Privacy Policy

I. INTRODUCTION

When you sign up with ShelfPerks, you are trusting us with your information. 2497 Inc. and ShelfPerks ("we," "us," "our," or the "Company") take that responsibility seriously. This Privacy Policy is designed to help you understand how we collect, store, use, and share the personal information you provide, and to assist you in making informed decisions when using our Products and Services.

Defined Terms

For purposes of this Policy:

• "Sites" refers to these websites: https://shelfperks.com, https://www.shelfperks.in, https://2497inc.com, https://grow.shelfperks.com, https://grow.shelfperks.in, and https://hardware.shelfperks.com.
• "Apps" refers to our mobile and tablet applications for Apple iOS and Android devices.
• "Services" refers to the Company's services accessed via the Sites, the Apps, or other electronic or non-electronic methods.
• "Personal Data" means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).
• "Usage Data" is data collected automatically, generated by the use of the Apps, Sites, or Services, or from the Service infrastructure itself.
• "Cookies" are small files stored on your device.
• "Data Controller" means the natural or legal person who determines the purposes for which and the manner in which any personal information is processed. We are the Data Controller of your Personal Data.
• "Data Processors (or Service Providers)" means any natural or legal person who processes data on behalf of the Data Controller. We may use various Service Providers to process your data effectively.
• "Data Subject" and "User" refer to any living individual using our Service, App, or Site who is the subject of Personal Data.

II. INFORMATION WE COLLECT

We collect information to provide better service to all our users. When you are signed in, we collect information tied to your account credentials, which we treat as Personal Data.

Categories of Personal Data Collected

Personal Data we collect may include, but is not limited to:

• Identifiers: Email address, first name, last name, employer identifier or taxpayer identifier, phone number, street name, door number, apartment number, ZIP/postal code, city, county, state, province, country, IP address, device identifiers.
• Personal Information: Contact preference, age, date of birth.
• Payment Information: Credit/debit card information, payment card or contactless payment processing keys. Payment card data is processed securely through our payment processor partners; we do not store full payment card details on our systems.
• Commercial Information: Transaction details, sales history, purchase history, inventory details, product information.
• Geolocation Data: GPS data, store location, wireless network information, Bluetooth signals.
• Professional Information: Business registration details, business name and address, supplier information, employee records.
• Internet or Network Activity: Usage data, device type and settings, operating system, mobile network, crash reports, cookies, referrer URL, browser type, login information.
• Biometric Information: Where you choose to use biometric authentication features (such as fingerprint or facial recognition login) on devices running our Apps, we may process biometric data to enable those features. Biometric data is processed locally on your device where possible and is not stored on our servers unless technically necessary for the feature to function. We retain biometric data only for as long as you maintain the applicable authentication feature enabled, and delete it promptly when you disable the feature or delete your account.
• Order and Shipping Information: For purchases made through the ShelfPerks Hardware Store: shipping and billing address, order history, products purchased, shipping carrier and tracking data, and delivery confirmation.
• Hardware Returns and Warranty Information: Return request details, return reasons, serial numbers or product identifiers, diagnostic logs, warranty claim information, refund or exchange status, and correspondence related to returns or warranty claims for Hardware Store purchases.
• Partner Program Information: For applicants and participants in the ShelfPerks Partner Program (Technology, Referral, Sales Agent, Reseller, and Enterprise Partners): business or individual name, tax identification information (for example, for U.S. tax reporting purposes), bank or payout account information, website or social media handles, audience or reach information you provide, and referral link or code tracking and performance data.
• Referral and Signup Attribution Data: Where you sign up or purchase using a code or link distributed by a Partner, the code or link used and the date of referral, so the referring Partner can be credited and compensated.
• Merchant Loyalty Program Information: Where a Merchant operates a loyalty program using our tools, we process enrollment data, points balances, and redemption history on that Merchant's behalf. For this data, the Merchant is the Data Controller and ShelfPerks acts as a Data Processor or Service Provider.
• Third-Party Integration Data: Where you connect third-party applications or services to ShelfPerks through our integration platform, we may collect information necessary to enable that integration, including API credentials, connection settings, and data exchanged between ShelfPerks and the third-party service. The scope of data shared varies by integration and is limited to what is necessary for the integration to function.

• Government-issued identifiers: Social Security numbers, driver's license numbers, passport numbers, taxpayer identification numbers — collected only when required for account verification, tax compliance, or legal obligations, including for Partner Program tax reporting.
• Financial account information: Bank account details, payment card information — processed securely through our payment processor partners.
• Precise geolocation data: GPS coordinates — collected only when you enable location services for delivery or fraud prevention.
• Personal information of minors: We do not knowingly collect personal information from children under 16 without parental consent.
• Biometric data: Fingerprint or facial recognition data used for authentication — processed locally on your device where possible, not stored on our servers unless technically necessary.

