Privacy Policy

1. What we collect

• Account details — your email address, and your password in hashed form (or a Google account identifier if you sign in that way).
• What you tell us at signup — the name you want to be called, optionally what you are working on, and optionally where you heard about us.
• What you type into the tools — product names, features and notes, plus the copy the tools generate from them.
• Billing details — your subscription status and renewal date. Card numbers go to Stripe and never reach our servers.

2. Why we are allowed to hold it

We process your account and billing data because we need it to provide the service you have contracted for. We process your signup answers on the basis of legitimate interest, to understand who uses the product — you can leave those fields blank.

3. Where it goes

We use four processors and no one else. Each one gets only what it needs to do its job:

• Supabase (EU, Ireland) — your account, profile and saved work. Gets: email, password hash, profile answers, saved generations.
• Google, Gemini API (US) — gets the text you type into a tool, and returns the generated result. Nothing else about you is sent: not your email, not your name, not your account ID.
• Stripe (US/EU) — gets your email and payment details, which you enter on Stripe’s own checkout page. Card numbers never touch our servers.
• Vercel (global edge) — hosting. Gets standard server logs: IP address, the page requested, timestamp.

We do not sell your data, share it for advertising, or use it to train any model. There are no advertising trackers and no third-party analytics on this site.

4. What Google does with your inputs

This is the part worth reading carefully, because it is the one place your writing leaves our systems.

When you run a tool, the text you typed is sent to Google’s Gemini API over an encrypted connection. Google’s published terms state that data submitted through the paid API is not used to train its models and is retained only transiently for abuse monitoring. On the free tier, Google states that content may be reviewed by humans and used to improve its products.

Treat anything you paste as leaving your control. Do not put customer data, unreleased product information, trade secrets or anything covered by an NDA into the tools. They are built for product facts you intend to publish anyway.

Google’s own terms are the authority here, and they can change: ai.google.dev/gemini-api/terms.

5. How it is kept safe

• Everything travels over HTTPS. We do not accept unencrypted connections.
• Passwords are hashed by Supabase Auth. Nobody at ShopHelpy.com can read yours, and we will never ask for it.
• The database uses row-level security: the rules live in the database itself, so one account cannot read another’s profile or saved work even if application code has a bug.
• The key that can bypass those rules is used by exactly one thing — the payment webhook — and never reaches a browser.
• We store no card numbers, CVCs or bank details anywhere. Stripe holds all of it.

6. How long we keep it

• Account and profile — until you delete your account.
• Saved generations — until you delete them, or until your account goes.
• Subscription records — deleted with your account, except the minimum billing history tax law requires us to keep.
• Server logs — held by Vercel on their standard retention, then dropped.

Deleting your account removes your profile, your saved work and your subscription record.

7. Where your data sits, and transfers

Your account and saved work are stored in the EU (Ireland). Google and Stripe process data in the United States, so running a tool or paying involves an international transfer. Both operate under standard contractual clauses and the EU–US Data Privacy Framework.

8. Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email dragostinov9@gmail.com and we will respond within 30 days. If you are in the UK or EU you may also complain to your data protection authority.

9. Cookies

We set one kind of cookie: the login session, which keeps you signed in. It is essential to the service, so it needs no consent banner. We run no advertising trackers and no third-party analytics.

10. Children

ShopHelpy.com is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.