Legal

Privacy Policy

Last updated 28 September 2026 · Effective from that date

Shelfjet is operated by Cool Brands Pte Ltd (UEN 202324371E), 4008 Ang Mo Kio Avenue 10, #02-16, Techplace 1, Singapore 569625, Singapore. This policy explains what personal data we process, why, how long we keep it and what rights you have. It is written to meet Singapore's Personal Data Protection Act (PDPA) and the requirements of the marketplaces whose data we handle (Shopee, Lazada, TikTok Shop, Shopify). Questions and requests: privacy@shelfjet.com.

1. Two kinds of data, two roles

• Account data about the people who use Shelfjet (merchants and their staff). Here we are the data controller (in PDPA terms, the organisation collecting the data).
• Order data about the merchant's customers: buyer names, delivery addresses, phone numbers, e-mail addresses and order contents that flow in from marketplaces and web stores. Here the merchant is the controller and we are the data intermediary / processor, acting on the merchant's instructions under our Data Processing Agreement.

2. Account data we collect

• Name, work e-mail address, password (stored only as a salted scrypt hash), two-factor secret (encrypted), recovery codes (hashed).
• Organisation name, billing contact, plan, and subscription status. Card details are entered on Stripe's pages and never touch Shelfjet; we hold only Stripe's customer and subscription identifiers and the last four digits and expiry shown in the billing portal.
• Sign-in records: time, IP address and browser for each session, failed attempts, and an audit log of actions taken in the workspace (who changed what, from where).
• Support correspondence.

We use this to provide the Service, secure accounts, bill, support you and send service notices. We do not sell it or use it for advertising.

3. Order data we process for merchants

When a merchant connects a channel, Shelfjet receives orders through that platform's API and webhooks. For each order we store the buyer's name, phone, e-mail (where the platform provides it), shipping address, items, prices, payment status and the platform's order identifiers, plus courier tracking events and the shipping label. We use it only to fulfil the order: allocate stock, arrange shipment with the courier the merchant chose, print labels, update the platform, and produce the merchant's reports. The merchant remains the data controller for buyer data; Shelfjet never sells it, never uses it for marketing or profiling, and never shares it between merchants.

Marketplace platforms may impose additional rules. For Shopify we honour the customer data request, customer redaction and shop redaction webhooks automatically; for every platform (including TikTok Shop, Lazada and Shopee) we delete or redact buyer data when the platform or the merchant asks us to, and a merchant can redact a customer's data at any time from within Shelfjet or by e-mailing us.

4. Who we share data with

• Marketplaces and web-store platforms you connect, to update order and stock status.
• Couriers you choose, to create the shipment and label (name, address, phone, parcel details).
• Payment processing: Stripe Payments Singapore Pte Ltd handles subscription payments (billing contact name and e-mail, card details you enter on Stripe's pages, invoices). Card data never touches Shelfjet. Stripe's own privacy policy applies to what it collects.
• Infrastructure providers: Render (application hosting and managed PostgreSQL, Singapore region), Slack (only if you enable the Slack integration), e-mail delivery for service notices.
• Authorities, where the law requires it.

We do not sell personal data to anyone. Data is hosted in Singapore. Where a platform or courier you use is outside Singapore, the transfer is under your instruction as the merchant; where we transfer data ourselves (for example to Stripe or Slack) we ensure the recipient protects it to a standard comparable to the PDPA.

5. Retention and deletion

6. Security

Credentials and tokens are encrypted at rest (AES-256-GCM); passwords are hashed; all traffic uses TLS with HSTS; the database accepts no connections from the internet; owners and administrators must use two-factor authentication; every release runs an automated tenant-isolation test across the whole API; access and changes are audit-logged. We will tell affected merchants without undue delay if a breach affects their data, and notify the Personal Data Protection Commission where the PDPA requires it.

7. Your rights

Under the PDPA you may ask for access to the personal data we hold about you and how it has been used or disclosed in the past year, and ask us to correct it. You can access, correct or export your account data from Settings, and close your workspace at any time; for anything else, write to our Data Protection Officer at privacy@shelfjet.com. We respond within 30 days and may charge a reasonable fee for access requests, which we will tell you in advance. Buyers whose data was processed on a merchant's behalf should contact the merchant, who can act in Shelfjet; we will assist the merchant with any request. You may also withdraw consent to our use of your account data by closing your workspace, and you can complain to the Personal Data Protection Commission (pdpc.gov.sg) if you are unhappy with our response.

8. Cookies

The app uses one strictly necessary session cookie and no tracking or advertising cookies. The marketing site sets no cookies.

9. Changes

We will post changes here and, for material changes, notify workspace owners by e-mail or in the app at least 14 days in advance.

Contact

Data Protection Officer (Edison Lim), Cool Brands Pte Ltd (UEN 202324371E), 4008 Ang Mo Kio Avenue 10, #02-16, Techplace 1, Singapore 569625, Singapore · privacy@shelfjet.com · General support: support@shelfjet.com