Privacy policy
Effective 12 October 2026
Shelveo maps retail stores. A field operator photographs a store with a 360° camera and the Shelveo Capture app; Shelveo turns the photos into a floor plan of the store, which the retailer's own staff view and edit on the Shelveo platform. This policy explains what personal information that involves, why we need it, where it is kept and what you can ask of us.
1. Who we are
Shelveo is run by Shelveo Spatial Intelligence (Pty) Ltd, a South African company (registration number 2026/587671/07), based in Langebaan, Western Cape. We are the responsible party for the information described here under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is André Oberholzer, who can be reached at admin@shelveo.co.za.
Where we map stores for a retailer, we work on that retailer's instructions, and its staff's accounts and its stores' data are also governed by our agreement with that retailer.
2. Who this policy covers
- Field operators who use the Shelveo Capture app on an Android phone.
- Platform users: staff of Shelveo and of its customers who sign in at shelveo.co.za.
- People who happen to be in a store while it is photographed.
- Visitors to this website.
3. The Shelveo Capture app
The app is a work tool for operators whose account was created for them by Shelveo or by their employer. It has no advertising and no analytics or tracking software, and nobody can create an account from inside it.
What the app collects
| Information | Why |
|---|---|
| Your account: username, name and the customer you work for. Your password is checked by our sign-in service (Google's Firebase Authentication) and is not kept on the phone. | To sign you in and show you the stores you may capture. |
| Location of the phone: when you choose a store, when a capture starts, with each photo and with each entry in the activity log. | To suggest the store you are standing in, to record where a capture was made, and to keep an honest record of field work. |
| An activity log: sign-ins, captures started, opened, finished and deleted, each photo and each upload, with the time and the phone's location. | So that we and your employer can see what was captured, when, where and by whom, and can investigate problems. |
| Your phone: make, model, Android version, the app version, an identifier the app makes for itself when installed, and Android's identifier for this app on this phone. Never the serial number, IMEI or phone number. | To tell phones apart in the activity log and to solve problems with a particular phone. |
| The photos: 360° photos of the store from the camera, and what the app works out from them (how the photos connect, a rough map of the store). | They are the survey itself: the store's floor plan is built from them. |
Permissions the app asks for
- Location: used as described above, only while the app is open or a capture is under way. The app does not read your location once you have closed it.
- Nearby devices (Bluetooth and Wi-Fi): only to find and connect to the 360° camera. They are not used to work out where you are.
- Notifications: to show that the camera is connected while the screen is off.
The app does not ask for your contacts, messages, calls, microphone, the phone's own camera or your photo library.
When information leaves the phone
Nothing about a capture is sent until you press Upload. The upload carries the photos, the capture's details and the activity log entries we do not have yet. Signing in and loading your list of stores contact our servers as well. Everything is sent over an encrypted connection.
On the phone, what the app works out from the photos and the activity log are encrypted with a key that never leaves the phone. The photos themselves stay in the app's own storage, which other apps cannot read, until you delete the capture or remove the app.
4. People in store photos
A 360° photo of a store can include shoppers and staff. We photograph stores to record shelving and layout, not people, and we do not try to identify anyone. When a capture is processed, people are detected automatically, left out of the reconstruction and blurred in the images shown on the platform. The original photos are kept in a private archive that only Shelveo can reach, so that a store can be processed again. Automatic detection is not perfect; if you believe you can be recognised in an image on the platform, tell us and we will blur or remove it.
5. The Shelveo platform and this website
- Your account: email address, name, role and the customer you belong to, and whether you have set up the second sign-in step (an authenticator app). Passwords are kept by Google's Firebase Authentication in protected form, not in our own records.
- What you do with access and data: an audit trail of actions such as creating or removing users, stores and exports, with who did it and when.
- Mapping time: for people who map stores, how long they spent mapping each store.
- Corrections to Shelbi: when you accept or change a category that Shelbi, our assistant, suggested, we keep that decision to improve later suggestions for the same customer.
- Settings in your browser: display choices are kept in your browser's own storage. We use no advertising or tracking cookies.
- Protection against abuse: the site uses Google reCAPTCHA to check that requests come from the real Shelveo pages, and Google Maps where a store's location is chosen. Google receives your IP address and browser details when these load.
The public pages of this website collect nothing about you beyond what any web server receives (your IP address and browser type), which our hosting provider logs for security.
6. How we use information
We use personal information only to provide the service: to sign people in, to produce and show store plans, to keep the service secure, to account for field work and mapping work, and to meet our legal obligations. We rely on our contract with the customer or employer concerned, on our legitimate interest in running a secure and accountable service, and on the law where it requires us to keep records. We do not sell personal information and do not use it for advertising.
Shelbi. To suggest what each shelf holds, pictures of shelving cut from the store photos are sent to an artificial intelligence model run by Google (Vertex AI). It is asked about products and categories only, never about people.
7. Who receives it
- The retailer whose store it is, and where you are an operator, your employer: they see the store's plans and images, and may be given the record of who captured or mapped it.
- Google (Firebase and Google Cloud): sign-in, databases, processing and the artificial intelligence service.
- Cloudflare: storage and delivery of the store images.
- Authorities, where the law requires it.
These providers act on our instructions. Their systems are outside South Africa, mainly in the United States, so your information is transferred there. They are bound by contract to protect it to a standard comparable to POPIA.
8. How long we keep it
- Store photos, plans and mapping: for as long as we serve the retailer concerned. When a store is deleted, its plans and images are removed; its original photos are kept for a further 60 days in case it must be restored, then deleted.
- Accounts: until the account is removed by us or by the customer's administrator.
- The activity log and the audit trail: for as long as they are needed to account for the work and to keep the service secure, and as the law requires.
- On an operator's phone: until the capture is deleted in the app or the app is removed.
9. How we protect it
Access is by individual account, with a second sign-in step for people who can change a customer's data. Each customer's stores are kept apart from every other customer's. Store images can be opened only by someone signed in with access to that store. Connections are encrypted, and actions that change access or remove data are recorded. No system is perfectly secure; if a breach affects your information we will tell you and the Information Regulator as the law requires.
10. Your rights
How we apply POPIA, and the forms you can use, are on our POPIA page. Under POPIA you may ask us whether we hold information about you and for a copy of it, ask us to correct or delete it, object to our using it, and withdraw a consent you have given. Write to admin@shelveo.co.za; we will answer within 30 days. If your account was created by your employer, we may need to involve them.
Deleting your account and data. To have your Shelveo Capture or platform account deleted, with the personal information linked to it, email admin@shelveo.co.za from the address on the account, or ask your administrator. We keep only what the law or an open dispute requires us to keep, and tell you if that applies.
If you are not satisfied with our answer, you may complain to the Information Regulator of South Africa (inforegulator.org.za).
11. Children
Shelveo is a tool for people at work. It is not meant for anyone under 18, and we do not knowingly collect information from children.
12. Changes to this policy
When we change this policy we will post the new version here with its date, and tell account holders about changes that matter.