SpecialShelf Privacy Policy
Version 1.0
Last updated: 15 October 2026
SpecialShelf is a tool independent shops use to track special orders and layaways and to send their customers order updates. It is operated by Agnostic AI (Pty) Ltd, registration number 2025/950332/07, 52 Hillview, 14 Sparrowhawk Street, Centurion, Gauteng, 0157, South Africa ("we", "us"). Contact for privacy: support@agnosticai.co.za. Our Information Officer under South Africa's Protection of Personal Information Act (POPIA) is Johannes Petrus (Jannie) Jordaan, support@agnosticai.co.za.
There are two groups of people, and our role differs for each:
| Who | Our role |
|---|---|
| Shops and their staff (our customers) | We decide how we use your information: under POPIA we are the responsible party. |
| Shoppers (the shops' customers who receive order updates) | The shop decides; we process your information only on the shop's behalf, as its operator (POPIA) / service provider (US state privacy laws). |
1. If you're a shopper who got a message from a shop
Why you heard from us. A shop you ordered from uses SpecialShelf to tell you when your order arrives, what is left to pay, and when to pick it up. Messages say they come from the shop (emails: "{Shop} via SpecialShelf").
What we hold for that shop: your name, phone number and/or email address, what you ordered and when, the payment status the shop's Square account reports, whether you agreed to texts (and when, and which staff member recorded it), and the messages sent to you and their delivery status. We never see or store card details — payments happen on Square's own pages.
Where it comes from: from you at the shop counter, and from the shop's Square account.
What it's used for: only to run that shop's orders with you and send you the order updates you agreed to. We don't sell or share your information, use it for our own marketing, combine it with other shops' data, or use it to profile you.
Texts. You get texts only if you agreed at the shop. Reply STOP to stop, or HELP for help; see the Text Messaging Terms. Mobile numbers and text-messaging opt-in data and consent are never shared with third parties or affiliates for marketing or promotional purposes.
Emails are order updates (transactional messages), not marketing. Replying reaches the shop.
Your rights. To see, correct or delete your information, or to object, contact the shop — it is in charge of your information. You can also email us; we'll pass your request to the shop within 5 business days and help it respond.
How long we keep it. While the shop uses SpecialShelf. Message texts are removed 90 days after sending (the record that a message was sent stays). If the shop leaves, everything about you held for that shop is deleted 90 days after its account closes.
2. If you run or work at a shop that uses SpecialShelf
What we collect
| Information | Source | Why (purpose) |
|---|---|---|
| Name, email, role in the shop | You, at sign-up or invitation | Account, sign-in, permissions, audit trail |
| Shop name, locations, settings, phone | You and your Square account | Running the service |
| Square connection (access tokens, stored encrypted) and the Square customer, catalog, tax, order, invoice and payment data needed for your orders | Square, with your permission | Providing the service you asked for |
| Records of actions on orders (who did what, when) | Generated by your use | Your audit trail, support, security |
| Texting registration details: legal name, EIN or sole-proprietor status, address, website, contact (stored encrypted) | You | US carrier registration of your texting |
| Subscription status, plan and billing contact | Paddle | Access to paid features; invoices |
| Technical data: sign-in times, device/browser information in server logs, error reports | Generated by your use | Security, troubleshooting |
| Your emails to us | You | Support |
Card and bank details for your subscription are handled by Paddle, our reseller and merchant of record, under its own privacy notice (paddle.com/legal/privacy). We receive your subscription status, not your card.
Legal bases (POPIA s11): performing our contract with your shop; our legitimate interests in securing and improving the service (using aggregated, non-identifying figures); complying with law.
Emails we send you: service emails (sign-in links, alerts, the Friday summary, billing and security notices). We send product news only if you opt in, and every such email has an unsubscribe link.
3. Who we share information with
Only:
- Sub-processors that run parts of the service for us (database and sign-in, hosting, background jobs, email delivery, text delivery, billing, error tracking), each under a written agreement with data-protection terms. The current list, with locations, is at /subprocessors.
- Square, as the shop's own provider, to create and read the shop's orders and invoices.
- Authorities, when the law requires it, or to protect rights, safety and security.
- A buyer of the business, if SpecialShelf is sold or merged; the same protections continue, and shops are told beforehand.
We do not sell personal information and do not "share" it for cross-context behavioural advertising.
4. Transfers outside South Africa
We are a South African company; our service providers process data mainly in the United States (and Paddle in the United Kingdom). We transfer personal information only where POPIA section 72 allows it: each provider is bound by a written agreement giving protection substantially similar to POPIA's, and transfers are necessary to perform our contract with the shop.
5. How we protect information
Encryption in transit (TLS); credentials and texting registration details encrypted at rest (AES-256-GCM); each shop's data isolated from every other shop's in the database (row-level security); least-privilege access; logs of actions on orders; regular review of these safeguards. If a security compromise affects you, we notify as POPIA section 22 and other applicable laws require, and we tell affected shops immediately so they can notify their customers.
6. How long we keep information
| What | How long |
|---|---|
| Shop account and Store Data | While the shop's account is open. After cancellation, or a trial that ends without a subscription: read-only for 90 days, then permanently deleted |
| Rendered message texts and Friday summaries | 90 days after sending |
| Raw data received from Square and webhook payloads | 30 days |
| Records needed for tax or legal reasons (e.g. invoices, held by Paddle) | As the law requires |
| Backups | During the pilot our database plan keeps no automatic backups, so deleted data is gone at once. If we add backups, deleted data will leave them as they expire, and we will update this table |
7. Cookies
We use only essential cookies: one that keeps you signed in, and a short-lived one that protects the Square connection step. We use no advertising or analytics cookies. Paddle's checkout window sets its own cookies to process payment securely (see Paddle's privacy notice).
8. Your rights
Everyone may ask us for access to, correction of, or deletion of their personal information, and may object to processing, by emailing support@agnosticai.co.za. We'll confirm your identity and reply within 30 days. Shoppers: see section 1 — we involve the shop.
South Africa (POPIA): you may also complain to the Information Regulator (inforegulator.org.za — complaint forms and contact details are on its website). Requests for records under PAIA follow our PAIA Manual.
United States: residents of states with comprehensive privacy laws (such as California, Colorado, Connecticut, Virginia and others) may have rights to know, access, correct and delete personal information and to opt out of sale, targeted advertising and profiling. We don't sell personal information, don't use it for targeted advertising, and don't profile. We will not discriminate against anyone for exercising their rights. You may use an authorised agent; we'll verify the request.
9. Children
SpecialShelf is a business tool, not directed at children under 13 (or 18 for shop accounts), and we don't knowingly collect children's information for our own purposes.
10. Changes
We'll post changes here with a new date. For material changes we email shop owners at least 30 days before they apply.
11. Contact
Agnostic AI (Pty) Ltd, 52 Hillview, 14 Sparrowhawk Street, Centurion, Gauteng, 0157, South Africa · support@agnosticai.co.za · Information Officer: Johannes Petrus (Jannie) Jordaan.