A).
Wishlist / receipt emails handled via Mailersend	The email address and message detail are retained by Mailersend for 7 days for QA and customer-support purposes, after which they are removed. Cloudshelf does not separately store the email address.
Security, configuration and operational logs	180 days from creation. Logs are redacted of personally identifiable information at the point of writing.
Website server logs (essential cookies and IP)	Up to 180 days from creation, used for security and operational purposes.

I. Children

We do not knowingly collect personal data from children. Our in-store shopper interactions are designed to avoid collecting personal data from any individual regardless of age — what we record is session data (products viewed, basket, purchases, answers to product-discovery questions), not personal data about you. Our website and retailer-facing services are intended for adult business users.

If you believe we have inadvertently collected personal data from a child, please contact dpo@cloudshelf.ai and we will delete the data.

J. Your rights under UK and EU GDPR

If we act as a controller for your personal data, you have the following rights under UK and EU data protection law:

• Request access to your personal data.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data (portability).
• Withdraw consent at any time, where we rely on consent.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see L).

To exercise any of these rights, email us at dpo@cloudshelf.ai. You will not have to pay a fee, although we can charge a reasonable fee, or refuse to act, if your request is clearly unfounded, repetitive or excessive.

We may need to verify your identity before responding, and may ask you for further information to speed up our response. We aim to respond to all legitimate requests within one month; if your request is complex or numerous, we may extend that period and will keep you updated.

Lodging a complaint

If you are unhappy with how we have handled your personal data, we would prefer to hear from you first at dpo@cloudshelf.ai so we can try to resolve the matter. You also have the right to lodge a complaint with a supervisory authority:

• United Kingdom: the Information Commissioner’s Office (ico.org.uk).
• European Economic Area: the supervisory authority in your country of residence. A directory is maintained by the European Data Protection Board at edpb.europa.eu.

If we act as a processor for your data (typically shopper data — see A), the appropriate first contact is the retailer or brand as controller; we will assist them in responding.

K. Your rights under California law (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights in relation to personal information that we hold as a business.

Right to know and access

You may request that we disclose: the categories of personal information we have collected about you; the categories of sources; our business or commercial purpose; the categories of third parties to whom we have disclosed personal information; and the specific pieces of personal information we have collected about you.

Right to correct

You may request that we correct inaccurate personal information that we maintain about you.

Right to delete

You may request that we delete personal information we have collected from you, subject to applicable exceptions.

Right to limit use and disclosure of sensitive personal information

Cloudshelf does not collect or use sensitive personal information beyond what is permitted for purposes such as providing the service you requested. If this changes, we will update this policy and provide a mechanism to limit such use and disclosure.

Right to opt out of sale or sharing

We do not sell your personal information, and we do not “share” your personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. Should this change in the future, we will update this policy and provide the required opt-out mechanism.

Right to non-discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights — for example, we will not deny goods or services, charge different prices, or provide a different level of service.

Notice at collection

Where we collect personal information from a California resident, we provide a notice at or before the point of collection summarising the categories of personal information we collect and the purposes for which we use it. This policy is the long-form version of that notice.

Retention by category

Our retention periods, by category of personal information, are set out in H.

How to exercise your CCPA / CPRA rights

Submit a verifiable consumer request to dpo@cloudshelf.ai. Only you, or someone legally authorised to act on your behalf, may make a verifiable request related to your personal information. Where you use an authorised agent, we will ask the agent to provide signed permission demonstrating that you authorised them to act on your behalf, and we may ask you to verify your own identity directly with us.

We may respond to at most two verifiable consumer requests per consumer in any 12-month period.

L. Automated decision-making

We do not engage in automated decision-making that produces legal or similarly significant effects in relation to you. Where we use AI sub-processors to power in-store product recommendations (see A and E), those features assist your shopping experience but do not produce legal or similarly significant effects.

M. Contacting us

Data Protection contact: dpo@cloudshelf.ai

Postal address: Cloudshelf Limited, 36-38 Cornhill, London, United Kingdom, EC3V 3NG.

EU Representative (Article 27 GDPR): Ghislain Ulrich, Paris, France — contact via dpo@cloudshelf.ai.

N. Third party links

Our website and services may contain links to other websites operated by third parties. Those websites have their own privacy practices. We are not responsible for them — please check their notices before providing personal data to them.

O. Changes to this policy

We may update this policy from time to time as the law changes, as our services change, or as a result of customer or regulator feedback. Where we make material changes that require your consent, we will contact you. A change log is set out below.

Change log

Version 3.0 — 27 May 2026

• Full restructure into an audience-first format (shoppers, retailer or brand users, business contacts).
• Clarified controller vs processor roles, with a summary table near the top.
• Removed over-disclosed data categories that we don’t actually collect.
• Added our EU Representative (Article 27 GDPR): Ghislain Ulrich, Paris, France.
• Updated the California section to CPRA: right to correct; right to limit use of sensitive personal information; explicit position on “sharing” for cross-context behavioural advertising; retention by category; notice at collection; authorised agent process.
• Added a retention table covering all data categories.
• Confirmed that the website uses only strictly-necessary cookies (no consent banner required under PECR / ePrivacy).
• Documented the Mailersend wishlist/receipt mechanism (7-day retention by Mailersend).
• Added Anthropic and OpenAI as AI sub-processors for in-store product recommendations; replaced Sentry with Axiom for structured logging.
• Documented the “job-to-be-done”-style product-discovery questions in the shopper experience.
• Updated security, configuration and operational log retention to 180 days (PII redacted at the point of writing).
• Confirmed SOC 2 certification (certified since 2024).
• Strengthened privacy-by-design for shopper data: no shopper PII in our database, and PII redaction in operational logs.
• Added a link to the archived version 2.0.

Version 2.0 — 21 March 2024

• Previous published version — view archived version 2.0.