Privacy Policy

Last updated: January 19, 2026

1. Information We Collect

Personal Information:

  • Account Information: Name, email address, business information
  • Billing Information: Processed securely via Paystack (we never store payment details)
  • Form Data: The forms you create and their configuration settings
  • Submission Data: All data collected through your forms (names, emails, messages, files)

Technical Information:

  • Usage Data: How you interact with our service, feature usage, timestamps
  • Device Information: IP address, browser type, operating system
  • Cookies: Essential cookies for service functionality

2. How We Use Your Information

We use your information to:

  • Provide and maintain Shelfcue services
  • Sync form submissions to your connected Google Sheets
  • Process payments through Paystack
  • Send service-related emails via Resend
  • Improve our services and develop new features
  • Comply with legal obligations (CCPA/Kenyan law)

3. Data Storage & Security

  • Storage Location: Google Cloud servers
  • Retention Period: 12 months after account cancellation
  • Security Measures: Encryption in transit and at rest, secure access controls
  • Your Form Data: You own all data collected through your forms. We act as a processor.

4. Google Services Integration

When you connect your Google account, Shelfcue integrates with Google Sheets and Google Calendar to provide core functionality:

Google Sheets:

  • What We Create: When you publish a form, we automatically create a new Google Sheet in your Google Drive named "[Form Title] - Responses". This sheet is owned by you and stored in your Google Drive.
  • What We Write: Each time someone submits your form, we append a new row to your sheet containing:
    • A timestamp of when the submission was received
    • All form field values (names, emails, messages, etc.)
    • Meeting date/time (if your form includes meeting scheduling)
    • Calendar event link (if a meeting was created)
  • What We Don't Do: We do not read, modify, or delete existing Google Sheets that we did not create. We do not access other files in your Google Drive. We do not share your sheets with anyone.
  • Your Control: You own and fully control all Google Sheets created by Shelfcue. You can view, edit, delete, or share them at any time through Google Drive. You can revoke our access at any time from your Google Account settings.

Google Calendar:

  • What We Read: When a prospect submits a form requesting a meeting, we query your Google Calendar to check existing events and identify available time slots. This prevents scheduling conflicts and double-booking.
  • What We Create: When a meeting is successfully booked through your form, we automatically create a calendar event in your selected Google Calendar with the meeting details (date, time, attendee information, and meeting notes). This eliminates the need for manual calendar entry.
  • When We Access: Calendar access is only used when:
    • You have explicitly enabled Google Calendar integration in your account settings
    • A form submission contains a meeting booking request
    • We need to verify availability and create the corresponding calendar event
  • What We Don't Do: We do not read, modify, or delete existing calendar events that we did not create. We do not access calendar data for any purpose other than booking automation. We do not store, share, or sell your calendar data.
  • Your Control: You own and control all calendar events created by Shelfcue. You can view, edit, or delete them at any time through Google Calendar. You can revoke our calendar access at any time from your Google Account settings, which will prevent new meeting bookings from being automatically added to your calendar.

Permissions We Request:

  • Create and manage Google Drive files: Required to create new Google Sheets and write form submission data. This scope only allows access to files that Shelfcue creates, not your existing files.
  • View and manage Google Calendar: Required to (1) read your calendar events to check availability and prevent double-booking conflicts, and (2) automatically create calendar events when meetings are booked through form submissions. This scope is essential for our scheduling automation feature and is only used when you have explicitly enabled Google Calendar integration and a form submission includes a meeting booking request.

You can revoke these permissions at any time from your Google Account settings. Revoking access will prevent new form submissions from syncing to Google Sheets, but existing sheets and data will remain in your Google Drive.

5. Data Sharing & Disclosure

We never sell your data. We only share data with:

  • Google Services: As described in Section 4 above, when you connect your Google account
  • Paystack: For payment processing only
  • Resend: For transactional email delivery
  • Legal Requirements: When required by law

6. Supabase Authentication

We use Supabase to securely manage user authentication and data storage.

During Google Sign-In, you may briefly be redirected to a Supabase domain (ending in .supabase.co) for verification. This process is secure and required for login functionality. Supabase does not have access to your personal data beyond what is necessary to authenticate your account.

7. Your Rights (CCPA & GDPR Compliance)

You have the right to:

  • Access and download your personal data
  • Correct inaccurate information
  • Delete your account and associated data
  • Opt-out of marketing communications
  • Data portability in machine-readable format

Contact: wambui@madewithmake.com for data requests.

8. International Data Transfers

By using Shelfcue, you acknowledge your data may be processed outside Kenya, including in the United States and other locations where our service providers operate.