Privacy policy

1. Who is responsible

The controller of personal data processed through ai-shelf is MARKAPP MEDIA LTD (“Markapp”), registered in Cyprus under company number 436282, registered office Markou Drakou 64, Plaza Court, Floor 2, Office 23, 4002 Mesa Geitonia, Limassol, Cyprus, with offices at Aisopou 6, Agios Nikolaos, 3100 Limassol, Cyprus.

Contact for privacy questions and requests: adtech@markappmedia.site.

2. What this policy covers

This policy explains how we use personal data when you visit aishelf.tech, request a demo, sign in to the client app or the Markapp console, and use reports and AI SEO checks. Markapp’s general privacy policy at markappmedia.site also applies to our wider services.

3. Data we collect

• Account data: name, work email, company, role, the account you belong to, a scrypt hash of your password (never the password itself), and sign-in times.
• Demo and contact requests: name, work email, company, role, phone if given, and your message.
• Requests and support: what you ask for in the app (new runs, assistants, packages) and the messages you write.
• Service data: the brands, markets, competitors, questions and web pages you or Markapp set up, AI answers and results. These concern brands and businesses; they are not meant to contain personal data.
• Technical data: IP address and request logs kept by our hosting provider for security and troubleshooting.
• Connector data (only if you connect an AI assistant, see section 5): the name and return address the assistant app registers with us, and a sign-in record (which app, which person and account, when it was connected, last refreshed and disconnected).

4. Why we use it, and on what legal basis

• To provide the Service under the contract with your company, and your account inside it (contract; our legitimate interest in serving our business clients).
• To reply to demo and contact requests and to follow up commercially (your request; our legitimate interest).
• To keep the Service secure, prevent abuse and fix problems (legitimate interest).
• To meet legal, tax and accounting obligations (legal obligation).
• We do not sell personal data and we do not use it for advertising profiles.

5. AI assistant connector

If you connect Claude, ChatGPT or another AI assistant to ai-shelf through the connector, this is how data flows:

• Sign-in: you sign in on aishelf.tech with your ai-shelf password; the assistant never sees it. It receives signed access tokens that expire after 2 hours and are renewed while the connection is active. We do not store the tokens themselves, only the sign-in record described in section 3.
• What we receive from the assistant: the tool it calls and the inputs it sends, such as a brand name, a web page address or a note for Markapp. We do not receive your conversation with the assistant.
• What we send to the assistant: results of the account you signed in with (brands, scores, competitors, cited sources, fixes, the status of requests), never other accounts’ data, API costs or Markapp’s internal notes.
• Requests: a request sent through the connector is stored and handled like a request from the app, and Markapp is alerted as described in section 6.
• The assistant’s provider (for example Anthropic for Claude or OpenAI for ChatGPT) processes the results you ask for in your conversation under its own terms and privacy policy, as the controller of that processing.
• Disconnecting: remove ai-shelf in the assistant’s settings, or ask us to end every connection of your account. Changing your password or closing your account also ends all connections at once.

6. Who receives it

We use carefully selected service providers that process data on our instructions:

• Render (web hosting, Frankfurt region, EU).
• GitHub (secure storage of account records and results, and running the measurement jobs).
• Anthropic (Claude), and other AI assistant providers that a client adds to its package (for example OpenAI, Google or Perplexity), to answer the measurement questions and review web pages. We send brand and market questions and page text, not your account data.
• Slack and our email providers (Titan, Brevo), for internal alerts about requests and for emails to you.
• The AI assistant you connect to the ai-shelf connector, at your request, as described in section 5.
• Our professional advisers, and authorities where the law requires it.

7. International transfers

Some providers are located outside the European Economic Area, in particular in the United States. Where this happens we rely on the safeguards the GDPR provides, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework where the provider is certified.

8. How long we keep it

• Account data: while your account is active, then deleted within 12 months unless the law requires longer.
• Contract, invoicing and accounting records: as long as Cyprus law requires (normally up to 6 years).
• Demo and contact requests that do not lead to a contract: up to 24 months.
• Security logs: up to 12 months.
• Connector sign-in records: while the connection is active, then up to 12 months after it ends.
• Service results: for the duration of the relationship; on request we delete them or return them to your company.

9. Your rights

Under the GDPR you may ask for access to your personal data, correction, deletion, restriction, portability, and you may object to processing based on legitimate interest. Write to adtech@markappmedia.site; we reply within one month.

You may also complain to the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy) or to the authority where you live or work.

10. Security

Sign-in is by invitation only; passwords are stored as salted scrypt hashes; sessions are signed and expire after 12 hours; the connector uses OAuth 2.1 with PKCE and short-lived signed tokens; every client sees only its own account; connections use HTTPS; and API costs, internal notes and other clients’ data are never shown to client users.

11. Cookies

We use only essential cookies. See the Cookie policy.

12. Changes

We may update this policy. The date at the top shows the latest version.