Legal

Privacy Policy

Last updated 19 September 2026

Important information and who we are

This privacy policy gives you information about how Virify Limited collects and uses your personal data through your use of this website (https://shelfkeepr.com/), including any data you may provide when you register with us, sign up for updates on our website and services, create an account, hunt a Product, or communicate with other users via our site.

This website is not intended for children and we do not knowingly collect data relating to children.

This privacy policy is supplemental to our Terms and Conditions, and unless otherwise defined in this policy, capitalised terms shall have the same meanings as those given in the Terms and Conditions.

Controller. Virify Limited is the controller and responsible for your personal data (referred to as "Virify", "we", "us" or "our" in this privacy policy). Virify Limited is a company registered in England and Wales under company number 16255324, with its registered office at 14 Museum Place, 4th Floor, Cardiff, United Kingdom, CF10 3BH.

If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details in the Contact details section below.

The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

Identity Data - the username you choose, which is shown publicly on anything you post.
Contact Data - email address.
Transaction Data - details about payments to and from you and other details of products and services you have purchased from us.
Technical Data - internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
Profile Data - your username and password, your Product search preferences, saved Products, feedback and survey responses.
Usage Data - information about how you interact with and use our website, products and services.
Marketing and Communications Data - your preferences in receiving marketing from us and our third parties and your communication preferences.
User Content Data - the books you add to your hunt list or shelf, the price ceilings and conditions you set, the collections you create, and the comments you post on Most Hunted threads, which are public and shown with your username and a badge saying whether you pay for Hunter or use Watcher.

Cookies. We use one encrypted session cookie to keep you signed in, and a handful of first-party preference cookies - your light/dark theme, which dashboard tab and sections you last had open, your search filters, and whether you've dismissed a notice. One more remembers how you first found us: the campaign tags on the link you arrived by, the page you landed on and the site that sent you. It lasts 6 months, and if you sign up it is saved with your account so we know which posts and ads bring people in. None of them track you across other sites, and there are no advertising cookies.

We also collect and use aggregated data such as statistical or demographic data which is not personal data, as it does not directly (or indirectly) reveal your identity - for example, aggregating Usage Data to calculate the percentage of users accessing a specific website feature.

How is your personal data collected?

We use different methods to collect data from and about you, including through:

Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by email or otherwise - for example when you create an account, use our site to communicate with other users, subscribe to our service or publications, request marketing, enter a promotion or survey, or give us feedback or contact us.
Automated technologies or interactions. As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions and patterns, using functional cookies, server logs and other similar technologies.
Third parties or publicly available sources. Contact and Transaction Data are collected from providers of technical, payment and delivery services, such as Stripe.

How we use your personal data

Legal basis. The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following:

Performance of a contract with you - for example, providing you with access to our site and its features in accordance with our Terms and Conditions.
Legitimate interests - where necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and give you the best and most secure customer experience. We balance any potential impact on your rights before relying on this basis.
Legal obligation - where necessary for compliance with a legal obligation we are subject to.
Consent - only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

Purposes for which we use your personal data:

To register you as a new user of our site (Identity, Contact) - performance of a contract with you.
To process and manage your account (Identity, Contact, Transaction, Marketing and Communications) - performance of a contract with you; legitimate interests (recovering debts due to us).
To manage our relationship with you, including notifying you about changes to our terms or privacy policy and dealing with your requests, complaints and queries (Identity, Contact, Profile, Marketing and Communications) - performance of a contract with you; compliance with a legal obligation; legitimate interests (keeping our records updated and managing our relationship with you).
To enable you to communicate with other users via our site (Identity, Contact, Profile, Usage, User Content) - performance of a contract with you; legitimate interests (operating and developing our site).
To enable you to complete a survey (Identity, Contact, Profile, Usage, Marketing and Communications) - legitimate interests (studying how users use our site, to develop it and grow our business).
To administer and protect our business and this website, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data (Identity, Contact, Technical) - legitimate interests (running our business, IT and network security, fraud prevention, business reorganisation); compliance with a legal obligation.
To deliver relevant website content and online advertisements and measure their effectiveness (Identity, Contact, Profile, Usage, Marketing and Communications, Technical) - legitimate interests.
To use data analytics to improve our website, products and services, user relationships and experiences (Technical, Usage) - legitimate interests.
To send you relevant marketing communications and personalised suggestions (Identity, Contact, Technical, Usage, Profile, Marketing and Communications) - legitimate interests, or consent where required.
To carry out market research through your voluntary participation in surveys (Identity, Contact, Profile, Marketing and Communications) - legitimate interests.
To enforce our terms and conditions, acceptable use policy and other policies, and to protect our rights and the rights of other users (Identity, Contact, Technical, Usage, User Content) - legitimate interests; compliance with a legal obligation.

