# Privacy policy

> We never sell personal data for money, share some with ad partners when advertising is on, honor Global Privacy Control, and never see your card number.

## Who we are

Goodshelf is a store brand of Wildcard AI, Inc., a Delaware corporation registered to do business in California (156 2nd St STE 630, San Francisco, CA 94105). In this policy, "we" and "us" mean Wildcard AI, Inc.. This policy covers Goodshelf's website, its machine-readable files and APIs, and orders placed through them.

## What we collect

- **Order details:** your name, email address, shipping address, the items you buy, and your order history. Stripe collects these at checkout and passes them to us.
- **Payment details:** you enter your card on Stripe. We never receive or store your full card number; Stripe tells us whether the card was authorized and charged.
- **Messages:** what you write when you email us.
- **Device and usage information:** pages you view, what you click, the page that referred you, browser and device type, approximate location from your IP address, and cookie or device identifiers. Analytics, session recording, and advertising tools collect this in your browser; our servers also log requests.
- **AI assistants and agents:** when an AI assistant or shopping agent reads our pages or starts a checkout for you, we record which assistant made the request so we can measure agent traffic and credit the order. An order it starts is handled like any other order once you pay.

## How we use it

- To process, ship, and support your orders, including returns and refunds.
- To answer your questions.
- To keep the store secure and stop fraud and abusive bots.
- To understand how people and AI assistants use the store, and to fix pages that do not help.
- To measure and improve our advertising (see "Advertising, sale, and sharing" below).
- To meet legal, tax, and accounting obligations.

## Who we share it with

We share personal information only with the companies that help us run the store, and with advertising partners as described in the next section:

| Company | What it does for us | What it receives |
| --- | --- | --- |
| Stripe | Payments and checkout | Order, contact, shipping, and card details you enter on Stripe |
| Shipping carriers and fulfillment partners | Deliver your order | Name, shipping address, order contents |
| Resend | Sends order emails, such as your order confirmation | Your name, email address, and order details |
| PostHog | Product analytics, session recordings (form inputs are masked), and error tracking. Browser events can travel through our own address, goodshelf.com/stockroom, which forwards them to PostHog. | Usage and device information, an analytics identifier, and order events |
| Google Analytics | Website analytics | Usage and device information, cookie identifiers, and order events |
| Microsoft Clarity | Session recordings and heatmaps that show how pages are used | Usage and device information, mouse and scroll activity, and cookie identifiers |
| Hosting, database, network, and email providers (such as Render, Supabase, Cloudflare, and Google Workspace) | Run the website, store order records, protect the site, and handle email | The data needed to provide those services |

We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business.

## Advertising, sale, and sharing

When advertising is switched on, the store loads advertising tags ("pixels") from **Meta (Facebook and Instagram), Google Ads, Microsoft Advertising (UET), TikTok, Reddit, and OpenAI (ChatGPT ads)**. They record visits, items added to a cart, checkouts started, and purchases, and may set their own cookies. When you buy, our server can also send the purchase to Meta, TikTok, Reddit, and OpenAI through their conversion APIs, together with your email address in hashed (scrambled) form, your IP address, your browser user agent, and the ad click identifiers or cookies from your visit. These companies use this to measure our ads, show our ads to people likely to be interested, and under their own policies to improve their advertising services.

We do not sell personal information for money. California and some other states treat this kind of advertising disclosure as "sharing" for cross-context behavioral advertising, and some of it may count as a "sale" under those laws. In the last 12 months the categories involved were identifiers (hashed email, IP address, cookie and device IDs), commercial information (what you bought), and internet activity (pages viewed and actions on our site). You can opt out at any time.

## Do Not Sell or Share My Personal Information

- **Use the opt-out page:** [Do Not Sell or Share My Personal Information](/privacy-choices). One click works without an account and without JavaScript. It applies to the browser you use; repeat it on each browser or device.
- **Use Global Privacy Control:** if your browser or extension sends the Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale and sharing for that browser, automatically.
- **Questions:** email hello@goodshelf.com with "Do Not Sell or Share" in the subject if the page or the signal does not work for you, and we will help you opt out.

Once you opt out, the advertising tags above do not load, and your purchases are not sent to advertising platforms. Our own analytics and our service providers keep working, because they process data only to run and improve the store for us.

We do not use or disclose sensitive personal information to infer characteristics about you, and we do not knowingly sell or share the personal information of anyone under 16.

## Cookies

We use cookies to keep your cart and checkout working, to remember your privacy choice, and for the analytics and advertising tools above. A cookie that stores the ad click identifier from the link you arrived on lasts 90 days. You can block or delete cookies in your browser settings; the cart and checkout need cookies to work.

## How long we keep it

- **Orders and payment records:** as long as we need them to fulfill and support your order, handle returns, refunds, and warranty questions, and meet tax, accounting, and legal obligations.
- **Emails with us:** as long as we need them to resolve your request and keep a record of it.
- **Analytics, session recordings, and error reports:** for the retention period set in each provider, and no longer than we need them to understand and fix the store.
- **Advertising data:** each advertising partner keeps data under its own policy. Our ad click cookie expires after the period stated above.
- **Traffic records and logs:** our own traffic records store IP addresses only in hashed form, kept as long as we need them for security and traffic measurement. Hosting and security logs, which can include IP addresses, are kept for the limited period our providers set.

When we no longer need personal information, we delete it or remove what identifies you.

## Your rights and how to use them

Depending on where you live (including California, Colorado, Connecticut, Virginia, and other US states), you have the right to:

- Know what personal information we collect, use, and disclose, and get a copy of it.
- Correct personal information that is wrong.
- Delete personal information we hold about you, subject to legal exceptions such as records we must keep for tax purposes.
- Opt out of the sale or sharing of your personal information and of targeted advertising (see [Do Not Sell or Share My Personal Information](/privacy-choices)).
- Not be treated differently for using any of these rights. We never charge more or offer worse service because of a privacy request.

To make a request, email hello@goodshelf.com with "Privacy request" in the subject, say what you would like us to do, and write from the email address you used to order (or tell us that address). We verify requests by matching them to that email address and may ask a follow-up question. You can also have an authorized agent make a request for you; we will ask for proof that you authorized them. Our team replies within one business day. We confirm requests within 10 business days and complete them within 45 days, and tell you if we need more time as the law allows.

If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject. We respond to appeals within the time your state requires.

## Children

Goodshelf is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, email us and we will delete it.

## Security

The whole site is served over HTTPS, card details go directly to Stripe, and access to order data is limited to the people and providers who need it.

## Changes to this policy

When we change this policy, we update it here with a new "Last updated" date, and note material changes in the changelog on Our standards.

## Contact us

- Email: hello@goodshelf.com. Our team replies within one business day.
- Mail: Wildcard AI, Inc., 156 2nd St STE 630, San Francisco, CA 94105

---

Canonical: https://goodshelf.com/policies/privacy
Last updated: 2026-10-22