Additional Privacy Notice for EU Users

Last updated: 13th of October 2026

1. Introduction

Koodos, Inc. and its affiliates (“we,” “our,” “us”) are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR). This Privacy Notice explains how we collect, use, and share personal data about EU users, particularly in relation to data accessed through the Amazon Portability API.

2. Data We Collect

When you use our services, we may collect the following types of personal data through the Amazon Portability API:

• Name

• Email address

• Consumption history

• Other relevant data as permitted by the API

  
  

3. Purpose of Data Processing

We process your data for the following purposes:

• Personalization: To personalize your experience and provide customized content and recommendations.

• Customer Support: To provide customer support and respond to your inquiries.

• Service Improvement: To analyze and improve our services, including developing new features.

• Marketing and Communication: To send you marketing communications and updates about our services, if you have provided consent.

4. Legal Basis for Processing

Our processing of your personal data is based on the following legal grounds:

• Consent: We rely on your consent to process personal data collected through the Amazon Portability API. You can withdraw your consent at any time by contacting us.

• Performance of a Contract: We process your data to fulfill our contractual obligations to you, such as providing our services.

• Legitimate Interests: We may process your data for legitimate interests, provided these interests are not overridden by your privacy rights.

  
  

5. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right to Access: You can request access to the personal data we hold about you.

• Right to Rectification: You can request correction of inaccurate or incomplete data.

• Right to Erasure: You can request deletion of your data in certain circumstances.

• Right to Restrict Processing: You can request that we limit the processing of your data in certain circumstances.

• Right to Data Portability: You can request a copy of your data in a structured, commonly used, and machine-readable format.

• Right to Object: You can object to the processing of your data for direct marketing purposes or on grounds relating to your particular situation.

• Right to Withdraw Consent: You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. Data Sharing and Disclosure

We may share your personal data with:

• Service Providers: Third-party service providers who perform services on our behalf, such as hosting, data analysis, AI providers, and customer service.

• Business Partners: Partners who offer services jointly with us or with whom we collaborate.

• Legal and Regulatory Authorities: Authorities when we are required to comply with legal obligations or to protect our rights and interests.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit using TLS, encryption of personal data at rest in our databases, access controls that restrict personal data to authorized personnel who need it to operate the service, regular security assessments, and deletion of personal data on request.

8. Google User Data

If you choose to connect your Google Account to Shelf, we access only the data needed for the features you enable, and only after you grant consent on Google’s authorization screen:

• Sign in with Google: your basic profile information and email address, used to create and authenticate your Shelf account.

• Google Calendar (read-only): if you connect Google Calendar, we read your calendar events (titles and times) to show them to you and to power features you choose to use in the app, including AI-powered insights. We do not edit, create, or delete calendar events.

Google user data is protected by the safeguards described in Section 7. We do not sell Google user data or use it for advertising, and we share it only with service providers who process it on our behalf to provide these features. We do not use Google user data to develop, improve, or train generalized AI or machine learning models. Google user data is retained only while your Google connection is active and is deleted when you disconnect your Google Account or delete your Shelf account. You can revoke Shelf’s access at any time in your Google Account settings: https://myaccount.google.com/connections.

Shelf’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

9. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including to comply with legal obligations, resolve disputes, and enforce agreements.

10. Cross-Border Data Transfers

As we are based in the United States, your personal data may be transferred outside the EU. We ensure appropriate safeguards are in place, such as standard contractual clauses, to protect your data.

11. Contact Information

If you have any questions or concerns about this Privacy Notice or our data processing practices, please contact

EU Representative Contact Details:
Name: Mathilde Ollgard
Email: a@koodos.com
Phone: +447918794336

For further inquiries, you can also contact us at:

Koodos, Inc. 515 Greenwich Street, New York, NY 10013 Email: team@shelf.im

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. If we make significant changes, we will notify you through our services or by other means. The latest version will always be available on our website.