Version 2026-10-30-v5
Privacy Policy
Effective date: 2026-10-30 (UTC)
This policy explains how GRIM J9NOVANEXUS ANALYTICS LLC ("we", "us") collects, uses, shares, and protects your personal information when you use Shelby AI, and the rights you have.
1. Information We Collect
| Category | What it includes | Source |
|---|---|---|
| Account information | Email, verified phone number, agreement records (version and time), age (18+) confirmation | You |
| Content | Your requests and messages, generated app code, chat responses | You / the Service |
| Web search | When you turn on web search, the search queries the model makes from your request, and the results and sources it cites | You / the Service / the model provider |
| Shared apps | Apps you share, the version shared, your access settings (a password is stored only in hashed form), and the review result | You / the Service |
| Reports | The reason and details given in a report about a shared app. We store a one-way hash of the reporter's IP address rather than the address itself, to prevent abuse | The person reporting |
| Usage and billing | Model, token counts, cost, point transactions, and reset card records for each request | Generated automatically |
| Purchases and payments | Orders, items purchased, amounts, currency, taxes, payment status, refund and dispute status, and the account the purchase belongs to. We do not receive or store your full card number | Shopify / you |
| Referrals | Who invited whom, the related purchases, and reward amounts and status | Generated automatically |
| Security and device | IP address, country or region, browser and device information, sign-in sessions, human-verification results, regional restriction records, risk records | Collected automatically |
| Appeals and support | Information you provide when appealing or contacting support, by email or through the support messenger | You |
| Account closure | Your closure request, the time it was made, and the status of anonymization | You / generated automatically |
We do not intentionally collect sensitive personal information. Please do not submit other people's personal information, or your own ID numbers, card numbers, passwords, or other sensitive data, in your input or in support conversations.
2. How We Use Information
- To provide the Service: process your requests, generate apps and responses, run web search when you turn it on, save your projects and chats, and host the apps you share;
- Account and security: verify identity, check regional and age requirements, tell people apart from automated abuse when sign-in codes are requested, prevent fraud and abuse (including referral and payment abuse), and enforce the Usage Policy;
- Billing and purchases: calculate points, hold and settle usage, process reset cards, verify payments, add purchases to your account, handle refunds and payment disputes, and calculate and reverse referral rewards;
- Shared apps and reports: review apps before they are shared, control access under your settings, and review reports and remove apps that break the Usage Policy;
- Notifications: send verification codes, account status emails, purchase and refund notices, and service-related messages;
- Support: handle appeals and support requests;
- Account closure: close your account and anonymize your contact details as described in Section 4;
- Legal compliance: meet legal obligations, including accounting and tax obligations, and respond to lawful requests from authorities.
We do not sell your personal information, use it for targeted advertising, or use your content to train models.
Legal bases (EU/UK). If EU or UK data protection law applies to you, we process your information: to perform our contract with you (providing the Service, purchases, shared apps, and support); for our legitimate interests in keeping the Service secure and preventing fraud and abuse, which we balance against your rights; to meet legal obligations (such as accounting, tax, and responding to lawful requests); and with your consent where the law requires it (such as certain cookies).
3. Who We Share Information With
We share information with the following providers only as needed to run the Service, and require them to protect it under our agreements:
| Provider | Purpose | Information shared |
|---|---|---|
| Anthropic, OpenAI | Generating responses and apps; automated safety review; web search when you turn it on | The content you submit and the necessary context. For web search, the model provider's built-in search tool sends search queries to search services and retrieves third-party web pages |
| Cloudflare | Hosting (including shared apps), database, access protection; Turnstile human verification | All hosted service data. When you request a sign-in code, the Turnstile check runs in your browser and Cloudflare processes browser and device signals; we then send Cloudflare the one-time verification token and your IP address to confirm the result |
| Resend | Sending email | Email address and message content |
| Twilio | Phone verification | Phone number |
| Shopify and its payment providers | Checkout, payment processing, orders, refunds, and payment disputes | Your email address, the items purchased, prices, and an identifier that links the order to your account. You enter your payment details directly with Shopify or its payment providers; they process them under their own terms and privacy policies |
| Intercom (only once the support messenger is enabled) | In-product support messenger | A user identifier, your email address, and your name if you gave one; messages and files you send through the messenger; and the browser, device, and page information needed to run it. We do not send your phone number, chat or app content, or billing details to Intercom |
Model providers handle your content under their own API terms. According to their published terms, data submitted through their APIs is not used to train their models by default, but may be retained for a period for safety and abuse monitoring. We minimize what we send; for example, we do not enable OpenAI's response storage option. To reduce cost and latency, we may use the providers' prompt caching. Websites that appear in web search results are operated by third parties under their own policies.
