Version 3.0 · Published 27 May 2026 · Replaces version 2.0 (21 March 2024) — view archived version 2.0
This policy explains how Cloudshelf Limited (“Cloudshelf”, “we”, “us”) collects and uses personal data, and what your rights are. Throughout this policy we refer to our subscribers as “retailers or brands” — for example, a chain of stores or a consumer brand that uses Cloudshelf inside its own (or a partner’s) retail environment.
We have written this policy so that you can quickly find the bits that apply to you. There are three “you may be one of these” sections, followed by sections that apply to everyone.
D to O cover topics that apply across the board: cookies, sub-processors, international transfers, security, retention, children, your rights under UK and EU GDPR, your rights under California law, automated decision-making, contacting us, complaining, and changes to this policy.
Cloudshelf Limited is a company registered in England and Wales, company number 13158083. Our registered office is 36-38 Cornhill, London, United Kingdom, EC3V 3NG.
We are registered with the UK Information Commissioner’s Office (the “ICO”) under registration number ZB262450.
Our Data Protection contact: dpo@cloudshelf.ai.
Under Article 27 of the EU GDPR, we have appointed an EU-based representative for individuals in the European Economic Area. Our EU Representative is Ghislain Ulrich, based in Paris, France. You can contact our EU Representative via dpo@cloudshelf.ai.
Cloudshelf does not have a single role across all data. For some categories we are the data controller (we decide what data is collected and what happens to it). For other categories — most notably any data about shoppers in stores — we act as a data processor on behalf of the retailer or brand, who is the controller.
The table below summarises this split.
| Data we hold | Cloudshelf’s role | Controller (where different) |
|---|---|---|
| Retailer or brand administrator account data | Controller | — |
| Business contacts: prospects, partners, vendors, investors, shareholders (CRM) | Controller | — |
| Cloudshelf website visitors (essential cookies and server logs) | Controller | — |
| In-store shopper session data (products viewed, basket, purchases, answers to product-discovery questions) | Processor | The retailer or brand |
| In-store staff identifiers (e.g. name, staff number for commission) | Processor | The retailer or brand |
| Shopper email for wishlist or receipt (handled via our sub-processor Mailersend) | Processor | The retailer or brand |
Why this matters. Where we act as a processor, the retailer or brand decides what is collected, what it is used for, and how long it is kept. We are bound by a written data processing agreement with that retailer or brand. If you want to exercise data subject rights in relation to that data (access, correction, deletion, and so on), the right contact is the retailer or brand themselves — but we will assist them in responding to you.
When you interact with a Cloudshelf device in a store, we record information about the session, not about you. This includes:
We do not record your name, address, date of birth, or any other directly identifying information about you as part of this session data. The basket itself is created in the retailer or brand’s own eCommerce platform — the link between you and the basket is between you and the retailer or brand, not us.
To deliver in-store product recommendations and related features, we use AI sub-processors (currently Anthropic and OpenAI — see E). The data we send to these AI services does not contain personally identifiable information about you. The AI services are used to interpret your product-discovery answers and to surface relevant recommendations.
If you ask the device to email you a wishlist or a receipt, your email address is handled by our sub-processor Mailersend, who sends the email for us. Mailersend retains the email address and message detail for seven (7) days for QA and customer-support purposes, after which it is removed. Cloudshelf does not separately store your email address. In some configurations, the retailer or brand may instead handle the email themselves through their own systems — in those cases the retailer or brand is the controller of your email address.
Session data is held in our systems for the duration of the retailer or brand’s subscription, after which standard retention rules apply (see H. Retention). When a retailer or brand disconnects their eCommerce account from Cloudshelf, all associated data is erased within 48 hours (usage records and account names aside, which we retain for our own records).
We apply two privacy-by-design measures (under Article 25 UK/EU GDPR) to shopper data:
Because we are a processor for shopper data, the right place to exercise data subject rights (access, deletion, correction, objection, restriction, portability, and so on) is with the retailer or brand whose store you visited. They are the controller of your data. If you do not know who to contact, write to us at dpo@cloudshelf.ai and we will help you find the right party.
What we hold. If you administer a Cloudshelf account on behalf of a retailer or brand, we hold your work email address, your name, your employer’s name, and your job title. We hold a record of our exchanges with you in our CRM (HubSpot). We do not store any payment-card or bank account details — payment information is processed by our payment sub-processors and is not visible to us.
Lawful basis. Contract (we need to operate the service for your employer) and our legitimate interests (running and growing our business, supporting customers).
Retention. For the duration of your employer’s subscription, plus a further period for legal, tax and audit reasons (see H).
What we hold. If you are a member of in-store staff (or brand staff working in a retail environment), we hold your name and/or a staff number that identifies you for the purposes of associating you with a shopper session — for example so that you receive commission for a sale you assisted with. We do not collect any additional information about you in this role.
