What we do with your details.

01. What the application asks for

The beta application is eight questions. Six are required, and the two that are not are marked optional on the form itself.

Your name

So we know what to call you when we reply.

Your email address

The only way we have to answer you.

Your primary marketplace

Free text: for example, Amazon US. We offer no list to pick from.

Approximate monthly Amazon revenue

A band, never an exact figure. We do not ask you to be precise.

Active products (ASINs)

A band. Roughly how many products you actively sell, not which ones.

Approximate monthly Amazon ad spend

A band, including the option that you run no advertising at all.

Which decisions take the most time today

Optional. Any number of choices from a fixed list we offer.

What you would want ShOpti to help you decide

Optional free text. Whatever you write reaches us exactly as you wrote it, so please leave out anything you would rather we did not hold.

The three bands exist so we can decide who to speak to first. None of them is a threshold, and no answer disqualifies anyone.

02. What our server records alongside it

A few technical details are attached to each application. They are there to keep the form working and to stop a script flooding it, not to profile anyone.

The time the application arrived

Written by our server, never by your browser.

The country of your connection

The two-letter country code our host reports. Not a city, and not a location.

A one-way hash of your IP address

Your IP address itself is never stored. What is stored is a salted SHA-256 of it, which lets us count how many applications came from one client in the past hour and does nothing else.

Your browser’s user-agent string

The line every browser sends identifying itself. Kept for triage, and shortened.

We also add our own status and private notes to your application as we work through it (that we have replied, for instance). Those are written by a person, not by the system.

03. What we do with it

We read every application, decide who to speak to first, and reply by email. That is the whole purpose.

Applying is not acceptance into the beta, and it creates no account and no password. It gives ShOpti no connection to your Amazon seller account and no access to your Amazon data. This form asks for no credential of any kind.

We do not sell your details, share them for advertising, or add you to a marketing list. There is no newsletter to be subscribed to.

04. Why we are allowed to hold it

Where the UK or EU GDPR applies to you, we have to name the lawful basis we rely on. For everything described above it is Article 6(1)(f): legitimate interests. The interests are ours, in running a private beta and answering the people who ask to join it, and they are these four things and nothing else.

Evaluating and prioritising applications

Reading what you sent and deciding who we can usefully speak to first. A private beta has a limited number of places, and the three bands are how we allocate them.

Replying to you

You asked to hear from us, and the address you gave is the only way we have to answer.

Operating and securing the form

Keeping the application form working, keeping what you submitted intact, and being able to look at a failed submission and see what went wrong.

Preventing abuse and rate-limit evasion

Stopping one client flooding the form. This is the only reason the salted hash described above exists, and it is why an application carries one at all.

We do not treat submitting the form as consent, because it is not: you sent an application, and what we rely on is our own interest in reading it. That distinction is in your favour: a basis of legitimate interests is one you can object to, and the rights section below says how.

05. Where it is stored, and who else touches it

Besides us, two companies handle your application, and each does one job.

Cloudflare

Serves shopti.app and hosts the database your application is stored in. Because Cloudflare delivers every page of this site, it also receives your IP address and basic request information in the ordinary course of doing that (on every visit, not only when you apply).

Resend

Sends us one email when an application arrives, so that we see it the same day. That email carries the answers you gave, which means Resend handles them in transit.

No other company receives your application. Inside Cloudflare and Resend it is reachable by the authorised personnel and sub-processors each of them needs in order to provide its service, under the confidentiality terms of their own data-processing agreements. On our side, we download the applications as a spreadsheet to work through them; that export is protected by a secret token and cannot change or delete anything.

06. Where it goes in the world

Cloudflare and Resend are both United States companies, so your application is transferred outside the UK and the EEA when they handle it.

Both publish data-processing terms for exactly that transfer. Each incorporates the European Commission’s Standard Contractual Clauses, extended by the UK Addendum for data protected under UK law, and each states that it participates in the EU–U.S. Data Privacy Framework. Those terms are what the transfer relies on.

07. Cookies, analytics and tracking

There are none. This site sets no cookies, runs no analytics, embeds no third-party scripts, loads no tracking pixels and carries no advertising or social tags.

The form writes nothing to your browser either (no cookie, no local storage, no session storage), and it puts nothing you typed into the address bar. Fonts and images are served from this site rather than from someone else’s network, so reading these pages contacts no other company.

Because there is nothing to consent to, there is no cookie banner.

08. How long we keep it

We keep an application only while it is reasonably needed for the purposes above (evaluating the private beta and following up with the people who applied), so that we can return to someone we could not speak to straight away.

To be plain about it: nothing deletes them automatically. No expiry is set on the database and no scheduled job removes anything, so an application stays until we delete it by hand. We have set no fixed period, because setting one we did not enforce would be worse than saying so, and we will delete yours whenever you ask.

09. Email you will and will not get

Submitting the form triggers no automatic acknowledgement. If you hear from us, it is a person replying to what you wrote, at the address you gave.

We send applicants no other automated email of any kind.

10. How it is protected

Your application travels to us over an encrypted connection and is stored in a database only we can reach. The export sits behind a secret token, and your IP address is reduced to a salted hash before anything is written down.

None of that is a guarantee of perfect security, and we will not claim one. It is the reason the optional free-text question is worth answering with the same care you would give any email.

11. Your rights, and how to use them

Write to us from the address you applied with, and we will do any of the following.

Send you a copy

Everything we hold from your application, together with the technical details recorded alongside it.

Correct it

If an answer was wrong, or your details have changed.

Delete it

We remove your application from the database, and tell you when it is done.

Restrict it

Keep your application on file but stop using it, while we settle something you have raised: a correction you have asked for, or an objection we are still considering.

Object to it

Because we rely on legitimate interests rather than your consent, you can object to us holding and reading your application at all. Unless we have a compelling reason to carry on, an objection ends the processing. In practice, we delete the application and tell you so.

You never have to explain why, and none of this costs you anything. If you think we have handled your information badly, you are also entitled to complain to the data-protection authority for the country you live or work in; we would rather you wrote to us first, but you are not obliged to.

12. Changes to this policy

If what we collect or what we do with it changes, this page changes with it and the date at the top moves. We will not quietly begin collecting something this page does not mention.