Shared apps. When you share an app, its content is visible to the people who can open it under the access setting you chose: anyone who has the link, people who know the password, or signed-in users. Anyone who can see a shared app can copy what it shows.
We may also disclose information when required by law, to protect the safety of users or the public, to investigate violations, or as part of a merger or acquisition, in which case we will notify you.
4. Retention
| Data | How long we keep it |
|---|---|
| Chat content | Until you delete that chat or all chats, or close your account |
| Projects and generated apps | Until you delete the project or close your account |
| Shared apps | Until you withdraw the app, we remove it, or you close your account. Review and removal records are kept as security audit records |
| Sign-in codes | Stored only as a hash; expire after 10 minutes |
| Usage, billing, purchase, referral, and security audit records | Kept for 7 years to meet billing, accounting, security, and legal obligations; these records do not contain chat text |
| Support conversations | Only as long as needed to handle your request and keep a record of it |
| Account information | For as long as your account exists; deleted or anonymized within 30 days after account closure, unless the law requires us to keep it |
| Sign-ins from unsupported regions | If you confirm your email from an unsupported region, we keep your email address, the regional restriction record, and the related notice so we can enforce the restriction and handle your review request. These are kept as account information while the account exists; the restriction and its audit entries are kept as security audit records for 7 years |
Deleting a chat removes its text but not the related usage and billing records, which contain no chat text. To manage context length, the model may only consider recent messages, but the full history is kept until you delete it.
When you close your account, we sign you out on all devices, withdraw your shared apps, and delete your chats, apps, and workspace content. Within 30 days we anonymize your contact details, unless the law requires us to keep them. After that, you may register again with the same email address; your previous content and benefits will not be restored. The usage, billing, and security audit records described above are kept for 7 years. Historical audit, appeal, or internal review records may contain the contact details you had at the time or information you supplied; we keep them only for those purposes. Some copies may remain in backups for a limited time before they are overwritten.
5. Your Rights
Depending on where you live, including under the California Consumer Privacy Act (CCPA/CPRA), the EU or UK General Data Protection Regulation, and other laws, you may have the right to:
- Access the personal information we hold about you;
- Delete your personal information;
- Correct inaccurate information;
- Obtain a copy of your data;
- Object to or restrict certain processing, and withdraw consent where we rely on it;
- Opt out of sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising;
- Non-discrimination: exercising these rights will not lead to different treatment;
- Complain to your local data protection authority.
You can delete chats and projects and close your account directly in the product, or email [email protected] to exercise your other rights. We may need to verify your identity first.
6. Cookies and Similar Technologies
| Type | Purpose | When it is used |
|---|---|---|
| Essential | Keeping you signed in; protecting sign-in and forms; Turnstile human verification; opening password-protected shared apps | Whenever you use the Service |
| Support messenger (Intercom) | Running the support messenger and keeping your conversation available across pages and visits | Only once the support messenger is enabled, and as described in the notice shown with it |
We do not use advertising or cross-site tracking cookies. Where the law requires your consent for a cookie or similar technology, we ask for it before using it. When you sign out, we end your support messenger session on that device.
7. Security
We protect data with encryption in transit, access controls, hashed verification codes and share passwords, sandboxed previews and shared apps, and audit logs. No system is perfectly secure. If a security incident affects your data, we will notify you as required by law.
8. Minors
The Service is only for people 18 and older. We do not knowingly collect information from minors; if we learn we have, we will delete the account and its data.
9. International Transfers
We are based in the United States. We and our providers may process your information in the United States and other countries, whose data protection laws may differ from those where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses or our providers' certifications, and we take appropriate steps to protect data in transit. You can contact us for more information about these safeguards.
10. Updates
We may update this policy. We will give advance notice of material changes by email or in-product notice.
11. Contact
GRIM J9NOVANEXUS ANALYTICS LLC Address: 211 W Main St, Frankfort, KY 40601, USA Privacy inquiries: [email protected]
If the Chinese and English versions differ, the English version prevails.