Privacy policy

Effective 2026-10-22 · Version 1

Status: draft, not reviewed by a lawyer.

1. Who we are

Shop Top Shelf is operated by AI Eh-B'y, a Canadian company based in Newfoundland and Labrador ("we", "us"). We are responsible for the personal information we hold and follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector.

Our Privacy Officer is the person in charge of the protection of personal information and handles questions, requests and complaints: privacy@ai-eh-by.ca. For anything else, write to privacy@ai-eh-by.ca.

This policy covers every part of Shop Top Shelf:

the website shoptopshelf-sb.ai-eh-by.ca;
the web app at app.shoptopshelf-sb.ai-eh-by.ca, including public shop pages, product pages, smart links and shared wish lists, in a browser or installed on your phone or computer;
the emails, text messages and notifications we send, including the campaigns associates send through us.

Shop Top Shelf has two kinds of users. Associates sell the products of a direct-sales company and run a shop here. Customers browse shops, and may sign in to follow associates, like products, keep wish lists and write reviews. Every account is a customer account; it becomes an associate account when its owner creates a shop. Associates are independent sellers: when this policy says an associate receives or uses your information, the associate is responsible for their own use of it.

2. What we collect

Account

Your name, email address, profile photo (if your sign-in provider shares one), the ID your sign-in provider gives us (Google, Apple where offered, or your email address and password), your language, time zone, country and display theme. If you sign in with an email address and password, the password is handled by Google Identity Platform; we never see it or store it in readable form. Optionally, a mobile phone number, verified by a code, if you turn on text messages. Your plan (Free, Pro or Team), trial dates and subscription status.

Shops and content

If you create a shop: its handle, name, bio, photos, cover image, theme, the companies you sell for, your social media links and contact settings; your products (name, description, photos, price, your buy link, notes, collections); the content you create or generate (captions, hashtags, stories, scripts, images); your campaigns, scheduled posts and their results; your team membership. If you connect a social media account, the account's ID, username, the permissions you granted and an access token, stored encrypted (section 13.1). The AI shop setup draft made from your posts (section 13.1).

Customer activity

If you sign in as a customer: the shops you follow and your notification choices for each, the products you like, your wish lists (name, products, occasion, alert settings, whether it is shared by link), your reviews (stars, text, photos), your messages to and from associates, the products you viewed and the buy links you clicked (your history), your favourite categories and companies, and your privacy choices.

Contacts held for associates

Associates can keep a contact list. It holds the name, email address and (optionally) mobile phone number of people who signed up to that associate's updates, followed that associate and chose to share their email address with associates they follow, or were added or imported by the associate; with tags, notes, the source of each contact, the consent recorded (when, how and with what wording), unsubscribes, the last smart-link click and the products viewed through that associate's links. We hold this list on the associate's behalf (section 13.4).

Device and usage

Clicks on shops and smart links: the link, shop, product, campaign and channel, the time, the website that sent you (its host name only), the kind of device (phone, tablet or computer), the country our hosting reports for the request, whether you went on to the buy link, your account if you are signed in, and a daily visitor code made by hashing technical details with a secret that changes every day. We do not store your IP address with these records (section 13.3).
Delivery records: for each email, text message and push notification, the address, number or device it went to, the type of message, the language, the time and whether it was delivered. Never the body of an email or text message beyond the template and its values; for push, only the title.
Notifications: if you turn on push notifications, your browser's push address and keys; your notification choices and quiet hours.
Consent records: the versions of the terms, this policy and the acceptable use policy you accepted, and each opt-in you gave (section 4), with the date and time, language, the wording version you saw, and where you gave it.
Technical: our hosting keeps request logs (IP address, browser, time, page and errors) for security and troubleshooting. We use no advertising or analytics tools, no crash-reporting tools and no third-party trackers.

This website

Forms: what you send through the contact, support or account deletion forms (name, email address, topic, message, and the page and language you used). We store it in our database in Canada, with whether it was delivered, and send it to our team by email.
Theme setting: if you choose light or dark, your browser remembers it (section 8).
Cookies: the website sets none.

The installable web app

You can install the web app on your phone or computer from your browser. It asks for one permission only, notifications, and only when you turn them on. It uses no location, contacts, camera, microphone or calendar permission; choosing a photo to upload uses your device's file picker, and only the photo you pick is sent.

3. Why we use it, and what we never do

We use this information only to run the service: sign you in; show shops, products, reviews and the discovery pages; let associates manage their shop, contacts, content, campaigns and analytics; let customers follow, like, save, review and message; send the emails, text messages and notifications described in this policy; draft shop profiles and content with AI when you ask; screen public content against our acceptable use policy; process subscriptions; keep the service secure; record consent; and comply with the law.

