Legal

Privacy Policy

Last updated: October 4, 2026

Shelf Alerts ("we", "our", "us") is operated by Warehouse One LLC, San Pedro, CA, United States. This policy describes how we collect, use, retain, and protect personal information when you use our Shopify application and related services.

1. Information We Collect

When a shopper subscribes to availability notifications through a merchant's storefront, we may collect:

  • Email address to send back-in-stock or price-drop notifications
  • Phone number if the shopper opts in to SMS notifications
  • Name if optionally provided
  • Product and variant information to identify which item the shopper wants to hear about
  • IP address for consent records, abuse prevention, and rate limiting
  • Push subscription data if the shopper opts in to browser notifications
  • Notification engagement such as whether a message was delivered, opened, or clicked

When a Shopify merchant installs Shelf Alerts, we also access store data made available by Shopify APIs as authorized by that merchant, including products, inventory, orders, and related configuration data needed to operate the service.

2. Browse Tracking (Shopify Web Pixel)

Shelf Alerts includes a Shopify web pixel extension that records product views on the merchant's storefront so the merchant can re-engage shoppers who browsed an item but did not buy it. This is the data source for the retargeting feature.

When a shopper views a product page, the pixel may record:

  • A Shopify-assigned visitor identifier for the browsing session
  • Product details — product ID, title, URL, image, price, and currency
  • Email address and Shopify customer ID only when the shopper is logged in to the merchant's store

The pixel runs inside Shopify's customer privacy framework and only records events while the storefront visitor's analytics and marketing consent both permit it. If consent is absent, or is withdrawn during the visit, no further browse events are recorded. The pixel does not record payment details, checkout contents, or browsing activity outside the merchant's storefront.

Browse events are deleted automatically 30 days after the last view (see section 5).

3. How We Use Information

We use this information to provide the product's core functionality, including:

  • Capturing back-in-stock and price-drop notification subscriptions
  • Sending notifications through the channel selected by the shopper
  • Supporting merchant analytics for subscribers, opens, clicks, conversions, and attributed revenue
  • Processing consent, unsubscribe, and privacy-related requests
  • Operating adjacent product features such as wishlists, the low-stock counter, and retargeting where enabled by the merchant
  • Enforcing plan allowances, rate limits, and abuse prevention

We do not sell customer personal data. SMS opt-in data, phone numbers, and consent records will not be shared with third parties or affiliates for marketing or promotional purposes. No mobile information will be shared with or sold to third parties.

4. SMS Notifications

If a shopper provides a phone number and opts into SMS alerts:

  • They may receive up to one SMS message per product per restock or price-drop event they requested
  • Message and data rates may apply depending on the carrier or messaging provider
  • They may opt out of SMS by replying STOP
  • They may request support by replying HELP
  • They may re-subscribe to SMS after opting out by replying START
  • SMS consent is not required to purchase, complete a transaction, or receive email alerts

SMS delivery is handled through Twilio. As stated in section 3, SMS opt-in data, phone numbers, and consent records are never shared with third parties or affiliates for marketing or promotional purposes, and no mobile information is shared with or sold to third parties.

5. Data Retention

We retain personal data only as long as it serves the purpose it was collected for. The following periods apply:

  • Notification records (sends, opens, clicks, conversions) — 12 months
  • Subscriber records — 24 months after the subscriber's last activity
  • Wishlist records — 24 months after the shopper's last activity
  • Browse events from the web pixel — 30 days after the last view
  • Webhook processing logs — 7 days after receipt
  • Privacy request records — retained as evidence that a deletion or access request was received and carried out, even after the underlying personal data has been deleted

When a merchant uninstalls the app, the store's record is scheduled for deletion and the associated shopper data is removed on the schedule above or sooner. When Shopify sends us a customer redaction request, we delete that shopper's subscriber, notification, wishlist, and browse-event records for the store immediately rather than waiting for these periods to elapse.

6. Security

We use reasonable technical and organizational safeguards to protect personal data, including encryption in transit, encrypted managed infrastructure, environment separation, and access restrictions. Sensitive identifiers such as phone numbers and email addresses are partially redacted in operational logs where appropriate.

7. Data Sharing and Subprocessors

We share data only with service providers necessary to operate Shelf Alerts, such as:

  • Shopify for platform integration and webhook delivery
  • Amazon Web Services (AWS) for hosting, data storage, and queueing
  • Amazon SES for email delivery
  • Twilio for SMS delivery and delivery status
  • Connected merchant integrations such as Klaviyo, Mailchimp, Omnisend, or Zapier, only when the merchant explicitly enables and authorizes them

Where a merchant enables an integration, the merchant decides what is sent and becomes responsible for how that provider handles the data under its own privacy terms. We do not share data with any provider a merchant has not connected.

8. International Data Transfers

Shelf Alerts is operated from the United States. Personal data we process is stored and processed on Amazon Web Services infrastructure in the United States (region us-west-2), and our email and SMS providers may process message content and delivery metadata in the United States and other countries in which they operate.

If a shopper or merchant is located outside the United States, their personal data is transferred to and processed in the United States, which may have different data protection rules than their own jurisdiction. Where a merchant connects a third-party integration, data is additionally transferred to that provider's own processing locations under that provider's terms.

We transfer only the data needed to deliver the service, and only to the providers listed in section 7. If you need to know the specific transfer mechanism that applies to your jurisdiction, contact us at privacy@shelfapps.io and we will tell you what is in place.

9. Cookies and Tracking

The shelfapps.io marketing site does not set tracking cookies and does not run analytics, advertising, or session-replay scripts. We do not display a cookie consent banner because no non-essential cookies or trackers are processed when you visit this site.

When Shelf Alerts is installed on a merchant's Shopify store, the merchant's own cookie and tracking policy applies. Storefront tracking by Shelf Alerts is limited to the features the merchant has explicitly enabled — the web pixel described in section 2, and optional Google Analytics event forwarding — and operates within Shopify's customer privacy consent framework alongside the merchant's privacy notice.

10. Your Rights

Depending on jurisdiction, users may have rights to access, correct, delete, port, or object to certain processing of their personal data. Shoppers may also unsubscribe from notifications using the controls provided in those messages — the unsubscribe link in every email, or a STOP reply to any SMS.

Because we process shopper data on behalf of the merchant whose store collected it, a shopper may raise a request either with that merchant or directly with us. For privacy-related questions or requests, contact privacy@shelfapps.io.

11. Children's Privacy

Our services are not directed to children, and we do not knowingly collect personal information from children.

12. Policy Updates

We may update this policy from time to time. Any changes will be reflected on this page along with the updated effective date.

13. Contact

Shelf Alerts is operated by Warehouse One LLC, San Pedro, CA.
San Pedro, California, United States
Email: privacy@shelfapps.io
Website: shelfapps.io