Our role. Your retailer or brand is the controller for this data; Cloudshelf is the processor acting on their instructions under our data processing agreement with them.
Retention. Tied to your retailer or brand’s subscription and log retention rules (see H).
Your rights. Direct rights requests to your retailer or brand as the controller; Cloudshelf will assist.
What we hold. Your name, business email address, telephone number, employer, role, and a record of our exchanges (held in our CRM, HubSpot). We may add publicly available business information from sources such as LinkedIn, Companies House and similar.
Lawful basis. Our legitimate interests in running and developing a business-to-business relationship with your organisation. For business-to-business marketing communications, we rely on legitimate interests as permitted under the UK Privacy and Electronic Communications Regulations (PECR Reg 22) and equivalent EU rules.
Marketing. Cloudshelf only conducts business-to-business marketing. We do not market directly to consumers, and we do not conduct B2C outreach on behalf of our retailers or brands. Every marketing email we send contains a one-click unsubscribe link. As a matter of policy we stop emailing prospects who have become non-responsive even where they have not actively unsubscribed.
Retention. We do not automatically delete business contact records. We review CRM contact records periodically and remove contacts where there has been no meaningful engagement for an extended period (see H for the precise period).
Your rights. You can ask us at any time to update, correct or remove your record, or to stop sending you marketing. Contact dpo@cloudshelf.ai.
Our website at https://cloudshelf.ai targets business users only. When you visit the website, our servers automatically log technical data such as your IP address, browser type and version, time zone and platform. We use this data to run and secure the site.
We use only strictly necessary cookies on the website (see D). We do not deploy analytics, advertising or tracking cookies. We do not need, and do not display, a cookie consent banner.
Our website uses only strictly necessary cookies — cookies that are essential to the operation of the website (for example, to remember session state, to enable security features, or to load-balance traffic). Under regulation 6(4)(a) of the UK Privacy and Electronic Communications Regulations 2003, and the equivalent exemption in Article 5(3) of the EU ePrivacy Directive, strictly necessary cookies do not require user consent.
We do not deploy analytics cookies, advertising cookies, or other cross-site tracking technologies on our website. We do not allow third parties to set non-essential cookies through our website. Should this change in the future, we will deploy a cookie consent mechanism that satisfies UK/EU PECR/ePrivacy requirements and update this policy.
On the Cloudshelf in-store devices and the retailer or brand environments that integrate with Cloudshelf, functional storage may be used to operate the in-store experience (for example to remember a basket within a session). This functional storage does not identify you as an individual and is governed, where it processes any data about you, by the retailer or brand’s own policy as controller.
You can block or delete cookies via your browser settings — note that blocking strictly necessary cookies may stop parts of our website from working.
We use third party services (“sub-processors”) to deliver Cloudshelf. Categories include:
Our maintained list of named sub-processors, including the data they handle, their location, and the safeguards in place, is published at https://trust.cloudshelf.ai/subprocessors. Key sub-processors include Google, Microsoft Azure, HubSpot, Axiom, Mailersend, Anthropic and OpenAI.
Where a retailer or brand integrates Cloudshelf with their own eCommerce platform (such as Shopify or Salesforce Commerce Cloud), the retailer or brand is responsible for the data stored in that platform. You should consult that platform’s own privacy notice.
We may also disclose personal data: to a buyer in the event we sell our business or our company; to other companies in our corporate group as defined in the UK Companies Act 2006; where required by law or to protect rights, property or safety; and to combat fraud or credit risk.
Cloudshelf is established in the UK. Some of our sub-processors are established outside the UK and the EEA, principally in the United States. Where we transfer personal data outside the UK or the EEA, we rely on one or more of the following safeguards:
You can find the specific safeguard applied to each sub-processor on the sub-processor list at https://trust.cloudshelf.ai/subprocessors. If you would like more information about any specific transfer, contact dpo@cloudshelf.ai.
We take data security seriously. Our measures include physical, electronic and managerial safeguards; restricted access on a legitimate-business-need basis; encryption of data in transit; and PII redaction in our logs as a privacy-by-design measure under Article 25 UK/EU GDPR. For shopper data we also apply a stronger commitment: we never store any personally identifiable information about shoppers in our database (see A).
Cloudshelf has been SOC 2 certified since 2024. We practise data minimisation, retaining only personal data that is necessary. You can find our trust portal — covering our current security practices and certifications — at https://trust.cloudshelf.ai.
If we experience a personal data breach affecting your data, we will notify you and the relevant supervisory authority in accordance with applicable law.