We never sell personal information, never use it for advertising or to build advertising profiles, never track you across other websites or apps, and never give your content to anyone to train AI models. A customer's follows, likes and wish lists are shown to associates only as counts, unless the customer chooses otherwise (section 4).

Automated decisions: our screening (section 13.7) can hold a review, a message or a public text before it is published when it looks like it breaks the acceptable use policy. We tell you when that happens; you can edit it or ask for a person to review it at privacy@ai-eh-by.ca. Trending and "Because you liked" rows are ranked automatically from clicks, likes, follows, reviews and recency.

By creating an account you agree to this use; the sign-in screen says so, and we record which versions of the terms, this policy and the acceptable use policy you accepted.

Optional choices start off, are separate and are never bundled with sign-in: push notifications (each type separately), email updates from shops you follow (each type separately), text messages (each type, after you verify your number), sharing your email address with associates you follow, showing your activity, signing up to a shop's updates (confirmed by a link we email you), and connecting a social media account. You can withdraw any of them at any time: change Settings, turn off notifications on your device, use the unsubscribe link in any email, reply STOP to a text message, disconnect a social account or delete your account. Without some information (for example your email address) you cannot have an account.

Associates who import contacts confirm, each time, that every person gave them express consent to receive their emails (and, for texts, their text messages); we record that attestation and the source of each contact.

Everyone, on public pages: shop profiles, live products, collections, follower and like counts, ratings and reviews (with the reviewer's display name and photo, and a "clicked through from this shop" badge when it applies), and wish lists you share by link.
Associates: an associate sees their followers as a count; sees your name and email address only if you signed up to their updates, chose to share your email address with associates you follow, or they added you themselves; sees the messages you send them, your reviews of their shop and products, and clicks on their links as statistics (without your identity unless you are one of their contacts). They use contact details under their own responsibility and must follow the law and our terms.
Team leaders: an associate's team leader sees that associate's statistics only if the associate turned on sharing.
Service providers that process data for us, only to provide the service:
- Google Cloud (Canada): app servers, database, file storage for photos (Cloud Storage), Secret Manager, scheduled tasks, backups and logs, in the northamerica-northeast1 region (Montréal); pages may be delivered through Firebase Hosting, Google's worldwide network.
- Vertex AI (Google Cloud, may process outside Canada, including in the United States): runs the Claude AI models (made by Anthropic) for the AI shop setup, the content studio, insights and content screening (section 13.2).
- Google Identity Platform (United States and other countries): sign-in, including email and password and Sign in with Google.
- Apple (United States), if you use Sign in with Apple where offered.
- Google Workspace (Gmail API, United States and other countries): sends our emails and associates' campaign emails from noreply@shoptopshelf.ai-eh-by.ca, and delivers website form messages to us.
- Twilio (United States), only when text messages are turned on: sends text messages to numbers that opted in.
- Stripe (United States and other countries): subscription checkout, payments, invoices and sales tax for Pro and Team plans (section 13.5). We never see or store your full card number.
- Meta (Facebook and Instagram; United States and other countries) and TikTok (outside Canada), only if you connect an account: they receive our requests made with your permission (section 13.1).
- Your browser's push service if you turn on notifications: Apple (Safari), Google (Chrome and most Android browsers), Mozilla (Firefox) or Microsoft (Edge). It receives your browser's push address and the notification, encrypted so only your browser can read it.
Companies and stores you buy from: when you follow a buy link you leave our service; that site handles your data under its own privacy policy. We send it no personal information.
Legal reasons: when the law requires it, or in a sale or transfer of our business (we will tell you).

6. Where it is stored and transfers

Our database, photo storage, backups and logs are in Canada (Montréal). Some providers above (AI processing, sign-in, email, text messages, payments, social networks, push services and page delivery) may process data outside Quebec and Canada, including in the United States, where courts and authorities may be able to access it under local law. We use providers that protect the information by contract and with security measures comparable to ours, and we send them only what they need.

