Privacy Policy
What personal data we hold, why we hold it, and for how long — including business contact data collected from public sources.
These policies are published in English. The English text is the authoritative version; translations are provided for convenience only.
Last updated: 2026-08-01
The registered company details for this service have not been published yet. They will appear here and in the footer as soon as they are confirmed.
1. Controller
The controller for the personal data described here is [LEGAL ENTITY NAME — TO BE SUPPLIED], [REGISTERED ADDRESS — TO BE SUPPLIED]. Privacy contact: privacy@shelftap.com.
2. Data we collect about our users
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, password hash, Google account identifier and profile picture URL | Creating and securing your account | Performance of the contract |
| Plan, payment records and NOWPayments callback payloads | Billing and dispute handling | Performance of the contract; legal obligation |
| Searches you run and their results | Delivering the Service and showing your history | Performance of the contract |
| Contact-form and listing-request submissions, including your IP address and browser user-agent | Answering you and preventing abuse of the form | Legitimate interest |
| Documents you upload to claim or verify a company | Checking that you may represent that company | Legitimate interest; performance of the contract |
| Google Analytics measurement data | Understanding how the site is used | Consent — only collected if you accept analytics cookies |
3. Business contact data collected from public sources
ShelfTap's core function is to find companies. To do that we collect company-level information
that is already published: company name, address, website, generic mailboxes such as
info@ or export@, switchboard numbers, product pages and the source
URL each fact came from. Some of that information can identify an individual — a named
salesperson on a public "contact us" page, for example.
We process it on the basis of legitimate interest in operating a B2B discovery service, and only for business-to-business purposes. The balancing test is published in full on the KVKK and GDPR legal basis page. We do not collect special categories of data, we do not collect consumer data, and we do not buy contact lists.
If you are a listed company or a person named in a listing, you can have the entry corrected, restricted or deleted without creating an account. Use the Remove or correct a company listing form or write to privacy@shelftap.com. We do not require you to prove a legal interest before we act on a deletion request for a public-source listing.
4. Who we share data with
Only the sub-processors listed on the Sub-processors page, each for the single purpose stated there. We do not sell personal data and we do not share it for advertising.
5. International transfers
Several sub-processors operate outside the country where the Service is hosted. Where data leaves the EEA, United Kingdom or Türkiye it is transferred under the provider's standard contractual clauses or equivalent mechanism.
6. How long we keep it
Retention windows for each category, and the scheduled job that enforces them, are published on the Data Retention page.
7. Your rights
- Access a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have data erased, including a listing built from public sources.
- Restrict or object to processing based on legitimate interest.
- Receive the data you gave us in a portable format.
- Withdraw analytics consent at any time by clearing the
shelftap_consentcookie. - Complain to your supervisory authority — in Türkiye the KVKK Board, in the EEA your national data protection authority, in the UK the ICO.
Send requests to privacy@shelftap.com. We aim to acknowledge within 5 days and to resolve within 30 days.
8. Cookies
We set two strictly necessary cookies: the authentication cookie
(HttpOnly, Secure, SameSite=Lax, 30 days) and the language
preference cookie (HttpOnly, SameSite=Lax, 1 year). Google Analytics
cookies are set only after you accept them in the banner; your choice is stored in the
shelftap_consent cookie. Rejecting analytics does not degrade the Service.
9. Security
The controls actually implemented are listed, without embellishment, on the Security Overview page. Our breach-notification commitment is on the Incident Response page.
10. Changes
Changes are published here with a new "last updated" date. Material changes are emailed to account holders.