This policy explains what WP Shelf processes and the choices you have. It covers our website and customer accounts, Gloty, SnippetGrove, Crawlune, Tagloom, and our hosted services. Describing a pre-release feature here does not mean it is available to buy.
The short version
- Translations are served from your site. The plugin stores them in your WordPress database. Text submitted for translation is also processed and retained by our service, as explained below.
- Hosted generation sends selected content. SnippetGrove and Crawlune send the source and context needed to generate suggestions to WP Shelf and its AI provider. We keep submitted content and results after the job finishes.
- Label printing stays with your site and printer. Tagloom reads WooCommerce data from your WordPress site and sends rendered labels to your paired Bluetooth printer. It does not send order data to WP Shelf.
Information we collect
Account information. When you sign up for a managed plan, we collect your name, email address, and authentication credentials (passwords are stored only as salted hashes).
Billing information. Payments are handled by our payment processor (Stripe). We receive limited billing metadata such as plan, payment status, customer and subscription identifiers. Stripe stores payment details; we do not store full card numbers.
Usage and diagnostics. We collect aggregate, privacy-respecting analytics about the website (for example page views) and operational metrics for managed plans (for example translation volume, generated items and job failures) to run and improve the Services.
Signup source. During a website visit, we keep the first public page’s product and page category, and a broad source category such as search or the WordPress directory, in your browser tab’s session storage. These categories accompany your signup so we can understand which paths lead to accounts and purchases. We do not store the referring URL, raw campaign tags or a visitor identifier for this purpose. The browser record lasts for the tab’s session; once you sign up, its categories and your selected product or plan become account information. Storage being unavailable does not prevent signup.
Connected sites. Activating or checking a hosted-service license sends its key, your site URL and product identifier; activation also sends the plugin version. We use this information to manage site connections and usage. License keys authenticate WP Shelf requests and are not included in AI generation prompts.
Optional plugin reports. Some of our plugins can send a weekly report about the installation. It is off unless you switch it onin the plugin’s own settings, nothing prompts you to, and a site that never turns it on never sends anything. What it contains is counts and versions: which SEO or related plugins are active, how many published items are missing a field the plugin fills, how many AI crawlers a site blocks — counted, never named, since which ones you block is your own editorial decision — and the WordPress, PHP and plugin versions. It carries no site address, no email address and none of your content— an installation is identified by a one-way hash salted with a random value generated on your own site and never sent, so repeat reports can be counted as one installation. The receiving server can still see your server’s network address, as with any HTTPS request. Each plugin’s readme lists its exact payload. Switching the setting off stops future reports.
Gloty translations. The plugin keeps your translations in your own database, and serving a translated page never calls us. Producing a translation is different: the text you are translating is sent to the Gloty service, which forwards it to the AI engine that translates it.
We do store that text. Source segments and their translations are kept on our side so a string you have already paid to translate can be reused instead of re-translated, and we currently retain them for as long as your account exists rather than deleting them when a job finishes. We do not use your content to train models. You can request deletion at any time — see Your rights below.
SnippetGrove suggestions.Starting generation, or enabling generation on publish, sends the selected page’s title, excerpt or opening body text, URL, language, public taxonomy terms, existing SEO or social fields, and relevant site and product context. This can include your site name, tagline, focus keyphrase, product description and SKU. Image alt-text requests also send the image URL, dimensions, caption and surrounding context so the provider can fetch and inspect the image. A local coverage scan does not submit content for AI generation.
Crawlune suggestions.Starting a rewrite sends the original passage or heading, page title, URL, language, other headings, bounded body or section text, and available audit signals. Local audits, crawler controls and structured-data checks do not submit that content for generation. If you enable IndexNow, publishing or updating a page sends its URL, your site’s host name and verification key to the IndexNow endpoint. Scheduled email reports use your own WordPress mail configuration and chosen recipient.
SnippetGrove and Crawlune also send item and batch identifiers so interrupted work can recover its results. Their WordPress context filters let site developers change the content sent. We store submitted source, context, generated output and job status to process and recover the work. These records remain after completion; they are not automatically deleted when a run finishes. Contact us to request deletion. We do not use submitted content to train models.
Tagloom templates and print history.Tagloom stores these in your WordPress database. Your browser retrieves the selected product or order fields from that site, renders the label and sends it to the printer you pair. Fonts and printer code ship with the plugin; no WP Shelf account, analytics endpoint or hosted print service is involved. Your site’s own access and retention policies apply to these local records.
How we use information
- to provide, secure, and bill the Services;
- to respond to support requests;
- to understand aggregate usage and improve the product;
- to comply with legal obligations.
We do not sell your personal information.
Third parties we rely on
We share the minimum necessary with service providers that help us operate: our payment processor (Stripe), our hosting and infrastructure providers (Vercel and Railway), our transactional email provider (Resend), and the AI providers used for work you request. Gloty translation uses OpenAI and Google Gemini; SnippetGrove and Crawlune generation currently uses OpenAI. Crawlune’s optional IndexNow submissions go directly from your site to IndexNow. Each provider acts under its own terms and privacy commitments. Tagloom does not use these hosted services to print.
Data retention
We keep account and billing records for as long as your account is active and as required by law thereafter. You can ask us to delete your account data at any time, subject to legal retention requirements.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. To exercise these rights, contact us at the address below and we will respond within the timeframe the law requires.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected in the effective date above and, where appropriate, communicated to account holders.
Contact
Questions or requests about your privacy? Email hello@wp-shelf.com.
See also our Terms of Service.