Privacy Policy

The short version

• We store your name, your email address, your studio name and the product data you enter.
• We use it to run your account and send you the emails the product promises.
• We do not sell it, and there is no advertising or analytics code on this site.
• It is stored on hosting in the United States.
• Email us to get a copy of it, or to have it deleted.

1. Who is responsible for your data

Shelfwise is operated by Olga Angel, doing business as Shelfwise, 1017 N Palm Ave,Rialto, CA 92376, United States. That business is responsible for the personal data described here. Questions and requests go to support@milani-cosmetics.com.

2. What we collect

When you create an account and use the app, we store:

• Account details: your name, your email address, your studio or business name, and your role (owner or member) on the studio.
• Password: stored only as a one-way hash. Nobody, including us, can read your password. A password reset link is generated rather than a password being sent to you.
• Product records you enter: product names, SKUs, brands, categories, unit costs, stock counts, thresholds, reorder quantities and any notes you type. Notes are free text, so please do not put anything sensitive in them.
• Stock history: every change you record, who made it, when, and the reason. This is what the monthly report is built from.
• Sign-in records: the date and time of a successful sign-in, and a record of failed attempts including the IP address they came from. Failed attempts are kept to slow down password guessing.
• Email log: what was sent, to which address, and whether the sending server accepted it. This is how a missing low stock alert can be investigated.

3. What we do not collect

• No payment card details. Card payment is not switched on, and no card data is collected anywhere in the app.
• No advertising identifiers, no tracking pixels, no social media plugins.
• No analytics script. There is nothing measuring which pages you visit or for how long.
• No location data, no contacts, no camera or microphone access.

4. Why we use it

• To create and run your account, and to let the people on your studio sign in.
• To show you your own catalog, stock levels and reports.
• To send the emails the product is meant to send: low stock alerts, password resets, and service messages about the trial or billing.
• To keep the service secure, for example by throttling repeated failed sign-ins.
• To answer you when you write to support.

We do not use your data for advertising, we do not build a profile of you, and we do not use it to train models.

5. Cookies

The app sets one cookie, named shelfwise_session. It contains a random session identifier and is what keeps you signed in between pages. It is marked HttpOnly, so scripts cannot read it, and SameSite, so another site cannot use it, and it is sent over HTTPS only. It expires when your session ends.

This website sets no cookies at all. There is no cookie banner because there are no cookies to consent to.

6. Who sees your data

• People on your studio. Anyone signed in to your studio sees the shared catalog and stock history, and sees which user recorded each change.
• Hosting and database. The application and its database run on hosting infrastructure in the United States, which stores the data on our behalf.
• Email delivery. Alert and reset emails are sent through the mail provider that hosts the support mailbox. That provider processes the recipient address and the message in order to deliver it.
• Nobody else. We do not sell data, rent it, or hand it to advertisers. We will disclose data if a court order or the law requires it, and we will tell you if that happens unless we are barred from doing so.

7. Where it is stored

On servers located in the United States. If you use the service from outside the United States, your data is transferred to and stored in the United States.

8. How long we keep it

• Account and product data: kept while your account exists.
• If you ask us to delete your account, we delete the account and its product data. You can also export what you need first.
• Failed sign-in records: kept for a short period, then cleared.
• Email log: kept while it is useful for diagnosing delivery problems.
• Anything we are required to keep for tax or legal reasons is kept for as long as the law requires, and nothing else.

9. How it is protected

• The site is served over HTTPS only.
• Passwords are stored as one-way hashes.
• Every database query uses prepared statements with bound parameters.
• Every request that changes data requires a cross-site request forgery token.
• Session cookies are HttpOnly and SameSite, and the session id is rotated.
• Every read and write is scoped to your studio, so one studio cannot reach another's data even by guessing an identifier.

No system is perfect, and we will not pretend otherwise. If there is a breach that affects your data, we will tell you what happened and what we are doing about it.

10. Your choices

• See it: nearly everything stored about your studio is on screen in the app, under products, reports and settings.
• Copy it: the Studio plan exports the reorder list and the monthly report as CSV. You can also ask us for a copy of your data.
• Correct it: edit products, stock counts and your name and studio name in the app. Ask us if something cannot be edited.
• Delete it: write from the email address on the account and ask us to delete the account and its data.
• Turn off emails: low stock alerts can be switched off in settings. Password reset and service messages about your account are not marketing and are still sent.

There is no marketing list to unsubscribe from, because we do not run one.

11. Children

The service is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.

12. Changes to this policy

If this policy changes in a way that affects what is stored or who can see it, we will email you before the change takes effect. The date at the top of this page always shows the current version.

13. Contact