Privacy Notice
Version 2026-11-beta-1 · DRAFT FOR ATTORNEY REVIEW · not legal advice
This notice explains what Ucheema Asset Solution LLC, doing business as Shelfworth ("we"), collects when you use the Shelfworth beta, why, who processes it, and how long we keep it. Shelfworth is a business tool for finance teams; it is not intended for consumers or anyone under 18.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account data | Your work or personal email address, and your name if you add it | To invite you, send sign-in links and show who did what |
| Customer Data (your organization's) | Uploaded inventory files (item numbers, descriptions, quantities, costs, dates, locations, order quantities), calculated results, policy settings, override notes | To provide the service. Columns with customer or vendor names are not imported |
| Activity records | Sign-ins, overrides, exports, with the time and user | Audit trail of who changed what (part of the product), and security |
| Technical data | Session cookies, IP address and browser type in server logs | To keep you signed in and protect the service |
We do not use advertising or tracking cookies, analytics trackers, or sell or rent data.
Cookies
Only essential session cookies that keep you signed in. They are HttpOnly (not readable by page scripts) and expire after you sign out or the session ends.
Who processes data for us (subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | United States |
| Render Services, Inc. | Hosting the application | United States |
| Resend | Sending sign-in emails | United States |
| Anthropic, PBC | AI text features, only if your organization turns them on; text fields only (never quantities, costs, dates or amounts); deleted by Anthropic within 30 days and not used for training under its API terms | United States |
We will update this list before adding a new subprocessor that handles Customer Data.
How long we keep data
- Customer Data: until your organization asks us to delete it, the beta ends, or the account is closed. We then delete it within 30 days.
- Uploaded raw files: may be deleted earlier (after the calculated results and workpapers are produced) to keep only what's needed.
- Account data: while your invitation is active, and then as needed for legal and security records.
- Server logs: a limited period for security, then deleted.
Security
- Each organization's data is isolated in its own workspace by tested database access rules.
- Access is invite-only, with emailed one-time sign-in links.
- Data is encrypted in transit (HTTPS) and at rest by our hosting providers.
- We never connect to or write to your accounting system.
No system is perfectly secure. If we learn of a breach affecting your data, we will tell you without undue delay.
Your choices and requests
You can ask to see, correct, export or delete your account data or your organization's Customer Data by emailing hello@getshelfworth.com. We respond within 30 days. Where your organization controls the data, we may need an authorized person from the organization to confirm the request.
Changes
We'll post updates in the app and ask for your acceptance when they matter.
Contact
Ucheema Asset Solution LLC · hello@getshelfworth.com · c/o Republic Registered Agent LLC, 17350 State Hwy 249, Ste 220, Houston, TX 77064