What we keep about you, and why

Who is responsible

Apexlayer Technologies Private Limited (CIN U58201HR2025PTC135312), C/O WeWork India, DLF Forum, DLF Cyber City Phase III, Sector 24, Gurugram, Haryana 122002, India. In the words of India’s Digital Personal Data Protection Act, we are the data fiduciary for the account data described on this page.

What we collect

• Your account. Your email address, and when you first and last signed in. There is no password to lose.
• Each browser you sign in from. One record a browser: when it signed in, when it was last used, and the line the browser sends to describe itself (its name and its system). A session ends after 30 days without use and after 180 days in any case, and an account keeps at most ten.
• What you watch. The brands, products, cities and rivals you save, and the alerts you set up, including a Slack webhook, a webhook address of your own or a phone number if you add one. A webhook’s signing secret is stored sealed, so a copy of the database cannot sign anything.
• What you tell us at setup. Your role, your company if you give it, the apps and the questions you pick, and the rivals you name. A phone number only if you type one and tick the box asking a person to reach you on it. Untick it and the number is removed. And where you came from: the tag of an ad or a partner’s link you arrived by (an ad’s name, never anything about you), or else the site that linked to us.
• What you ask us. A request to add a brand, a product, a keyword or a city, with any product link you paste. A person reads the link. No machine opens it.
• A note from the talk page. If you ask for a walkthrough, a call back or an answer: the name, email address, brand and message you send, and a phone number if you give one. It is used to reply to you and for nothing else.
• A call you book on the talk page. The time you pick, your email address, and your name, brand or company and note if you type them. The call goes on our Google calendar with a Google Meet room, and we send you the invitation from our own address; your note stays with us and is not put in the invitation. It is used for the call and for nothing else.
• Payments. Razorpay takes the payment. We store its payment id, the amount and what it bought. We never see your card.
• Invoices, and your GST details if you give them. Every payment has a tax invoice. If you ask for it in a company’s name, we keep the company name, its GSTIN and its address: on that invoice, and on your account for the next payment, where you can change or remove them.
• Files you write. When a plan writes Excel or CSV files: when each was written, from which screen, in which format and how many rows, so the monthly count on your Exports screen is true.
• Mail we send you. Which kind of mail went to your address, its subject line and when. Never its text, and a sign-in code is blanked out of the subject.
• A security log. A short record of sign-ins, sign-outs, plan changes and deletions, with the network address the request came from: a full IPv4 address, or the first half of an IPv6 one. It never holds a password, a code or anything you typed.
• How the site is used. Every page counts its visits with Umami, which runs on our own server and sets no cookie: the page, the site you came from, and the kind of browser and device. On the public pages, Google Analytics also counts visits, and Microsoft Clarity shows us how a page is used (clicks, scrolling, where a visit ended), with what you type hidden. Neither of those two runs on the signed-in screens, on sign-in, on setup, on an invoice or on a booked call’s page.
• How the site performs. For each request for figures: which kind of request, the location of the network that served it, how long it took and its size. No account and no address is in that record.

What we do not collect

No advertising scripts. No analytics from another company on the signed-in screens. No fingerprinting. No bought contact lists. We never ask for a seller login or an ad account, so we hold none of your sales, orders or ad spend.

The measurements themselves are product listings the apps show in public, read the way a shopper in a pincode sees them. They contain no personal data.

Cookies, and what stays on your device

Shelf sets no cookie of its own. Your sign-in is kept in your browser’s local storage, and it leaves your device only as a header on requests to our own servers. The same storage holds what the product remembers between visits, such as the brand and the city you last looked at, and for 30 days the tag of an ad or a partner’s link you arrived by, which is sent only if you sign up. Signing out removes the sign-in.

Other companies may set a cookie while you use the site. Cloudflare, the network in front of the site, may set a short-lived security cookie to tell people from bots. Razorpay’s checkout loads on the page at the moment you buy a plan, and only then, and may use cookies of its own. On the public pages only, Google Analytics and Microsoft Clarity set cookies of their own to tell one visit from the next. Our own visit count sets none.

Who it reaches

Cloudflare (the network in front of the site), Oracle Cloud (our servers, and the database we operate on them), Razorpay (payments), ZeptoMail (Zoho) (the mail we send you), Google (visit counts on the public pages, and a call you book), Microsoft (Clarity) (how the public pages are used), Slack (only if you point an alert at a Slack webhook). Nobody else, and no data broker. What each one does and what it sees is on the sub-processors page.

The database that holds your account and what you watch is ours, and we operate it. An alert you point at a webhook of your own is posted to that address and nowhere else.

How long we keep it

• Your account and what you watch: for as long as the account exists.
• A sign-in code: stored only as a hash, and gone 75 minutes after it was sent.
• The record of a sign-in mail: 30 days.
• The security log: 400 days.
• Payment and invoice records: eight years, because Indian tax law requires it. An invoice keeps the GST details it was made out to.

Your choices

Both are buttons on your account page, so you do not have to ask anyone.

Download my account data gives you a file with everything we hold that is about you: your account, your plans, what you watch, your alerts, your export history, your setup answers, your requests and any note you sent from the talk page.

Delete my account removes all of that at once, signs out every browser, and takes your email address off the security log. Payment and invoice records stay for eight years, because Indian tax law requires it and we cannot lawfully drop them. The GST details kept for your next payment go with the account. A record of each data file you downloaded (what it held, and when) is kept for two years, also after an account is deleted, as a record of the licence; after a deletion it holds a scrambled form of the address, never the address itself.

If you would rather a person did it, write to support@seetheshelf.com. We act within one working day and finish within thirty.

Grievance officer

Under the Digital Personal Data Protection Act 2023 and the IT Rules, our grievance officer is Sachin Gurjar, Director, Apexlayer Technologies Private Limited, dpo@apexlayer.in, C/O WeWork India, DLF Forum, DLF Cyber City Phase III, Sector 24, Gurugram, Haryana 122002, India. A complaint is acknowledged within 72 hours and answered within 30 days. If you are not satisfied, you can take the matter to the Data Protection Board of India.

Changes to this page

A change that matters is announced on the changelog with its date, and this page always states when it last changed. We do not edit it silently.

Apexlayer Technologies Private Limited, CIN U58201HR2025PTC135312. Registered office: C/O WeWork India, DLF Forum, DLF Cyber City Phase III, Sector 24, Gurugram, Haryana 122002, India. A question about this page goes to legal@apexlayer.in.