Privacy Policy
GearKit AI, LLC ("GearKit," "we," "us," or "our") builds AI operating layers for real-world businesses. This Privacy Policy describes how we handle personal information collected through our websites — shelfkit.ai, gearkit.ai, and the pages they serve (including the ShelfKit, LineKit, and free-tools pages) — and through the hosted ShelfKit service (together, the "Service"). This policy also serves as our cookie and analytics notice: everything our pages set or measure is described here, in the Cookies & analytics section.
Personal information we collect
Information you give us
- Lead and signup details. When you request access, book an Ops Audit, or use an email box on one of our free tools, we collect what the form asks for: your name, work email, company, and any note you add about your operation.
- Account data. If you use the hosted console, our sign-in provider (Clerk) processes your name, email address, and authentication credentials to operate your account.
- Correspondence. Emails you send us, and notes from calls you book with us.
Customer business data (hosted Team and Ops tiers only)
When you subscribe to a hosted tier, we process the business data you bring so the service can do its job: your operational files and records, and — if you connect a mailbox — the vendor and customer email the service reads and drafts for you. Mailbox connections use narrow OAuth scopes you grant explicitly: read-only Gmail access (Google's gmail.readonly scope, plus gmail.compose where draft creation is enabled) and delegated Microsoft send access (Microsoft Graph Mail.Send). You can revoke these grants at any time from your Google or Microsoft account settings. This data is processed to provide the service to you — never for advertising, and never sold.
Data you paste into free tools (guest sessions)
Some free tools — like the component runway — let you paste business data (sales exports, inventory counts, lead times) without creating an account. So your work survives a page refresh, we store what you paste on our servers, tied to a cookie in your browser (see Cookies & analytics). We also record which steps of the tool you used and whether they succeeded, so we can fix what breaks. This data is used only to run the tool for you — never for advertising, never sold. Guest data is not linked to any account; it simply expires (see Retention below). If we add a way to carry a guest session into a new account, this policy will describe it before that ships.
Information collected automatically
Our pages use PostHog product analytics (see Cookies & analytics below) to log device and usage data: browser and device type, IP-derived general location, pages viewed, and interaction events such as a form submission or a tool run.
Cookies & analytics
This section is our full cookie disclosure — there is no separate cookie notice.
- PostHog analytics. Our marketing pages (shelfkit.ai, gearkit.ai, the LineKit and engine pages), our free tools, and the operator console use PostHog to measure how the Service is used. PostHog sets first-party cookies and browser storage to recognize a returning browser. We create identified analytics profiles only for signed-in users of the hosted product.
- No session replay. Session recording is disabled in our analytics configuration — we do not capture replays of your screen, keystrokes, or mouse movement anywhere on the Service. In the operator console we go further: automatic event capture is off, only explicitly named events are sent, and URLs are scrubbed of query parameters before anything leaves your browser.
- No advertising trackers. We use no advertising pixels or third-party ad cookies, and we do not use analytics data for targeted advertising.
- Functional cookies. The hosted console uses cookies from Clerk to keep you signed in.
- Guest session cookie. Free tools that save your in-progress work set a first-party cookie (sk_guest) so your browser can find its own saved data. It identifies your browser, not you, and expires with the guest data itself.
- Do Not Track and Global Privacy Control. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing for these signals to opt out of. We do not otherwise respond to Do Not Track signals.
- Your controls. You can block or delete cookies in your browser settings; the marketing pages and free tools keep working without them.
How we use personal information
- To respond to you. Lead form submissions exist so we can reply about ShelfKit or LineKit — that is their only use.
- To provide the hosted service, including reading and drafting the email and operational work you have asked it to handle, keeping your account secure, and supporting you.
- To improve the Service, using analytics about how pages and features are used.
- Compliance and protection: to comply with law, enforce our Terms of Use, and prevent fraud, abuse, and security incidents.
AI processing, and the Solo / hosted line
- Free Solo skills. Solo skills run in your own Claude environment against files you own. Nothing passes through GearKit: we do not receive, store, or see your data, and your existing terms with Anthropic apply unchanged.
- Hosted Team and Ops tiers. The hosted service sends the content it processes for you (for example, a vendor email it is drafting a reply to) to Anthropic's API to generate that work product. This runs under Anthropic's commercial terms, which prohibit using our API data to train their models. We do not use your business data to train AI models either.
How we share personal information
We share personal information only with the service providers that run the Service (sub-processors), professional advisors, authorities when legally required, and a successor in a business transaction such as a merger or acquisition. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Our sub-processors:
| Provider | What it does | What it touches |
|---|---|---|
| Railway | Hosting and database infrastructure | All hosted-service data |
| Anthropic | AI processing (Claude API, commercial terms — no training on our data) | Content the hosted service processes for you |
| Clerk | Sign-in and account management | Account and authentication data |
| Resend | Transactional email delivery | Lead form contents; service emails |
| PostHog | Product analytics | Usage and device data described above |
Retention
- Lead form submissions are delivered to us by email (via Resend, to our team's inbox) and kept as ordinary business correspondence while we might still work together. Email us at any time to have your details deleted — see Your rights below.
- Hosted-tier data is retained while your subscription is active. When you cancel, you keep your files: your data remains yours, exportable, and we delete our hosted copies on request.
- Free-tool guest data is deleted automatically 90 days after your last activity with the tool.
- Analytics data is retained per PostHog's standard retention settings, and we keep it only as long as it is useful for understanding the Service.
Your rights (including U.S. state privacy rights)
Depending on your state of residence, you may have rights to know, access, correct, delete, and obtain a copy of your personal information, to appeal a decision we make on a request, and to opt out of sale, sharing for targeted advertising, and certain profiling. Our practices for those opt-outs are simple: we do not sell personal information, we do not share it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects — so there is nothing to opt out of.
To exercise any right, email boris@gearkit.ai. We verify requests by corresponding with the email address our records associate with you, and we may ask for more information when needed to confirm identity. Authorized agents may submit requests with proof of authorization. We will not discriminate against you for exercising any of these rights.
The categories of personal information we have collected in the last 12 months are those described in "Personal information we collect" above: identifiers and contact data, professional information (company), internet activity (analytics), and — for hosted customers — the business content you bring to the service. We collect them from you directly and from your use of the Service, for the purposes described above, and disclose them only to the sub-processors listed above.
Security
We use technical and organizational safeguards designed to protect personal information, including scoped OAuth grants, encrypted transport, and access controls. No internet service can guarantee perfect security.
Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.
Changes to this policy
If we materially change this policy, we will update the date above and post the new version here. Your use of the Service after a modified policy takes effect means the modified policy applies.
Contact us
GearKit AI, LLC (a California limited liability company)
Email: boris@gearkit.ai