This policy explains what personal data [YOUR COMPANY NAME] ([KVK NUMBER], [ADDRESS]) processes when you use Shelfwords, why, and what your rights are under the GDPR. Contact for privacy questions: [CONTACT EMAIL].
What we store
- Account: your email address, a salted hash of your password (never the password itself), your credit balance, the date you joined, and whether you confirmed your email.
- Your work: the product facts you enter, the texts written for you, your edits, templates and brand defaults.
- Billing: the billing details you enter (company, contact, address, VAT number) and the history of your credits.
- Waitlist: if you leave your email on the coming soon page, we keep it to send you one email when Shelfwords opens and to add your bonus credits when you sign up with it. We delete the list after launch, or sooner if you ask.
- Feedback: ratings and notes you send us.
- Usage: how many AI calls and tokens your requests used, so we can control cost and fair use.
- Technical: a session cookie, and short-lived server logs.
Why, and on what legal basis
To provide the service you asked for (contract), to keep it secure and prevent abuse and to control costs (legitimate interest), to send account emails such as email confirmation and password reset (contract), and to meet legal duties such as bookkeeping (legal obligation). We do not send marketing email without your consent.
Who else processes data
- AI provider: Anthropic. The product facts and instructions you submit are sent to its API to generate texts and research. Do not enter personal data about people in product facts. [CHECK AND CITE THE CURRENT ANTHROPIC DATA PROCESSING TERMS AND DATA LOCATION.]
- Hosting: [YOUR HOSTING PROVIDER AND LOCATION].
- Email delivery: [YOUR EMAIL PROVIDER, for example Resend] sends account emails.
We do not sell personal data.
Cookies
We set one cookie, sw_session, that keeps you signed in. It is strictly necessary for the service, so no consent banner is needed. We use no advertising or tracking cookies and no analytics that identify you. If that changes, we will ask first.
How long we keep data
Account data and your texts are kept until you delete them or your account. Sessions expire after 30 days. Password reset links expire after 1 hour and confirmation links after 7 days. After you delete your account we keep only anonymous usage totals. Backups are overwritten within [BACKUP RETENTION, for example 30] days. Bookkeeping data is kept for the period the law requires.
Your rights
You can see, download and delete your data yourself on the Profile page. You can also ask us to correct your data, restrict or object to processing, or give you your data in a portable format, by writing to [CONTACT EMAIL]. We answer within one month. You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Passwords are stored hashed with scrypt. Connections use HTTPS. Access to the admin page is limited to named administrators. No system is perfectly secure, and we will report a data breach as the law requires.
Changes
We will update this policy when something changes and show the date of the last update here: [DATE].