Direct marketing. You may receive marketing communications from us if you have requested information from us or registered for an account and have not opted out. We may analyse your Identity, Contact, Technical, Usage and Profile Data to work out which services and offers may interest you.

Third-party marketing. We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing. You can ask us to stop sending you marketing communications at any time from your account settings. Opting out does not affect service-related communications that are essential for administrative or customer service purposes, such as updates to our Terms and Conditions.

Disclosures of your personal data

We may share your personal data where necessary with:

Sign-in providers - Google, Discord and Microsoft, only when you choose to sign in with them. They tell us who you are; we tell them nothing about your use of ShelfKeepr.
Marketplaces - eBay's public Browse API and Etsy's public listing API, for listings that match the books you track. Your account details are never sent to either; only the book title, ISBN and search terms are. Links may carry an affiliate tag - eBay Partner Network for eBay, Rakuten Advertising for Etsy.
Payment processing - Stripe.
Email delivery - transactional email sent via Amazon Simple Email Service (AWS, EU region). Your email address and message content pass through it for delivery.
Hosting and network - Railway (application and database hosting) and Cloudflare (DNS, CDN and DDoS protection).
Analytics - a self-hosted, first-party Umami instance. It sets no cookies, does not fingerprint you, and reports aggregate page views and clicks only.
Professional advisers including lawyers, bankers, auditors and insurers.
HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.
Third parties to whom we may choose to sell, transfer or merge parts of our business or assets, or with whom we may merge. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy policy.

International transfers

We transfer certain personal data outside the UK and the European Economic Area ("EEA"), such as to the relevant tax authorities where we operate. We will do our best to protect your personal data, but we cannot guarantee that transfers via the internet are completely secure. Any personal data you make available through content you upload, create or otherwise make publicly accessible on our site may be viewed by other users outside the UK and the EEA.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know, and they process it only on our instructions, subject to a duty of confidentiality.

We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where legally required to do so.

Data retention

We only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain it for longer in the event of a complaint or if we reasonably believe there is a prospect of litigation.

To determine the appropriate retention period we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether those purposes can be achieved by other means, and applicable legal, regulatory, tax, accounting or other requirements.

You can ask us to delete your data - see Your legal rights below. In some circumstances we will anonymise your personal data so it can no longer be associated with you, and may then use it indefinitely for research or statistical purposes without further notice to you. A comment of yours that other members have replied to is anonymised rather than deleted, so their replies keep their place; the rest of your comments are deleted with your account.

Your legal rights

You have a number of rights under data protection law in relation to your personal data. You have the right to:

Request access to your personal data (a "subject access request"), to receive a copy of it and check we are lawfully processing it.
Request correction of personal data we hold about you that is incomplete or inaccurate, though we may need to verify new data you provide.
Request erasure of your personal data in certain circumstances, including where there is no good reason for us continuing to process it, where you have successfully objected to processing, where we may have processed it unlawfully, or where erasure is required to comply with local law. We may not always be able to comply for specific legal reasons, which we will explain if applicable.
Object to processing of your personal data where we rely on legitimate interests (including profiling), unless we can demonstrate compelling legitimate grounds that override your rights. You have an absolute right to object at any time to processing for direct marketing purposes.
Request transfer of your personal data to you or a third party, in a structured, commonly used, machine-readable format - this applies only to automated information you provided consent for, or that we used to perform a contract with you.
Withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing carried out before withdrawal. We will tell you if withdrawing consent means we can no longer provide a service to you.
Request restriction of processing in certain scenarios: to establish the data's accuracy; where our use is unlawful but you don't want it erased; where you need us to hold it to establish, exercise or defend legal claims; or while we verify whether our legitimate grounds override an objection you've raised.

No fee usually required. You won't have to pay a fee to exercise your rights, unless your request is clearly unfounded, repetitive or excessive, in which case we may charge a reasonable fee or refuse the request.

What we may need from you. We may ask for information to confirm your identity as a security measure, and may contact you for further information to speed up our response.

Time limit to respond. We try to respond to all legitimate requests within one month. It could take longer if your request is particularly complex or you have made a number of requests, in which case we will notify you and keep you updated.

Contact details

Email: [email protected]

Complaints

You have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection issues. Before doing so, please make your complaint to us first, or ask us for clarification - the ICO will expect you to have done this. You can submit a complaint to us at [email protected].

Changes to this policy and your duty to inform us of changes

We keep our privacy policy under regular review. It's important that the personal data we hold about you is accurate and current - please keep us informed if it changes, for example a new address or email address.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.