7. How long we keep it

Account data (profile, preferences, consent records, follows, likes, wish lists, history): until you delete your account. You can clear your history at any time.
Shops and their content (profile, products, collections, content library, campaigns, posts, links, statistics, contact list, team data): until the associate deletes them or their account.
Reviews: until you delete them. When you delete your account, your reviews stay, shown as "Deleted user" with no link to you, so ratings stay accurate.
Messages: messages you wrote are deleted with your account; messages others wrote to you stay with them until they delete their account or the shop is deleted.
Contacts held for associates: until the associate deletes them or their shop; an unsubscribe is kept so that associate never writes to that person again (section 13.4).
Click records: 13 months, then deleted; only daily totals per shop, product, campaign and channel (no visitor code, no account) are kept with the shop's statistics.
Delivery records: 13 months after the message was sent, or sooner if you delete your account.
AI shop setup drafts (with the posts and captions used as evidence): 30 days after the draft is ready, or as soon as you apply or discard it.
AI usage counters (how many generations you used per day): 30 days.
Uploaded originals: photos are re-encoded and stripped of location and camera data; the original upload is deleted within 1 day.
Photos you publish (shop, products, reviews): until you delete them or the shop, product or review they belong to.
Push subscriptions: until you turn notifications off, sign out on that device or delete your account; deleted sooner when the push service reports them invalid, or after 60 days without being renewed.
Moderation and report records: 1 year after they are resolved.
Admin audit log (actions our staff take, such as suspending a shop): 2 years.
Short-lived security records (sign-in attempt counters, social account connection requests): 30 days at most.
Unsubscribes and bounces: a one-way hash of the address or number (not the address itself) with the message type, kept so we never write to it again against your wishes.
Billing records (subscription events and invoices): 6 years after the end of the tax year they relate to, as Canadian tax law requires.
Backups: copies of the database made before each update of the app, stored in Canada: 35 days.
Hosting logs: 30 days.
Website form messages: 13 months after you send them in our database (then deleted automatically), and in our email for as long as needed to handle your request.

8. Cookies and storage on your device

We use no advertising or analytics cookies. What we keep on your device:

Web app: one cookie, __session (HttpOnly, Secure, 14 days), keeps you signed in; deleted when you sign out. The sign-in library (Firebase) keeps your sign-in in your browser's IndexedDB; cleared when you sign out. In your browser's local storage: shoptopshelf.lang (language), shoptopshelf.theme (theme), shoptopshelf.auth.lastProvider (which sign-in method you used last, so the sign-in screen can mark it; never your email), shoptopshelf.installBanner.dismissed (you closed the install banner). In session storage, cleared when you close the tab: shoptopshelf.pendingLink (a sign-in in progress while you link two sign-in methods), shoptopshelf.pendingReauth (a confirmation sign-in in progress, for example before deleting your account). The service worker caches the app's own files (no personal data) so it opens quickly.
Website: shoptopshelf.theme in local storage if you choose light or dark. No cookies.
When it is cleared: signing out removes the session cookie, the sign-in and this device's push subscription. Account deletion also removes shoptopshelf.auth.lastProvider. The language, theme and banner settings stay until you clear your browser's site data.

9. Your rights

Access and export: Settings > Download my data gives you a copy of your data in a structured, commonly used format (JSON); associates can also export their contact list.
Correction: edit your profile, shop and preferences in the app.
Withdraw consent: section 4.
Deletion: section 10.
If an associate holds your details: unsubscribe with the link in their email or reply STOP to their text, or ask them; you can also write to us and we will pass the request on and stop messages from that associate to you.
Other requests: write to our Privacy Officer at privacy@ai-eh-by.ca to ask for access, correction, deletion or information about how we use your data. We answer within 30 days.
Complaints: contact our Privacy Officer first. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

10. Account deletion

Delete your account in the web app from Settings > Delete account, or without the app from the account deletion page at shoptopshelf-sb.ai-eh-by.ca/delete-account. That page lists exactly what is deleted right away and what is kept, and for how long: in short, your account, profile, preferences, follows, likes, wish lists, history, messages you wrote, push subscriptions, connected social accounts and, if you have one, your shop with its products, content, campaigns, links, statistics and contact list are deleted, and any subscription is cancelled; your reviews stay as "Deleted user"; billing records (6 years), unsubscribe hashes, moderation records (1 year), the admin audit log (2 years), backups (35 days) and hosting logs (30 days) are kept for the periods in section 7.

11. Security, breaches and risks

Encryption in transit (HTTPS) and at rest; social media tokens sealed with a separate key (AES-256-GCM) kept in Google Cloud Secret Manager; database and file access limited to the app's own service account; session cookies that are HttpOnly and Secure; and logging of sensitive actions. No system is perfectly secure, and anyone who has a wish list's share link can see that list. We keep a record of every privacy breach (confidentiality incident). When a breach creates a real risk of significant harm (a risk of serious injury under Quebec law), we notify the people affected and the Office of the Privacy Commissioner of Canada and, for people in Quebec, the Commission d'accès à l'information, as the law requires.

12. Children

Accounts are for people 14 and older (section 2 of the Terms of Use). We do not knowingly collect information from children under 14. If you think a child under 14 has given us information, contact us and we will delete it.