III. OTHER SOURCES OF PERSONAL INFORMATION

We may derive information about you from third parties, including identity verification services, background information providers, public records, credit reports, and compliance reports.

We may receive Personal Data about you when others add you to their customer data, supplier data, contacts, or calendar in our Services, or send messages through our Services (including receipts, purchase orders, invoices, gift cards, or gift certificates).

We may accumulate Personal Data and usage data when you use the Services, Apps, or the sites of our merchants and partners.

If you are a potential candidate for employment with ShelfPerks, 2497 Inc., or our subsidiaries or partners, we may receive your Personal Data directly or through third parties such as recruiters or external websites to evaluate your candidacy or contact you about opportunities.

Partner-held referral data. If you register for a ShelfPerks Merchant Account using a signup code, discount code, or referral link provided by a ShelfPerks Partner (including a Referral Partner, Sales Agent Partner, or Reseller Partner), that Partner may independently collect and retain information about your referral or signup, such as the code used, the date of referral, and your contact information. That Partner's collection, use, and retention of that information is governed by the Partner's own privacy practices, not this Policy. Contact the Partner directly regarding information they hold about you, or contact us at privacy@shelfperks.com if you need help identifying the Partner who referred you.

All or some of the information in this section may fall into categories of personal data under the CCPA: Identifiers, Personal Information, and Professional Information.

IV. HOW WE USE YOUR DATA

Purposes of Processing

We use your data for the following purposes:

• Account Management: To create and update your account, verify your identity, and verify your customers' and employees' identities.
• Service Delivery: To enable your commerce experience, point of sale, deliveries, inventory management, purchase orders, order tracking, invoicing, receipt generation, product suggestions, hardware order fulfillment, and shipping.
• Business Operations: To help you track sales, customer visits, supplier fulfillments, and partner deliveries.
• Personalization and Improvement: To optimize and personalize the products and services we offer by aggregating information collected from our Apps, Services, Sites, and partners.
• Product Development: To develop, test, and improve new or existing Apps, Sites, and Services.
• Security and Fraud Prevention: To maintain safety and security, including detecting, deterring, and combating fraud or unsafe activities (including suspected bot, hedging, or resale abuse on the Hardware Store, and fraud within the Partner Program), unauthorized practices, and unsafe products.
• Communications: To provide news, special offers, perks, general information, user manuals, and usage alerts about our Services and similar goods and services we offer, unless you have opted out.
• Customer Support: To provide customer support and notify you of changes to our Services.
• Legal Compliance: To comply with legal obligations under applicable laws, including tax laws, GST regulations, RBI guidelines, GDPR, CCPA, and other regulatory requirements, including tax reporting for Partner Program compensation.

• Performance of contract: To deliver Services you requested.
• Legal compliance: To meet our legal obligations.
• Legitimate interests: For fraud prevention, security, service improvement, and analytics, where not overridden by your rights.
• Consent: For marketing communications, optional features, and processing of sensitive personal information, which you may withdraw at any time.

V. COOKIES AND OTHER TECHNOLOGIES

We use: session cookies to operate our Services; preference cookies to remember your preferences; security cookies for authentication and security; analytics cookies to understand how you interact with our Services; and, subject to your consent, advertising cookies to deliver relevant advertisements.

We also use beacons, tags, and scripts to collect and track information and to improve our Services. You can instruct your browser to refuse cookies; however, some functionality may become unavailable.

We recognize and honor Global Privacy Control (GPC) signals as a valid opt-out of the sale and sharing of personal information. When we detect a valid GPC signal, we will treat it as a request to opt out, display confirmation, and apply your preference across our services.

We do not currently respond to traditional, non-GPC "Do Not Track" browser signals. You can control tracking through your cookie preferences or browser settings. Learn more at http://www.allaboutcookies.org.

VI. DISCLOSURE TO THIRD PARTIES

We may share your information with:

• Service Users: Merchants, stores, warehouses, customers, and suppliers you interact with.
• Business Affiliates: To accept payments, schedule appointments, send invoices, fulfill and deliver orders, and provide support.
• Service Providers and Partners: To provide, maintain, and improve our Services, including running advertising, contests, coupons, and gift card programs.
• Analytics Partners: Aggregate statistics only, with no Personal Data shared.
• Vendors and Suppliers: For technical services, audit, payments, fraud detection, marketing, and infrastructure.
• Payment Processors: Stripe, Fiserv, Helcim, Stax, Coinbase Commerce, Apple (for App Store subscriptions), Google (for Play Store subscriptions), and other payment processing partners — for payment processing only, including Hardware Store checkout.
• Shipping and Logistics Partners: UPS, USPS, FedEx, and other carriers, to fulfill and deliver Hardware Store orders.
• Referral Attribution: Where you sign up or purchase using a Partner's code or referral link, we may share limited information with that Partner (such as confirmation of your signup or purchase and the code or link used) so the Partner can be credited and compensated.
• Partner Program Payout and Tax Reporting: Payment or payout processors, and disclosure to tax authorities (such as the IRS on Form 1099) as required by law for Partner compensation.
• Cloud Service Providers: For data storage and backup, under strict data processing agreements with encryption and security requirements.
• Legal Authorities: When required by law, court order, or to prevent illegal activities. We share data with law enforcement in response to legal requests.
• Business Transfers: In case of merger, acquisition, or asset sale, with appropriate safeguards to protect your data.

