Data processing addendum
For a customer whose use of Shelf involves personal data: who decides what, how it is kept safe, what happens in a breach, and when it is deleted.
The short version
- It applies when your company’s people hold Shelf accounts. For what they save there, you are the controller and we are the processor.
- We process it only to run the service. We do not sell it, share it for advertising, or train anything on it.
- We tell you about a breach within 72 hours of learning of it.
- A signed copy is available on request.
How to use this page
This addendum forms part of the terms for any customer whose use of Shelf involves personal data. It applies as it stands, with nothing to sign. If your company needs a signed PDF, write to support@seetheshelf.com and we return one within one working day.
1. Roles
Where your people hold accounts, you decide who they are and what they watch. For that data you are the controller (the data fiduciary, in the words of India’s Digital Personal Data Protection Act) and Apexlayer Technologies Private Limited (CIN U58201HR2025PTC135312) is the processor.
For running the service itself, which means billing, the security log and answering support, we act on our own account, as the privacy page sets out. The measurements contain no personal data: they are product listings the apps show in public.
2. Scope
- Subject matter: providing the Shelf service.
- Duration: the term of the agreement, and until the data is deleted under section 7.
- Whose data: your employees and contractors who hold accounts.
- Which data: work email address, sign-in times, what they save to watch, and where their alerts are sent.
3. Instructions
We process the data only on your documented instructions, which for most customers means: run the service. We do not sell it, share it for advertising, or train anything on it.
4. Sub-processors
Cloudflare (the network in front of the site), Oracle Cloud (our servers, and the database we operate on them), Razorpay (payments), ZeptoMail (Zoho) (the mail we send you), Google (visit counts on the public pages, and a call you book), Microsoft (Clarity) (how the public pages are used), Slack (only if you point an alert at a Slack webhook). Nobody else, and no data broker. What each does and what it sees is on the sub-processors page. We give 30 days’ notice on the changelog before adding one, and you may object.
5. Security
- Everything between your browser and us travels encrypted.
- A session is a random token, stored only as a hash. A sign-in code is stored only as a hash, and is gone 75 minutes after it was sent. There is no password to steal.
- A webhook’s signing secret is stored sealed, so a copy of the database cannot sign a message as us.
- The server answers a request only with the data of the account whose session asked, so one account cannot read another.
- Payments are taken by Razorpay. A card never reaches our servers.
- Access to the servers is limited to the founder and named operators.
The security page says more, including what is not built yet.
6. A breach
We notify you without undue delay, and in any case within 72 hours of becoming aware, with what we know, what we do not yet know, and what we are doing.
7. Deletion
An account holder can delete their account from the account page, and it is removed at once. On termination we delete the remaining personal data within 90 days. The one exception is the payment records that Indian tax law requires us to keep for eight years.
8. Audit
We answer a security questionnaire once a year for each customer, and we will support an audit at your cost with 30 days’ notice.
Apexlayer Technologies Private Limited, CIN U58201HR2025PTC135312. Registered office: C/O WeWork India, DLF Forum, DLF Cyber City Phase III, Sector 24, Gurugram, Haryana 122002, India. A question about this page goes to legal@apexlayer.in.