Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains what personal data Trades Shelf (the “Store”) collects, how we use and share it, and what rights you have. The Store is a Digital Shelf Lab store operated by Codigo Bro LLC, 1057 NW 136th Ave, Miami, FL 33182, United States (“we”, “us”). Codigo Bro LLC is the controller of your personal data.

1. What data we collect

Contact details you enter at checkout: your name and email address (and your phone number, only if the checkout asks for it).
Order details: the products you buy, prices, currency, any discounts or promotions, the time of purchase and the history of access to and downloads of your files.
Payment details: your payment is processed by Stripe. When you pay with a payment card (credit or debit card), Stripe stores that card and we receive only the card brand, the last four digits, the country and billing postcode, and the result of Stripe's fraud checks — never the full card number.
Security checks: Cloudflare Turnstile, a check against bots and fraud, runs on the checkout page and on the purchase buttons of the offers that follow it.
Device and visit details: your IP address, your browser's user agent (a technical description of your browser and device), the type of device, your approximate location (country, region and city) derived from your IP address or your billing details, the pages of the Store you visit, and the ad or campaign that directed you to the Store (campaign parameters such as UTM tags, and click identifiers such as fbclid, a code Facebook adds to the links in its ads).
Cookie identifiers: see section 4.
Your acceptance of our terms: the version of the terms and policies you accepted at checkout, with the time, IP address and device.
When you use our apps: the email address you sign in with, a one-time sign-in code, and a record of the devices signed in to your account (an app can be used on up to 3 devices), so that only you can open what you bought. The content you create in an app (for example, your boards, circuits, customer names and addresses, and your business details and logo) is stored on your own device, not on our servers. It leaves your device only when you choose to: for example, when you download, print or share a PDF, or export a backup file and send it yourself.
The messages you send us for customer service.

2. What we use your data for

To process your order, deliver your products and send confirmation and access emails for your order.
To process payments, including the optional offers you add to your order with one click after checkout. If you paid with a payment card or a digital wallet, Stripe securely stores those payment details. We use them only for one-click purchases, within 24 hours of your order and in the same browser. Stripe stores them until you ask us to remove them.
To provide customer service and handle refunds.
To prevent fraud and to respond to payment disputes.
To measure and improve our advertising, including by sharing information with Meta as described below, and to show our ads to the right people (see Meta Custom Audiences in section 3).
To comply with legal, tax and accounting obligations.

We send emails about your order (access to your files and receipts). We save your email address as soon as you enter it at checkout, even if you don't finish your order. In that case, or if your bank doesn't complete the payment verification, we may send you a single reminder with a link to resume your order where you left off. The reminder has no discounts or offers, and we won't write to you again about that order. If you are in the UK or the EU, our legal basis is our legitimate interest in helping you finish a purchase you started (Art. 6(1)(f) UK GDPR and GDPR). You can opt out at any time using the link at the bottom of the email or by writing to support@digitalshelflab.com: the Store will not send you any further reminders. We do not send newsletters or marketing emails, and we do not track whether you open our emails or click their links: for the reminder, we only learn whether it was delivered and whether the order it refers to is later completed.

3. Who we share it with

We do not sell your personal data. We share it only with:

Stripe — payments, saved payment methods and fraud prevention.
Meta Platforms (Facebook and Instagram) — to measure our ads, attribute orders to them and improve their delivery, through the Meta Pixel and the Meta Conversions API (see section 4). We also upload our customers' email addresses to Meta, pseudonymised (normalised and hashed with SHA-256) before they are sent, to create Meta Custom Audiences. We use these audiences so that our ads are not shown to people who have already bought, and to help Meta find people similar to our customers. Meta matches the pseudonymised email addresses against the accounts it holds. Meta uses this information under its own privacy policy.
Service providers that process data on our behalf: Cloudflare (hosting, security, anti-bot checks, delivery of your files and apps, email delivery and visit statistics), Supabase (database hosting, in the United States), and Resend and Brevo (email delivery, as backup providers).
Professional advisers; authorities, where the law requires it; and, in the event of a merger, acquisition or sale of our business, the buyer.

Under some US state laws, sharing data with Meta for advertising purposes may count as a “sale” or “sharing” of personal data for targeted advertising. Section 6 explains how to object to this (opt out).

4. Cookies, the Meta Pixel and the Conversions API

Meta Pixel (in your browser). When you view our pages or the checkout, the Meta Pixel reports events to Meta, such as viewing a page, viewing a product, proceeding to checkout, adding an offer to your order, entering your payment details and making a purchase.

Meta Conversions API (from our servers). We also send these events, including your purchases, from our servers. They may include your email address, name, phone number (only if the checkout asks for it), city, county or region, postcode and country. We pseudonymise these details with a hash function (SHA-256) before sending them. We send your IP address, your browser's user agent and the values of the Meta cookies _fbp and _fbc unhashed. The Pixel and the Conversions API use the same event ID, so that Meta does not count the same event twice.

Cookies we use:

Needed for the checkout and your order (strictly necessary): cookies that maintain your checkout session and support the steps after payment, including the one-click offers. They are kept for up to 24 hours.
visitor_id — our cookie that recognises your browser, to count visitors and to recognise the device used for an order (fraud prevention). Kept for: 1 year.
dsl_attr — our cookie that stores the campaign parameters (UTM tags) and click identifier of your first and latest visit, and the version of the page you were shown, so that we know which ad directed you to the Store. Kept for: 30 days.
_fbp and _fbc — Meta's cookies. If you arrive from a Meta ad with a click identifier (fbclid) and there is no _fbc cookie yet, our server creates it, so that the ad can be linked to your order.