VII. SALE AND SHARING OF PERSONAL DATA

California Residents

ShelfPerks does not sell or broker your personal information for monetary or other valuable consideration. We may "share" personal information as defined under the CCPA, for example through third-party analytics and advertising services. You have the right to opt out of such sharing.

We have not sold any Personal Data of our consumers or merchants in the twelve months prior to the effective date of this Privacy Policy. We do not and will not sell personal data of consumers under 16 years of age.

Do Not Sell or Share My Personal Information: A "Do Not Sell or Share My Personal Information" link is available in the footer of all ShelfPerks websites and applications. You may also exercise this right by contacting us at privacy@shelfperks.com.

VIII. RETENTION OF PERSONAL DATA

We retain Personal Data according to the following schedule:

IX. POLICY ON "DO NOT TRACK" SIGNALS

Global Privacy Control (GPC): We recognize and honor GPC signals. When we detect a valid GPC signal from your browser, we will treat it as a request to opt out of the sale and sharing of your personal information, display confirmation that your opt-out has been honored, and apply your preference across our services.

Traditional DNT Signals: For traditional "Do Not Track" browser signals that do not follow the GPC standard, we do not currently respond to these signals. You can control tracking through your cookie banner or browser settings.

Learn more at https://globalprivacycontrol.org/ and https://allaboutdnt.com/.

X. FOR EUROPEAN ECONOMIC AREA RESIDENTS

If you reside in the European Union, European Economic Area (EEA), or Switzerland, you have certain data protection rights under the General Data Protection Regulation (GDPR), including:

• Right of access: To request copies of your Personal Data.
• Right to rectification: To request correction of inaccurate information.
• Right to erasure: To request deletion of your Personal Data, subject to certain conditions and legal exceptions.
• Right to restrict processing: To request that we limit processing of your Personal Data.
• Right to data portability: To receive your Personal Data in a structured, machine-readable format, or request transfer to another controller.
• Right to object: To object to our processing of your Personal Data.
• Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time.
• Right to lodge a complaint: With your local data protection authority.
• Right regarding automated decisions: Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

XI. CHILDREN'S PRIVACY

Our Sites, Apps, and Services are not directed to anyone under the age of 13, and we request that they not provide Personal Data to us. We do not knowingly collect personal information from children under 13 years of age.

• Ages 13 to 15: You may use our Services only with the involvement of a parent or guardian.
• Ages 16 to 17: You may use our Services with parental or guardian involvement.
• Ages 18 and older: You may use our Services independently.

XII. REQUEST ACCESS TO OR DELETION OF PERSONAL INFORMATION

If you have an account with us, you can access and update the following information directly in your profile settings: name, address, email address, phone number, password, linked credit card or bank account information, and business or tax information.

You may contact us at privacy@2497inc.com or privacy@shelfperks.com to:

• Request access to Personal Data we hold that is not accessible through your account profile.
• Request deletion of your Personal Data.
• Request correction of inaccurate Personal Data.
• Request restriction of processing of your Personal Data.
• Request a portable copy of your Personal Data.
• Object to processing of your Personal Data.
• Opt out of the sale or sharing of your personal information.
• Limit the use of your sensitive personal information.

• Most requests (CCPA and general): 45 days, with a possible 45-day extension if necessary (with notice to you).
• GDPR data subject requests: Without undue delay and within one month (extendable to three months for complex requests, with notice to you).
• Grievance complaints under certain jurisdictions: 15 days.

XIII. DATA SECURITY

We implement industry-standard technical and organizational measures to protect your data:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 or higher for data in transit; end-to-end encryption for sensitive communications.
• Access Controls: Role-based access controls with principle of least privilege; multi-factor authentication for employee access to systems containing personal data; regular access reviews and immediate revocation upon termination.
• Monitoring: 24/7 security monitoring, intrusion detection, and regular vulnerability testing.
• Vendor Management: Due diligence and contractual security requirements for all vendors with access to Personal Data.
• Employee Training: Annual privacy and security training for all employees with access to Personal Data.
• Incident Response: Documented breach detection, response, and notification procedures.

