Privacy Policy
Last updated 10 October 2026
This policy explains what Shelf Space does with your information, who else sees it, and what you can ask us to do about it. We have tried to write it in plain English rather than legal boilerplate.
Who we are
Shelf Space is operated by Sonic Studio Ltd, a company registered in England and Wales (number 15877834), registered office 37a Ventnor Villas, Hove, BN3 3DA. VAT number GB 475 1243 94. You can reach us at jake@sonicstudio.uk.
We are the data controller for the personal data described in this policy. Shelf Space is a business tool: it helps an independent brand find shops, hotels and other businesses that might stock its products, research whether they are a good fit, and prepare introduction emails for the user to review and send.
What we collect
| Waiting list | If you join the waiting list, your email address and the date you joined. We use it only to tell you when Shelf Space opens, and delete it on request. |
|---|---|
| Account details | Your name, email address and Google account identifier, received from Google when you sign in. We never see or store your Google password. |
| Your brand profile | Everything you enter about your business: brand name, website, product descriptions, story, pricing and minimum order details, targeting preferences and your email signature. |
| Mailbox access | If you connect Gmail, we store an access token that lets us send the messages you approve. It does not allow us to read your email. See “Your Gmail data” below. |
| Research data | Information about the businesses you research: name, location, category, published contact details, our assessment of fit and the sources it came from. |
| Content you create | Draft emails, edits, approvals, and any product photographs you upload for use in emails. |
| Usage records | How much of your monthly research allowance you have used, when runs were started, and error logs needed to keep the service working. |
| Payment details | If you subscribe, payments are handled by Stripe. We receive confirmation of your subscription status. We never receive or store your card number. |
Why we use it, and our legal basis
- To provide the service you signed up for: researching businesses, preparing drafts and sending approved emails. Legal basis: performance of our contract with you.
- To find and verify published business contact details: our legal basis is legitimate interests, namely enabling business-to-business introductions. We balance this against the interests of the people concerned by using only details a business has published for the purpose of being contacted, and by honouring do-not-contact requests immediately.
- To send emails through your Gmail account: legal basis is our contract with you, as sending is part of the service you signed up for. You choose whether to connect Gmail and can disconnect it at any time.
- To take payment and meet our tax and accounting obligations: legal basis contract, and legal obligation.
- To keep the service secure and working: legal basis legitimate interests.
Your Gmail data
Shelf Space’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use your Gmail access only to send introductions you have approved, either one by one or by switching on automatic sending. We ask Google for permission to send email and to know your email address, nothing more. We cannot read, search or delete anything in your mailbox.
- We do not use Gmail data for advertising, and we do not sell it.
- We do not use Gmail data to develop, improve or train generalised artificial intelligence or machine learning models.
- No human at Shelf Space reads your Gmail data, except where you have given specific permission so we can help with a support problem, where it is necessary for security purposes or to comply with the law, or where the data has been aggregated and made anonymous.
You can disconnect Gmail from within Shelf Space at any time, and you can revoke access entirely from your Google account permissions page.
Who else processes your data
We use a small number of service providers. Cloudflare, Anthropic, OpenAI and Stripe act on our instructions and are not permitted to use your data for their own purposes. We also send searches to Google Maps and look businesses up on Companies House, which handle that under their own terms.
| Cloudflare | Hosting, database and file storage for everything in your workspace. |
|---|---|
| Sign-in, sending through Gmail, and finding businesses through Google Maps. Google Maps listings that are never researched are deleted within 30 days. | |
| Anthropic and OpenAI | AI services used for researching businesses, assessing whether they suit your brand, and writing draft emails. Your brand profile and the research findings are sent for this purpose. |
| Companies House | The UK company register. The names and websites of UK businesses you might contact are checked against it to see whether they are limited companies. |
| Stripe | Subscription payments and card processing. |
Some of these providers are based outside the UK. Where data is transferred internationally it is protected by the safeguards required under UK data protection law, such as the International Data Transfer Agreement or an adequacy decision. Ask us and we will send you a copy.
Automated assessment
Shelf Space uses an AI model to score how well a business might suit your products and to draft emails. These are suggestions, not decisions producing legal effects. Nothing is sent unless you approve it or switch on automatic sending, you can override any score, and you can edit or discard any draft.
If your details appear in our research
If you are a business owner or employee and Shelf Space has found your published business contact details (from your business’s website or other pages your business has published), you have the right to object to that processing. Email us at jake@sonicstudio.uk and we will add your address or domain to our do-not-contact list, which prevents it being researched, drafted to, or emailed by any Shelf Space user.
How long we keep it
- Your workspace, brand profile, research and drafts are kept for as long as your account is open, with these limits: contact details for businesses never contacted are deleted after six months, each email sent is deleted two years after it was sent, and the contact details of the person it went to two years after the last one. The business stays marked as contacted, so it is not emailed again by mistake.
- Cancelling your plan keeps your workspace. You can close your account in Settings, which deletes it straight away, or ask us and we will do it within 30 days, apart from anything we must keep for tax or accounting purposes. Backups are kept for 14 days, then deleted. Our hosting provider also keeps encrypted recovery copies of the database for up to 30 days, used only to recover from a fault.
- Do-not-contact entries are kept indefinitely, because deleting them would mean we could no longer honour the request. When an account is closed, businesses it emailed and then put on its do-not-contact list stay blocked for every Shelf Space user, because that is usually how someone asks not to be contacted again.
- When an account has had a first-time offer (such as a free month), we keep a record of that against the account’s sign-in ID and the card used (a coded reference from Stripe, never the card number), even after the account is closed, so the offer can’t be claimed twice.
Your rights
Under UK data protection law you have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Email jake@sonicstudio.uk and we will respond within one month.
If you are unhappy with how we have handled your data, email us first and we will acknowledge your complaint within 30 days and tell you what we will do. You can also complain to the Information Commissioner’s Office at ico.org.uk.
If you received an introduction email sent through Shelf Space, this page explains where your address came from and how to stop any more.
Cookies
We set a cookie that records that you are signed in, and a short-lived one (ten minutes) that protects the sign-in itself. If you choose the UK or US version of the site, a small cookie remembers that choice. None of these are used for tracking or advertising. We do not use analytics or advertising cookies, so there is no cookie banner.
Security
Data is encrypted in transit and stored on Cloudflare’s infrastructure. Gmail permissions and service keys are encrypted at rest, held on the server and never exposed to your browser. Disconnecting Gmail cancels the permission at Google too. Each workspace is tied to the account that created it and cannot be read by another signed-in user.
Children
Shelf Space is a business tool and is not intended for anyone under 18.
Changes
If we change this policy we will update the date at the top, and we will email you if the change is significant.