13. Product features

An associate can connect an Instagram professional account or Facebook Page (through Facebook Login for Business) or a TikTok account. Each network asks you to grant permissions; we use them only to read your profile and your recent posts (up to the last 50: captions, media links and dates) to draft your shop, and, if you schedule posts and the network allows it, to publish the posts you scheduled. You can instead paste captions or upload screenshots. The AI drafts a bio, profile photo, the companies you sell for, products you have promoted (matched to our catalogue where possible) and a short description of your tone of voice, and shows which posts each suggestion came from. Nothing is applied to your shop until you choose it. Access tokens are sealed (section 11); disconnecting an account revokes our access where the network allows it and deletes the token. Your use of each network stays under that network's own terms and privacy policy.

13.2 AI features

Our AI features run on Claude models made by Anthropic, provided through Google Cloud Vertex AI, which may process the request outside Canada, including in the United States. We send only what the feature needs: for the shop setup, the posts in 13.1; for the content studio, the products you picked, your shop's tone of voice and your instructions; for insights, your shop's statistics; for screening, the text being checked. We do not store prompts. Generated results are kept only when you save them to your library or apply them. AI output can be wrong or inappropriate: you review it before using it and you are responsible for what you publish. A disclosure such as "#ad - I earn from sales" is added to generated social content in your language unless it is already there.

13.3 Smart links and click analytics

Every shop page, product page and smart link records the click details in section 2. We never store the IP address with a click; the daily visitor code lets us count unique visitors per day without knowing who they are, and it cannot be linked across days. Associates see these clicks only as statistics (visits, clicks, buy-link clicks, by product, campaign, channel, device type, country and referring website). A smart link opened by a social network's preview robot shows the product's title, image and shop name, the same as the public page.

13.4 Contacts, email and text-message campaigns

Associates can send email campaigns, automated emails (welcome, new product, back in stock, birthday, re-engagement) and, when text messages are turned on, text messages to their contacts. They are the sender and are responsible for having consent; we send for them, and only to contacts with recorded consent for that channel. Every campaign email names the shop, says why you receive it, gives the sender's contact information and has an unsubscribe link that works without signing in and takes effect right away; every text message accepts STOP (and ARRET or ALTO) and HELP. Campaign messages are not sent during the recipient's quiet hours where we know their time zone. Commercial messages of any kind are sent only once every element the law requires for them, including a mailing address, can be shown in them. An unsubscribe from one associate stops that associate's messages to you; it does not affect other shops.

13.5 Payments

Customers never pay us. Associates can subscribe to the Pro or Team plan. Stripe processes the checkout and payments, keeps the payment method and sends receipts; it receives your name, email address, billing country and postal code, payment details and the plan you chose. We receive your Stripe customer and subscription IDs, the plan, its status and dates; you manage your payment method and invoices in Stripe's customer portal, opened from Billing in the app.

13.6 Emails and notifications

Service emails are about your account, your shop and the shops you follow: welcome, AI draft ready, scheduled post reminders and results, new followers, reviews and messages, new products and sales from shops you follow (at most one email a day per shop), wish list price drops and back-in-stock alerts, replies, trial and payment notices, and a weekly summary for Pro associates. You choose each type, for email, push and text separately, in Settings > Notifications, and none is sent during your quiet hours (22:00 to 07:00 unless you change them). Every email identifies Shop Top Shelf and AI Eh-B'y, gives our contact address (privacy@ai-eh-by.ca) and, where it is not essential, has an unsubscribe link for that type. Push notifications are off until you turn them on and pass through the push services in section 5; they show on your lock screen, so they never include private details such as message text.

13.7 Reviews, messages and moderation

Reviews are public with your display name and photo. A review gets a "clicked through from this shop" badge when your account clicked a buy link of that shop. Associates can reply publicly. Messages between customers and associates are private between the two of you and our moderation staff. To keep the service free of banned claims (for example income or health claims), spam and abuse, we screen shop profiles, products, content, reviews and messages with rules and with the AI in 13.2; anything flagged is held for review by our staff, who can approve or remove it. Anyone can report a shop, product, review or message; reports are reviewed by our staff. Staff actions are recorded in the admin audit log.

13.8 Teams

An associate can create a team (Team plan) or join one with an invite code. Members see the team's shared templates, campaigns and content. The leaderboard and team statistics include a member only if that member turned on sharing; a member can turn it off at any time.

13.9 Buying from associates

Shop Top Shelf is not a store. Prices and buy links are set by associates; when you click "Buy", you go to the associate's own link, usually their direct-sales company's website, and buy under that company's terms and privacy policy. Shop Top Shelf is not affiliated with or endorsed by any direct-sales company unless it says so.

14. Changes to this policy

We post every change here with a new version number and effective date, and record it in our changelog. We tell you about material changes in the app or by email before they take effect, and the app asks you to accept the new version before you continue.

15. Contact

Privacy Officer: privacy@ai-eh-by.ca. General contact: privacy@ai-eh-by.ca. AI Eh-B'y, Newfoundland and Labrador, Canada.

This policy is available in English, French and Spanish, and each version has the same effect.