If you open the Store in the in-app browser of Instagram or Facebook, we may retrieve the campaign parameters (never the click identifiers) from the page that referred you and keep them for 7 days.

Visit statistics. For each page load we record the store, the offer, the market, your country, the type of device, the ad and campaign that directed you to the Store (ad ID, utm_content and whether a click identifier was present) and your visitor_id. These records do not contain your IP address, email address or browser user agent.

5. How long we keep it

Orders, payments, terms acceptance records and download records (including IP address and device details): at least 24 months after your purchase, to deliver your products, provide customer service, prevent fraud and respond to payment disputes, and longer where our tax and record-keeping obligations require it.
Email address, name and phone number from an unfinished order (including the reminder, if sent): 30 days, then we delete them. If you opt out, we keep only an irreversible hash of your email address, solely so that we do not send you any further reminders. If the order is completed, the order retention periods apply.
Records of the events sent to Meta (without IP address, email address or user agent): up to 24 months.
Customer lists for Meta Custom Audiences (your pseudonymised email address): kept in the custom audience, at Meta and on our servers, until you object or the audience is deleted.
Visit records (without IP address, email address or user agent): 3 months; daily visit totals: 24 months.
Saved payment method: kept by Stripe until you ask us to remove it; we use it only for one-click purchases within 24 hours of your order.
Campaign parameters retrieved in the in-app browser: 7 days.
Cookies: visitor_id 1 year; dsl_attr 30 days; checkout cookies up to 24 hours; Meta's cookies as Meta sets them.
Backups: daily backups are kept for 35 days.
Customer service messages: as long as needed to deal with your request and keep a record of it.

6. Your choices and your rights

Objecting to advertising. To object, write to support@digitalshelflab.com from the address you used at checkout. Once we have processed your request: (1) we remove you from our Meta Custom Audience at the next daily update (usually within 24 hours) and do not add you again; and (2) the events about your purchases that we send to Meta, through the Conversions API and through the Meta Pixel on the pages after checkout, no longer include your email address, phone number, name, city, county or region, or postcode, and are flagged for Meta's Limited Data Use. Those events still report the purchase and its amount, and still include technical details such as your IP address, your browser and cookie identifiers, as for any visitor. Visits to our pages before checkout may still be measured with cookies, and any event already queued when your request was received may still be sent in its original form within a few minutes. We cannot delete what Meta has already received. You can also block or delete cookies in your browser settings, and control how Meta uses your data in your Facebook or Instagram ad preferences. Our website does not currently show a cookie banner and does not act on automatic signals such as Global Privacy Control or Do Not Track; you can disable cookies and manage ad tracking yourself in your browser settings or your Meta account.
Your rights. Depending on where you live, you have the right to know what personal data we hold about you, to get a copy of it, to have it corrected or deleted, and to make a complaint if you are not happy with our response (see below for the Information Commissioner's Office). You may authorise a representative to make a request on your behalf. To make a request, write to support@digitalshelflab.com from the address you used at checkout. We will reply as soon as possible and in any case within one month of receiving your request. Exercising your data protection rights will not affect the service we provide to you or your terms. If you ask us to delete your data, we delete or anonymise the data we are not legally required to keep; we keep the records of your purchases and of their delivery as proof of the transaction (for payment disputes and tax).
UK and EU. If you are in the UK, your data is protected by the UK GDPR and the Data Protection Act 2018 (in the EU, by the GDPR). You also have the right to restrict or object to the processing, the right to data portability, and the right to complain to your supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk). We process your data on these legal bases: performance of the purchase contract (Art. 6(1)(b) UK GDPR), compliance with legal and tax obligations (Art. 6(1)(c) UK GDPR) and our legitimate interests (Art. 6(1)(f) UK GDPR). We also rely on our legitimate interest in not showing ads to people who have already bought, and in finding people similar to our customers, when we use our customers' pseudonymised email addresses for Meta Custom Audiences (section 3). You can object to this at any time: write to support@digitalshelflab.com and we will remove you from those audiences and limit the data we send to Meta about your purchases (see “Objecting to advertising” above). The same applies to the reminder about an unfinished order (section 2): if you object, the Store will not send you any further reminders.

7. International transfers

We and our service providers store and process information in the United States and in other countries. Where required, these transfers rely on the safeguards offered by our service providers, such as the UK Extension to the EU-U.S. Data Privacy Framework or standard contractual clauses with the UK Addendum.

8. Security

We take appropriate technical and organisational measures to protect your data, such as encrypted connections, access controls and private storage of your files. No method of transmission or storage is completely secure.

9. Children

The Store is for adults. You must be at least 18 years old, or the age of majority under the law of the country where you live if that is higher, to buy from us. Because the Store is intended only for people aged 18 and over, we do not knowingly collect personal data from children, and we do not send data about them to advertising partners.

10. Changes to this policy

We may update this policy. We will publish the new version on this page, showing the date of the latest revision.

11. Contact

For privacy questions or requests:

Email: support@digitalshelflab.com
Phone: +1 (786) 403-0332
Address: 1057 NW 136th Ave, Miami, FL 33182, United States