Privacy policy
What is collected about you, why, who it goes to, how long it is kept, and what you can ask for. ModelShelf is one person and a small library, so there is less of this than most sites have, and all of it is here.
What is collected about you, why, who it goes to, how long it is kept, and what you can ask for. ModelShelf is one person and a small library, so there is less of this than most sites have, and all of it is here.
01 · Controller
For anything in this policy, write to legal@modelshelf.com. It goes straight to the person who answers it.
02 · What is collected
What you give: your name and email address, your password (stored hashed by the login provider, never in readable form), your plan and account status, and anything you write in a message, support request or content request. For billing: billing name, country, and a VAT number where one applies.
Card details are entered directly with Stripe. They are never received or stored by ModelShelf.
What is collected automatically: pages viewed, searches, downloads, where you arrived from, session times, and technical data such as IP address, browser, device type, operating system and language. Cookies are covered in clause 07.
03 · Purpose and basis
Your account, your plan and your downloads are processed to give you the service you have paid for, which is the performance of a contract. Billing records are kept because accounting law requires it, which is a legal obligation. Support messages and security logs are processed because running the site safely and answering you is a legitimate interest. Analytics is processed only on your consent, which you can withdraw at any time. Your personal data is not sold, and it is not rented. There is no advertising business here to sell it to.
04 · Sharing
ModelShelf runs on a handful of services, each under a data processing agreement:
Webflow hosts the site and serves the pages.
Memberstack handles accounts, sign-in and plan access.
Stripe handles payments and card data, as an independent controller for payment and fraud purposes.
Google Analytics measures how the pages are used, and only where you have agreed to it.
Data may also be disclosed where the law requires it, to enforce the terms of use, or in connection with a transfer of the business.
05 · Transfers
Some of those providers process data outside the EEA, mainly in the United States. Those transfers rely on the European Commission’s standard contractual clauses, on the EU to US Data Privacy Framework where the provider is certified under it, and on the additional safeguards in each provider’s own agreement. Ask at legal@modelshelf.com if you want the detail for a particular provider.
06 · Retention
Account data: while your account is open, and for twelve months after you close it.
Billing and accounting records: five years. Accounting law in Norway, where ModelShelf is registered, requires it.
Support and other correspondence: up to twenty-four months.
Analytics data: fourteen months, as the analytics tool is configured.
Security and abuse logs: up to twelve months.
After that it is deleted or anonymised. Nothing is kept because it might be useful one day.
07 · Cookies
Necessary cookies keep you signed in and keep the site working and secure. They are set without asking, because without them there is no service.
Analytics cookies show which pages and searches are used, which is how the library gets better. They are set only if you agree.
Marketing cookies are not used. There is no advertising pixel on this site.
You can accept, refuse or change your mind at any time through the cookie settings link in the footer, and through your browser settings.
08 · Your rights
Under the GDPR you have the right to get a copy of the data held about you, to have it corrected, to have it deleted, to restrict how it is used, to receive it in a machine-readable form, to object to use based on legitimate interest, to withdraw consent at any time without affecting what was already done, and to opt out of any marketing email.
To do any of it, write to legal@modelshelf.com. You get an answer within one month, and you may be asked to confirm who you are first.
If you think your data is being handled unlawfully you can complain to the data protection authority where you live, or to the Norwegian Data Protection Authority, which is the supervisory authority for ModelShelf.
09 · Security
Access controls, encryption in transit on every page, and established providers running their own security programmes. No online service can promise to be impenetrable, but the measures here are reasonable for what is stored, which is an email address and a subscription status. If there is ever a breach that puts you at risk, you and the supervisory authority are told, as the law requires.
10 · Children
ModelShelf is not aimed at children under 16 and does not knowingly collect their data. If you think it has, write to legal@modelshelf.com and it will be deleted.
11 · Changes
This policy is updated when what it describes changes. The dates at the top of the page move with it, and anything material is notified by email or on the site.
Contact
The rules for using the library are in the terms of use. What ModelShelf is and how the files are made is on the about page.