Privacy Policy
Last updated 29 October 2026
This policy explains what personal data Shelfcrew collects, why, and what rights you have. It covers this website, the waitlist and, once you have access, the Shelfcrew platform for brands, agencies and creators.
1. Who we are
Shelfcrew is a trade name of BOKW Commerce, Brinkweg 2, 7076 BJ Varsselder, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 95817506. BOKW Commerce is the controller of the personal data described here. Questions or requests: hello@getshelfcrew.com.
2. What we collect
When you visit the website
We don't use cookies, analytics, advertising pixels or other tracking on this website. Fonts and images are served from our own server, so your browser doesn't contact third parties when you browse it. Our server keeps short-lived technical logs (IP address, browser type, the page requested and the time) to keep the site secure and working.
When you join the waitlist
We collect what you enter in the form: whether you are a brand, agency or creator, your name and email address, and, depending on your role, your brand or agency name, monthly Amazon revenue range, how you sell on Amazon (as a seller, with or without Brand Registry, or as a vendor), the number of Amazon clients you manage, your social media handle and the niche you film.
When you use the platform
- Account data: name, email address, company details and login information.
- Brand data: products, briefs, commission settings and the content creators submit to you.
- Creator data: social media handles, the videos you submit, shipping details you give for samples, and the payout details needed to pay you (handled by our payment provider; we don't store full bank or card numbers).
- Connected accounts: when a brand connects Amazon Ads or Meta, we receive access tokens and the data described in section 4. We never ask for or store your Amazon or Meta passwords.
- Messages: chats between brands, creators and our support.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing the waitlist and inviting you to the pilot | Steps you asked for before entering a contract (Art. 6(1)(b)) |
| Providing the platform: accounts, briefs, samples, submissions, ad launches, reporting and payouts | Performance of our contract with you (Art. 6(1)(b)) |
| Keeping the website and platform secure, preventing fraud and fake traffic | Our legitimate interest in a safe service (Art. 6(1)(f)) |
| Keeping invoices and tax records | Legal obligation (Art. 6(1)(c)) |
| Product updates by email, beyond the waitlist | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
We don't sell personal data, and we don't make decisions about you based solely on automated processing.
4. Amazon data
When a brand connects its Amazon Ads account through Login with Amazon, Shelfcrew uses the Amazon Ads API to access only what is needed to measure creator ads:
- the advertiser profiles the brand authorizes, so the brand can choose which account to use;
- Amazon Attribution advertiser and publisher identifiers;
- the Amazon Attribution tags Shelfcrew creates for approved creator videos;
- aggregated daily Attribution results per tag and per product: clicks, detail page views, add-to-carts, purchases and sales.
Amazon Attribution reports are aggregated and don't identify individual shoppers, and Shelfcrew doesn't try to identify them. We use Amazon data only to show the brand its results and to calculate creator commissions as the brand instructs. Creators see only their own earnings. We don't sell Amazon data, share it with other brands, combine it with other third-party data, use it for ad targeting, or use it to train machine learning models. When a brand disconnects or closes its account, we revoke the access token and delete its Amazon data within 30 days, unless the law requires us to keep part of it. Our Security page describes how we protect it.
5. Who we share data with
We use these service providers, who process data on our behalf under a data processing agreement:
- Hetzner Online GmbH (Germany): hosting of the website and platform, in a data center in the EU (Finland).
- Google: spreadsheets we use to manage the waitlist.
- mijn.host (the Netherlands): email.
- Stripe: creator payouts and brand billing, once the platform is live.
Within the platform, brands and creators they work with see each other's profile, briefs, submissions and messages. When a brand launches an ad, the video and the creator's handle are sent to Meta under Meta's terms. We may also disclose data when the law requires it.
Some providers may process data outside the European Economic Area. In that case we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. How long we keep it
- Waitlist data: until 12 months after the platform launches, or until you ask us to delete it.
- Account data: while your account is active, then deleted within 90 days, apart from what we must keep.
- Amazon data: deleted within 30 days of disconnecting the Amazon Ads account.
- Invoices and payout records: 7 years, as Dutch tax law requires.
- Server logs: up to 30 days.
7. Your rights
You can ask us for access to your data, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@getshelfcrew.com and we will answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.
8. Security
We use encryption in transit, encrypted storage of access tokens, access controls and logging to protect data. If a data breach is likely to affect you, we will tell you without undue delay. See our Security page for details and how to report a vulnerability.
9. Age
Shelfcrew is for people aged 18 and over. We don't knowingly collect data from anyone younger.
10. Changes
We update this policy when our service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or in the platform before it takes effect.