Privacy Policy
Effective date: May 28, 2026 · Last updated: May 28, 2026
1. Who We Are
Shelah is a product of Shelah.ai, based in Brooklyn, NY. We provide AI-powered dispatch software for grocery delivery operations (“the Service”). When we say “we,” “us,” or “Shelah.ai,” we mean the entity operating Shelah.
Questions about this policy: dispatch@shelah.ai
2. What We Collect
We collect only what is necessary to operate the Service:
Account & Store Data
Store name, owner name, work email address, billing information (processed by Stripe — we do not store raw card numbers).
Driver Data
Driver name, 4-digit PIN (stored as a SHA-256 hash — never in plain text), and GPS coordinates collected at 30-second intervals during active delivery shifts. GPS collection stops when the driver ends their shift or closes the app.
Order & Delivery Data
Customer delivery addresses, order contents, delivery timestamps, bag scan events, and route completion data. This data is provided by your store and belongs to your store.
Usage & Log Data
IP addresses, browser type, pages visited within the Service, error logs. Used for debugging and service improvement only.
Demo Requests
Name, email, store name, and phone number submitted through our demo request form. Used only to contact you about the Service.
3. How We Use Your Data
- To operate and improve the Shelah Service
- To dispatch drivers, calculate routes, and generate alerts
- To send transactional notifications (SMS via Twilio, push notifications)
- To generate audit trails and routing decision logs for your store
- To respond to support requests and demo inquiries
- To detect fraud, abuse, and security incidents
- To comply with legal obligations
We do not use your data for advertising. We do not build ad profiles.
4. Data Retention
We retain operational data (orders, GPS records, routing decisions, bag scan events) for 2 years from the date of creation, then delete it automatically. Account data is retained for the duration of your subscription plus 90 days after cancellation. You may request earlier deletion at any time (see Section 7).
5. Data Sharing
We do not sell, rent, or trade your personal data or your customers' data to any third party.
We share data only with:
- Supabase — our database and authentication provider (data stored in US East)
- Vercel — our hosting and compute provider
- Twilio — SMS notifications (only the phone number and message text are transmitted)
- Stripe — billing and payment processing
- Law enforcement — only when required by valid legal process
6. Driver GPS Notice
Drivers are shown a full disclosure screen before their first shift explaining what GPS data is collected, how it is used, and when it stops. Drivers must scroll through the disclosure and confirm acceptance before the app activates GPS tracking. Store owners are responsible for ensuring drivers have received this disclosure.
The standalone disclosure is available at: shelah.ai/driver/disclosure
7. Your Rights
Depending on your location, you may have rights under GDPR (EEA residents) or CCPA (California residents), including:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict certain processing
- Data portability (receive your data in a machine-readable format)
- California residents: the right to know what categories of data we collect and to opt out of sale (we do not sell data)
To exercise any of these rights, email dispatch@shelah.ai with “Privacy Request” in the subject line. We will respond within 30 days.
8. Security
We use industry-standard security practices: all data is encrypted in transit (TLS 1.2+) and at rest. Driver PINs are one-way hashed (SHA-256) and never stored in recoverable form. Access to production data is restricted to authorized personnel only. We conduct periodic security reviews and maintain incident response procedures.
9. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately at dispatch@shelah.ai.
10. Changes to This Policy
We may update this policy from time to time. We will notify active customers by email at least 14 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
11. Contact
Shelah.ai · Brooklyn, NY
dispatch@shelah.ai