BeautyShelf Privacy Policy
Updated: 15 September 2026
This policy explains how BEAUTYSHELF LTD collects and uses personal information when you use the BeautyShelf mobile application, creator dashboard, website and related services. It also explains the choices available to you, including whether to allow optional product analytics.
This policy provides information; it is not a request for consent. Where we need your consent, we ask separately in the App. You can use the core App without agreeing to non-essential analytics.
Who we are and how to contact us
BEAUTYSHELF LTD is the controller of your personal information. We are registered in England and Wales under company number 15425266.
Registered office: 7 Throwley Way, Office 10, Sutton, United Kingdom, SM1 4AF
Privacy and rights enquiries: support@beautyshelf.app
Who this policy covers
This policy covers people who use or interact with BeautyShelf, including:
• shoppers who browse, discover or buy beauty products through retailer or affiliate links;
• people who share routines, product reviews, recommendations or other community content without participating in monetisation programmes; and
• approved creators who publish monetised content or use the creator dashboard, commission information and performance reporting.
Retailer websites, social-media services and other third-party services linked from BeautyShelf have their own privacy policies. They control the information they collect when you use their services.
Personal information we collect
Information you give us
• Account and contact information, such as your name, email address, mobile number, username, date of birth where requested, profile photograph and account-verification details.
• Account credentials and authentication information. Firebase Authentication manages passwords; BeautyShelf does not receive your plain-text password.
• Information received when you choose Apple ID or another supported sign-in service, such as your name, email address and the unique identifier provided by that service.
• Profile preferences and content you submit, including routines, reviews, ratings, recommendations, comments, images and videos, subject to the features available to your account type.
• Messages and information you provide when you contact support or communicate through the App.
• Your device contacts if you choose to grant the relevant device permission for a social-connectivity feature. You can remove that permission in your device settings.
Information collected when you use BeautyShelf
• Device and technical information, such as device type and model, operating system, browser or app environment, app version, platform, production or staging environment, network information, IP address and approximate location derived from an IP address.
• Account, device and session identifiers, including a BeautyShelf user ID, session ID, PostHog distinct ID, Firebase Analytics app-instance ID, Crashlytics installation ID and, where relevant, a OneSignal subscription ID.
• Essential service information, such as authentication status, locally stored shelf information, security logs and your privacy choices.
• Affiliate and transaction information, such as an outbound retailer click, affiliate click reference, product, retailer, order identifier, order value, currency and commission amount.
• Notification and campaign information, such as a campaign identifier, notification type, whether a push notification or email was opened, and activity following a campaign where this is lawfully enabled.
Optional product analytics and diagnostics
If you consent to optional analytics, we collect event-level information about how you use the App. The information may be linked to your account and is not anonymous at the collection stage. It includes:
• registration method, referral source, onboarding steps completed, app launches, sessions and screens opened;
• home modules viewed or selected, positions of items and the route used to reach a screen;
• the words entered in a search, search type, number of results, whether a result was selected, the selected result and its position;
• products, brands, routines and creator profiles viewed, saved, unsaved or shared, including list name and share channel;
• review rating and whether review text was provided;
• price-comparison and retailer-offer information, such as retailer count, displayed price, lowest price, price spread, stock status and position;
• outbound retailer clicks, including the product, retailer, price, position, source screen and affiliate click reference;
• technical failures, crashes, screen name, device information and screen-load time; and
• the identifiers and technical details listed above so that events can be joined into sessions and, after sign-in, associated with the correct account.
We do not send your photos, videos or the body of your review text to product-analytics tools. A review event records only the rating and whether text was included.
Information received from other organisations
• Authentication information from Apple or another sign-in provider you choose.
• Confirmed order, order-value and commission information from AWIN or another affiliate network. We may join this to the affiliate click that led to the transaction.
• Payment information from Stripe where creator or partnership payments apply. Stripe processes payment-card details under its own arrangements; BeautyShelf receives only the information needed to administer the payment.
• Delivery and engagement information from OneSignal where you have enabled notifications or marketing communications.
Sensitive personal information
We do not ask you to provide information about health, race or ethnicity, political opinions, religion or beliefs, trade-union membership, genetics, biometrics used for identification, sex life or sexual orientation. However, words entered in a search, support message or content you submit may reveal sensitive information. Please do not include sensitive information unless it is necessary for the feature you are using. If we identify sensitive information that we do not need, we restrict access and delete it unless we have a lawful reason and an applicable UK GDPR condition to keep it.
How we use personal information and our lawful bases
We use personal information only for the purposes below. A separate rule under the Privacy and Electronic Communications Regulations 2003 may also require consent before information is stored on, or accessed from, your device.
Provide the App and your account
Information used: Account, profile, authentication, content, preferences and service activity needed for requested features.
