Privacy Policy

Gurus Bilişim Reklam ve Tanıtım Hizmetleri Tic. Ltd. Şti., Caferağa Mh. Doktor Esat Işık Cd. Şifa Sk. Akgün Ap. No:12/1 Moda Kadıköy İstanbul Türkiye, Kadıköy Tax Office / 4120434350, info@shelfi.net (“Shelfi”, “we”, “us”).

Shelfi is the data controller for data relating to its own customers (store owners) and website visitors. For data relating to a store's own customers (order details, WhatsApp messages, etc.), the store is the data controller; Shelfi acts as a “data processor”, processing such data only on behalf of and as instructed by the store.

• Identity and contact data: first and last name, email address, phone number, and messages you send via the contact or quote forms. • Account data: your Shelfi sign-in details, company (dealer) name and account settings. • Billing and payment data: company title, tax office and number, billing address, subscription and payment history. Card details are not stored by Shelfi; see Section 5. • Store data: products, categories, orders and content you create on the platform, as well as order and contact details of your store's customers. • Meta and WhatsApp data: described in detail in Section 4. • Technical data: IP address, browser and device information, access times and security logs.

• To create your account, provide the Service and manage your subscription (performance of a contract), • To collect payments, issue invoices and keep statutory records (legal obligation), • To respond to your contact and quote requests and provide support (pre-contractual steps and legitimate interest), • To keep the platform secure and prevent abuse and spam (legitimate interest), • To provide messaging on behalf of stores that enable the WhatsApp integration (performance of a contract; processing on behalf of the store).

We do not sell or rent your data to third parties for marketing purposes.

Shelfi uses Meta's WhatsApp Business Platform and “Facebook Login for Business” so that stores can connect their own WhatsApp Business accounts to the platform and message their customers. This connection is only established through an action explicitly initiated by the store owner.

Data processed in this context: • From the store owner: Meta business account ID, WhatsApp Business Account (WABA) ID, phone number ID and display name, business name, and the access token issued by Meta. • From the store's customers: WhatsApp phone number, WhatsApp profile name, the content and attachments of messages exchanged with the store, and message delivery statuses and timestamps.

This data is processed solely so that the relevant store can message its customers and handle order and support processes through the Shelfi panel. Data received from Meta is not used for advertising, profiling or data sales, and is not shared with other stores or third parties. Shelfi complies with the Meta Platform Terms and Developer Policies.

The store owner may remove the WhatsApp connection at any time from the Shelfi panel or from Meta Business Settings. Once removed, the access token is deleted and no new data is received; to delete existing message records, follow the steps on the User Data Deletion page.

Your data is shared only with the following service providers, and only to the extent necessary to provide the Service:

• PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.: payment processing and card storage. Your card details are processed directly by PayTR in accordance with PCI-DSS standards. • Meta Platforms, Inc. / Meta Platforms Ireland Ltd.: WhatsApp Business Platform and Facebook Login for Business (only for stores that enable the integration). • Cloudflare, Inc.: spam and bot protection on forms (Turnstile). • Netlify, Inc.: website hosting and content delivery. • Competent public authorities: where required by law.

The Shelfi platform's servers and database are located in Türkiye. The servers of the service providers used for website hosting (Netlify), spam protection (Cloudflare) and WhatsApp messaging (Meta) may be located abroad. Such transfers are carried out in accordance with Article 9 of the KVKK and the safeguards required by applicable law.

Our website uses only strictly necessary cookies: the “shelfi-lang” cookie that remembers your language preference (1 year), and the “shelfi-session” and “shelfi-user” cookies that keep you signed in (for the browser session, or for the session lifetime if “Remember me” is selected). Cloudflare Turnstile, used on our forms, may process technical data required for bot protection. We do not use advertising or tracking cookies.

Account and store data are kept for as long as your account is active. When an account is closed or a deletion request is made, the data is deleted or anonymised within 30 days at the latest. Data that must be retained under Turkish tax and commercial law, such as invoices and accounting records, is kept for the statutory period and deleted at the end of it. Contact form messages are kept for as long as needed to resolve your request, and for no longer than 1 year.

We apply technical and organisational measures such as encrypted connections (HTTPS), access controls and security logging to protect your data against unauthorised access, loss and misuse. Access tokens issued by Meta are stored only on the server side and are never exposed to the browser.

Under Article 11 of the KVKK and, where applicable, the GDPR, you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties to whom it is transferred; to request rectification of incomplete or inaccurate data, and its erasure or destruction; to object to processing; and to claim compensation for damage arising from unlawful processing.

You can send your requests to info@shelfi.net; we will respond within 30 days at the latest. The steps for deleting your data are described on the User Data Deletion page. If you are a customer of a store and your request concerns data processed by that store, we recommend contacting the store first; Shelfi will help the store fulfil your request.

Shelfi is a service for businesses and is not directed at anyone under the age of 18. We do not knowingly collect personal data from anyone under 18.

We may update this policy from time to time. The current version is published on this page and takes effect from its publication date; we will also notify you of significant changes via the email address registered to your account.

If you have any questions about this policy, you can reach us at info@shelfi.net or through our Contact page.