How we protect the customer, stock and money records your business runs on: where we stand on the law, what keeps your data safe, and who else touches it.
Last updated October 6, 2026
Privacy law (GDPR and CCPA)
You can download everything we hold on your business, or delete the whole account, without asking us. Deleting gives you 30 days to change your mind: sign back in and choose to keep your account. After that it is erased, apart from records the law requires us to keep.
Card security (PCI)
Card numbers never reach us. Our payment processor handles them, so there is nothing here to steal and the rules that apply to you stay as light as they can be.
Marketing email law (CAN-SPAM)
A promotional email cannot leave the system without a working unsubscribe link and a real postal address on it. We block the send rather than trust whoever wrote it.
Deleted means deleted
Erased data is gone from our backups within 180 days, and we check that every night.
A data processing agreement
Our Data Processing Agreement is part of our terms for every business, so there is nothing to sign. If your organization needs a countersigned copy, we will send one.
Where your data is kept
We store it in the United States. Every company that handles it is named on our subprocessor page, with where it is located.
A stolen password on its own should not be enough to get into your business.
Other businesses on the platform cannot see your records, and your staff see only what you have given them.
Scrambled while it is stored and while it travels, so it is unreadable to anyone who gets hold of it.
We never see or keep card numbers, yours or your customers'.
When something changes, you can find out who changed it and when, without calling support.
Someone trying to guess their way in, or hammering the system, gets stopped before it reaches your data.
Your browser is told to refuse anything we did not put there, so a bad advert or injected script has nothing to stand on.
The question people ask least and wonder about most. Nobody here can take over your account.
Erased data is gone from our backups within 180 days, and we check that every night.
Every outside company that handles your data is named, with what it does for us, what information reaches it, and where it is located. The list is updated whenever a provider is added or dropped.
Where we stand on formal certifications, so you do not have to ask.
SOC 2 Type II
Not yet certified. It is a yearly outside audit we will take on as we grow. Several of the companies underneath us already hold it, and they are listed on our subprocessor page.
ISO 27001
Not yet certified.
HIPAA
We are not set up to handle protected health information and do not sign BAAs. Please do not put patient records into the platform.
What we collect, why, and what you can ask us to do about it.
The agreement covering your use of the platform.
How we handle personal data on your behalf, part of the terms for every business.
Every outside company that touches your data, and what reaches each one.
Our security contact details, published where researchers look for them.
Found a security problem? Email security@trackyourshelves.com. It goes to the engineers, not a general support queue. We reply within 72 hours and keep you posted until it is fixed.
Reviewing us for your company and need more detail than this page gives? Ask at the same address and we will answer properly. We keep the specifics off a public page on purpose.
For privacy questions or to request your records, see our Privacy Policy.