Lawful basis: Contract. Legitimate interests where necessary to administer and improve the service without overriding your rights.
Creator and payment services
Information used: Creator status, content, payment, commission and transaction information.
Lawful basis: Contract. Legal obligation for tax, accounting and regulatory records.
Optional product analytics and diagnostics
Information used: Behavioural events, device and session identifiers, search information, crashes and performance data.
Lawful basis: Consent. Optional technologies remain off unless you choose to allow them.
Affiliate referral and conversion measurement
Information used: Retailer clicks, affiliate click references, confirmed orders, order values and commissions.
Lawful basis: Consent where storage, access or personal-level attribution requires it. Contract or legitimate interests for commission administration after lawful collection.
Personalisation within BeautyShelf
Information used: Preferences, saved items, content interactions and, where permitted, engagement information.
Lawful basis: Contract for features you request. Consent for personalisation based on optional analytics.
Service messages and support
Information used: Contact information, account details and communications.
Lawful basis: Contract and legitimate interests in supporting users and administering the service.
Marketing and re-engagement
Information used: Contact details, communication preferences, campaign engagement and inactivity status where separately permitted.
Lawful basis: Consent where PECR requires it. Legitimate interests only where the law permits, including an applicable soft opt-in. You can object at any time.
Security and fraud prevention
Information used: Account, device, network, security and diagnostic information.
Lawful basis: Legitimate interests in protecting BeautyShelf and its users. Legal obligation where applicable.
Legal compliance and claims
Information used: Information relevant to a legal request, dispute, complaint, corporate transaction or claim.
Lawful basis: Legal obligation and legitimate interests in establishing, exercising or defending legal rights.
Aggregate reporting
Information used: Statistics derived from lawfully collected activity and transaction information.
Lawful basis: Legitimate interests in understanding the service and reporting non-identifying results to creators, brands and business partners.
Where we rely on legitimate interests, our interests include providing and improving BeautyShelf, administering commissions, keeping the service secure, answering users, measuring non-identifying performance and protecting legal rights. We consider the necessity of the use, your reasonable expectations and the effect on your rights. You may object where this basis applies.
Product analytics and profiling
PostHog is our primary product-analytics provider. Firebase Analytics supports analytics, while Firebase Crashlytics and Firebase Performance support crash and performance diagnostics. We configure Google advertising personalisation and analytics data-sharing for advertising to be off for this analytics release.
Analytics reports may be aggregated, but the underlying event stream can relate to an identifiable user. When you sign in or register after using the App anonymously, activity collected with your consent may be merged into your account profile. We reset the analytics identity when you log out.
We use event information to measure active use, onboarding and activation, retention, search success, product and routine engagement, retailer clicks, conversions, repeat purchases, crashes and performance. We may classify an account as active, at risk or dormant using the period since the account's last activity.
If you have separately agreed to receive marketing, an inactivity classification may be used to decide whether to send a win-back message. Optional analytics consent does not itself give us permission to send marketing. You can opt out of marketing at any time.
We do not use this analytics release for personalised advertising, Meta or TikTok ad attribution, install attribution or session replay. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Cookies and similar technologies
Mobile apps use software development kits, device storage, identifiers and similar technologies that can store information on, or access information from, your device. The categories below explain the main technologies used by BeautyShelf.
Essential technologies
Examples: Authentication and session tokens, locally stored shelf information, security functions and the record of your privacy choices.
How it is controlled: Always on where strictly necessary to provide a feature you request, transmit communications or comply with applicable security requirements.
Product analytics and diagnostics
Examples: PostHog distinct ID, Firebase Analytics app-instance ID, Crashlytics installation ID, product events, crashes and performance information.
How it is controlled: Optional. We ask for consent before enabling these technologies in the form described in this policy.
Affiliate measurement
Examples: Affiliate click references and related referral or conversion information.
How it is controlled: Enabled only where an applicable exception applies or the required consent has been obtained.
Communications
Examples: OneSignal subscription ID and campaign delivery or engagement information.
How it is controlled: Used when you enable notifications or communications and where the applicable marketing rules allow it.
Your analytics choices
• Optional analytics are off unless you choose to accept them.
• You can reject non-essential technologies without losing access to the core App.
• You can change your analytics choice at any time in Settings. Turning analytics off stops new optional collection in the current session.
• We record the choice, time and policy version so that we can respect it and demonstrate compliance.
• Withdrawing consent does not affect processing carried out lawfully before withdrawal. You may also ask us to delete personal information, subject to legal exceptions.
If we later introduce a new non-essential purpose, including session replay, install attribution or advertising-related tracking, we will update the information shown to you and obtain fresh consent where required.