We retain personal data only for as long as necessary. The table below sets out our standard retention periods. Where the period depends on operational circumstances, we describe the criteria.
| Data category | Retention period |
|---|---|
| Retailer or brand administrator account data | For the duration of the subscription, plus 6 years following account closure for legal, tax and audit reasons. |
| Business contact records in CRM (prospects, partners, vendors, investors, shareholders) | Retained until the contact is no longer relevant to our business. We review CRM contact records every 24 months and remove records where there has been no meaningful engagement for 24+ months. |
| Marketing opt-out records | Retained for 6 years as evidence of opt-out, in line with PECR / ICO expectations. |
| In-store shopper session data (products viewed, basket, purchases, answers to product-discovery questions) and in-store staff identifiers | Retained for the duration of the retailer or brand’s subscription. When a retailer or brand disconnects their eCommerce account from Cloudshelf, associated data is erased within 48 hours (with usage records and account names retained on our side). Shopper data does not contain personally identifiable information about shoppers (see A). |
| Wishlist / receipt emails handled via Mailersend | The email address and message detail are retained by Mailersend for 7 days for QA and customer-support purposes, after which they are removed. Cloudshelf does not separately store the email address. |
| Security, configuration and operational logs | 180 days from creation. Logs are redacted of personally identifiable information at the point of writing. |
| Website server logs (essential cookies and IP) | Up to 180 days from creation, used for security and operational purposes. |
We do not knowingly collect personal data from children. Our in-store shopper interactions are designed to avoid collecting personal data from any individual regardless of age — what we record is session data (products viewed, basket, purchases, answers to product-discovery questions), not personal data about you. Our website and retailer-facing services are intended for adult business users.
If you believe we have inadvertently collected personal data from a child, please contact dpo@cloudshelf.ai and we will delete the data.
If we act as a controller for your personal data, you have the following rights under UK and EU data protection law:
To exercise any of these rights, email us at dpo@cloudshelf.ai. You will not have to pay a fee, although we can charge a reasonable fee, or refuse to act, if your request is clearly unfounded, repetitive or excessive.
We may need to verify your identity before responding, and may ask you for further information to speed up our response. We aim to respond to all legitimate requests within one month; if your request is complex or numerous, we may extend that period and will keep you updated.
If you are unhappy with how we have handled your personal data, we would prefer to hear from you first at dpo@cloudshelf.ai so we can try to resolve the matter. You also have the right to lodge a complaint with a supervisory authority:
If we act as a processor for your data (typically shopper data — see A), the appropriate first contact is the retailer or brand as controller; we will assist them in responding.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights in relation to personal information that we hold as a business.
You may request that we disclose: the categories of personal information we have collected about you; the categories of sources; our business or commercial purpose; the categories of third parties to whom we have disclosed personal information; and the specific pieces of personal information we have collected about you.
You may request that we correct inaccurate personal information that we maintain about you.
You may request that we delete personal information we have collected from you, subject to applicable exceptions.
Cloudshelf does not collect or use sensitive personal information beyond what is permitted for purposes such as providing the service you requested. If this changes, we will update this policy and provide a mechanism to limit such use and disclosure.
We do not sell your personal information, and we do not “share” your personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. Should this change in the future, we will update this policy and provide the required opt-out mechanism.
We will not discriminate against you for exercising any of your CCPA/CPRA rights — for example, we will not deny goods or services, charge different prices, or provide a different level of service.
Where we collect personal information from a California resident, we provide a notice at or before the point of collection summarising the categories of personal information we collect and the purposes for which we use it. This policy is the long-form version of that notice.
Our retention periods, by category of personal information, are set out in H.
Submit a verifiable consumer request to dpo@cloudshelf.ai. Only you, or someone legally authorised to act on your behalf, may make a verifiable request related to your personal information. Where you use an authorised agent, we will ask the agent to provide signed permission demonstrating that you authorised them to act on your behalf, and we may ask you to verify your own identity directly with us.
We may respond to at most two verifiable consumer requests per consumer in any 12-month period.
We do not engage in automated decision-making that produces legal or similarly significant effects in relation to you. Where we use AI sub-processors to power in-store product recommendations (see A and E), those features assist your shopping experience but do not produce legal or similarly significant effects.
Data Protection contact: dpo@cloudshelf.ai
Postal address: Cloudshelf Limited, 36-38 Cornhill, London, United Kingdom, EC3V 3NG.
EU Representative (Article 27 GDPR): Ghislain Ulrich, Paris, France — contact via dpo@cloudshelf.ai.
Our website and services may contain links to other websites operated by third parties. Those websites have their own privacy practices. We are not responsible for them — please check their notices before providing personal data to them.
We may update this policy from time to time as the law changes, as our services change, or as a result of customer or regulator feedback. Where we make material changes that require your consent, we will contact you. A change log is set out below.
Cloudshelf software uses your existing digital content to automatically create AI-driven buyer guides and endless-aisle experiences on digital devices, that help secure sales in your stores by making it easy to promote and sell the product your customers are looking for.