XIV. MOBILE APP SPECIFIC PRIVACY INFORMATION

iOS App (Apple App Store)

• Privacy Nutrition Label: Our App Store listing includes a Privacy Nutrition Label disclosing the types of data our app collects and how it is used. This is kept up to date with our current data practices.
• Privacy Manifest: Our iOS app includes a privacy manifest file declaring the types of data collected and required reasons for using certain APIs.
• App Tracking Transparency: If our app engages in tracking as defined by Apple, we request your permission through Apple's App Tracking Transparency framework before tracking your activity across other companies' apps and websites.
• Privacy Policy Access: Available from our App Store listing, within the app settings menu, and at https://shelfperks.com/privacy-policy.

• Data Safety Section: Our Google Play Store listing includes a Data Safety section disclosing our data collection, sharing, and security practices.
• Privacy Policy Access: Available from our Google Play Store listing, within the app settings menu, and at https://shelfperks.com/privacy-policy.
• Permissions: Our app requests only the permissions necessary for functionality. You can review and manage these permissions in your device settings.

XV. CALIFORNIA-SPECIFIC PRIVACY RIGHTS

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know: Request disclosure of categories and specific pieces of personal information we collect; categories of sources; business or commercial purposes for collection; and categories of third parties with whom we share personal information.
• Delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Correct: Request correction of inaccurate personal information.
• Opt-Out of Sale/Sharing: Opt out of the sale or sharing of personal information. We do not sell personal information, but provide an opt-out mechanism for sharing activities.
• Limit Use of Sensitive Personal Information: Limit our use and disclosure of sensitive personal information to purposes necessary to perform services or provide goods reasonably expected by an average consumer.
• Non-Discrimination: Exercise these rights without discrimination.

XVI. OTHER U.S. STATE PRIVACY RIGHTS

Beyond California, numerous other states — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others whose comprehensive privacy laws have taken effect through 2026 — grant their residents similar rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. You can exercise these rights by contacting privacy@shelfperks.com, and we will honor requests consistent with the law applicable to you.

XVII. CANADA-SPECIFIC PRIVACY RIGHTS

For users in Canada, our collection, use, and disclosure of personal information is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Canadian users have the right to access their personal information, request correction of inaccuracies, and lodge complaints with the Office of the Privacy Commissioner of Canada or applicable provincial privacy commissioners.

XVIII. OPT-OUTS AND COMMUNICATION PREFERENCES

You may opt out of marketing communications at any time by: clicking the unsubscribe link in any marketing email; adjusting your preferences in your account settings; contacting privacy@shelfperks.com; or replying "STOP" to SMS marketing messages. You will continue to receive transactional and service-related messages (such as order confirmations, billing notices, and account notifications) even after opting out of marketing communications.

Manage cookie preferences through our cookie banner, your browser settings, or third-party tools such as http://optout.networkadvertising.org/. We honor Global Privacy Control signals as a valid opt-out. Manage push notifications through your device settings.

XIX. UPDATES TO THIS POLICY

We may update this Privacy Policy periodically. The "Last Updated" date reflects the most recent revision. We will communicate material changes by email, prominent notice on our Sites, in-app notification, or notice in your account dashboard. Changes take effect when posted. Continued use after changes are posted constitutes acceptance. If you disagree with changes, you may cancel your account by contacting support@shelfperks.com.

XX. INTERNATIONAL USERS

ShelfPerks is based in the United States. If you access our Services from outside the United States, your information may be transferred to and processed in the United States and other countries where our service providers operate, which may have different data protection laws. We take steps to ensure adequate protection wherever we process your data.

• EEA: Standard Contractual Clauses, adequacy decisions, or your explicit consent.
• United Kingdom: Mechanisms approved under UK data protection law.
• Canada: Compliance with PIPEDA and applicable provincial privacy laws.
• Other jurisdictions: We comply with applicable law where we operate. Contact privacy@shelfperks.com with questions about your jurisdiction.

XXI. ADDITIONAL DISCLOSURES

Automated decision-making. We may use automated decision-making or profiling for fraud detection and prevention (including on the Hardware Store and within the Partner Program), product recommendations, business analytics, and risk assessment. You may request information about the logic involved, contest decisions made solely by automated means, request human review, and express your point of view.

Third-party links. Our Services may contain links to third-party websites, applications, or services that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

XXII. CONTACT INFORMATION

• General Privacy Inquiries: privacy@2497inc.com or privacy@shelfperks.com
• Data Protection Officer (GDPR): dpo@shelfperks.com
• California Privacy Rights: privacy@shelfperks.com (subject line: "California Privacy Rights Request")
• Partner Program Inquiries: partner@shelfperks.com
• Support and Technical Questions: support@shelfperks.com or https://support.shelfperks.com