Who we share personal information with
We share personal information only where needed for the purposes in this policy. Recipients include:
• Google Firebase, including Firebase Authentication, Firebase Analytics, Crashlytics and Performance;
• PostHog for product analytics in its European Union cloud region;
• OneSignal for push and email delivery and campaign measurement;
• AWIN and other affiliate networks for referral, conversion and commission administration;
• Stripe for payments where creator or partnership payments apply;
• Apple or another authentication provider if you choose its sign-in service;
• professional advisers, insurers, auditors, courts, regulators, law-enforcement bodies and public authorities where necessary or legally required; and
• a buyer, investor or successor if BeautyShelf is involved in a genuine corporate transaction, subject to appropriate confidentiality and data-protection arrangements.
Some providers process information on our instructions; others may act as a separate controller for parts of their service. For example, an affiliate network or retailer may determine how it uses information after you follow an external link. Their privacy policy applies to that independent use.
Creators, brands and commercial partners receive aggregate or de-identified reporting unless we tell you otherwise and have a lawful basis. We do not sell or rent personal information.
International transfers
BeautyShelf is based in the United Kingdom. The PostHog project used for product analytics is hosted in the European Union. The United Kingdom has adequacy regulations covering the European Economic Area, so personal information may be transferred there on that basis.
Other providers and their sub-processors may process information outside the United Kingdom. Where a destination is not covered by UK adequacy regulations, we use an approved safeguard where required, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, and carry out the required data-protection assessment. Contact us if you would like information about the safeguard relevant to your information.
How long we keep personal information
We keep personal information only for as long as reasonably needed for the purpose for which it was collected, including to meet legal, accounting, security and dispute-resolution requirements. We use the following criteria:
Account, profile and user content
Retention criterion: For the life of the account and then for the period needed to complete deletion, resolve disputes, enforce agreements and meet legal requirements. Public content may be retained or de-identified where another user's record depends on it.
Optional event-level analytics
Retention criterion: For no longer than needed to measure use and trends, diagnose issues and create reports. We review service-level retention settings and aggregate or delete event-level data when it is no longer needed.
Consent records
Retention criterion: For as long as the choice is current and afterwards for the period needed to demonstrate that we respected it.
Affiliate, transaction, commission and payment records
Retention criterion: For the period needed to administer payments and commissions and meet tax, accounting, fraud-prevention and legal-claims requirements.
Support and security records
Retention criterion: For the period needed to resolve the matter, protect the service and establish or defend legal rights.
Marketing preferences
Retention criterion: Until you opt out. We may keep a minimal suppression record so that we continue to respect an opt-out.
Backups
Retention criterion: Deleted on the applicable secure backup cycle unless retention is required by law or for an active security or legal matter.
Security
We use technical and organisational measures designed to protect personal information. These include access controls, role-based permissions, encryption in transit, secure authentication, separation of staging and production analytics projects, data minimisation, monitoring and periodic security review. No system is completely secure, so please contact support@beautyshelf.app if you believe your account or personal information may be at risk.
Children and younger users
BeautyShelf is not intended for children under 16, and an account may not be created by a person under 16. BeautyShelf's terms require users aged 16 or 17 to have permission from a parent or legal guardian.
Because some users may be under 18, non-essential analytics and profiling are off by default, and this analytics release is not used for personalised advertising. We aim to collect the minimum information needed, explain privacy choices clearly and avoid encouraging younger users to weaken a privacy setting. If we learn that a person under 16 has created an account or that we have collected their information contrary to our rules, we will investigate and delete the information where appropriate.
Your rights
Depending on the circumstances and the lawful basis, you may have the right to:
• ask for access to your personal information and receive a copy;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how information is used;
• receive information you provided in a structured, commonly used and machine-readable format and ask us to transmit it to another controller where the right to portability applies;
• object to processing based on legitimate interests; and
• withdraw consent at any time through Settings or by contacting us.
You have an absolute right to object to direct marketing. If you object, we will stop using your personal information for that purpose.
We normally respond within one month. We may ask for information to confirm your identity. Rights can be subject to legal conditions and exemptions, and we will explain any decision not to comply in full.
You may complain to the Information Commissioner's Office. Visit ico.org.uk/make-a-complaint or call 0303 123 1113. We would appreciate the opportunity to address your concern first.
Personal data breaches
We investigate suspected personal data breaches and keep the records required by law. Where a breach is likely to create a risk to people's rights and freedoms, we notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours after becoming aware of it. Where a breach is likely to create a high risk, we also inform affected people without undue delay unless a legal exception applies.
Changes to this policy
We may update this policy when our services, suppliers or legal obligations change. We will bring material changes to your attention in the App or by another appropriate method. Where a new use requires consent, we will ask for fresh consent before that use begins. Continued use of the App does not replace consent where the law requires a specific choice.
Contact us
BEAUTYSHELF LTD
7 Throwley Way, Office 10, Sutton, United Kingdom, SM1 4AF