Privacy Policy — ShelfScanner

Privacy Policy

Effective date: 30 May 2026  ·  Last updated: 30 May 2026

Short version: We collect only your name, email, and rough library size when you join the waitlist. We use it to send you ShelfScanner updates. We don't sell your data. Ever.

1. Who we are

ShelfScanner is a product of MuseLab, operating as MetaThriving2dMax, based in Ticao Island, Bicol, Philippines. In this policy "we," "us," and "our" refer to MuseLab / MetaThriving2dMax.

For privacy-related questions, contact us at marismacabuhay@metathriving2dmax.site.

2. What personal data we collect

We collect personal data only when you voluntarily provide it:

  • Your name — so we can address you personally in emails.
  • Your email address — to send you waitlist updates, product announcements, and (if you opt in) our email newsletter.
  • Your library size — the radio-button selection you make ("Under 100 books," "100–500 books," or "500+ books") helps us prioritise beta features for your collection size.

We also collect standard technical data automatically:

  • Browser type and version (User-Agent string)
  • Referring website (document.referrer)
  • UTM campaign parameters in the URL (e.g., utm_source, utm_medium, utm_campaign)
  • Timestamp of your submission

We do not collect payment card data, government ID numbers, or any sensitive personal information as defined under the Philippines Data Privacy Act (R.A. 10173).

3. How we use your data

  • To add you to the ShelfScanner waitlist and send your confirmation email.
  • To deliver our drip email sequence about ShelfScanner features, early-access updates, and launch announcements.
  • To send you the "Build a Better Bookshelf" guide promised at signup.
  • To understand where our signups come from (UTM analytics) so we can invest in the right marketing channels.
  • To improve the product by understanding what size collections our beta users have.

We will not use your email for unrelated commercial promotions from third parties.

4. Legal basis for processing

Under the Philippines Data Privacy Act (R.A. 10173), our legal basis for processing your personal data is your consent, given when you submit the waitlist form. You may withdraw consent at any time by unsubscribing (every email contains an unsubscribe link) or by emailing us at marismacabuhay@metathriving2dmax.site.

5. Third-party processors

We share your data only with service providers who help us operate ShelfScanner, under data processing agreements that restrict their use of your data:

  • GoHighLevel / LeadConnector — our CRM and email platform. Your name, email, library size, and UTM data are stored here to power our waitlist and email sequences. GoHighLevel is based in the United States. View their privacy policy.
  • Cloudflare — our website infrastructure provider. Cloudflare processes HTTP requests (including your IP address) as a standard function of serving web pages. View their privacy policy.
  • Clicksites.ai — our website hosting platform. View their privacy policy.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

6. Affiliate links

ShelfScanner displays affiliate links to purchase books through:

  • Amazon Associates (tag: shelfscanne09-20) — when you click an Amazon link and make a purchase within 24 hours, we may earn a small commission at no extra cost to you.
  • Bookshop.org (ref: shelfscanner) — when you click a Bookshop.org link and make a purchase within 30 days, we may earn a commission.

These affiliate platforms set their own cookies on your device when you click their links. We have no control over and take no responsibility for those cookies or the data collected by these third parties. Please review Amazon's and Bookshop.org's respective privacy policies for details.

7. Cookies and local storage

The ShelfScanner web app uses your browser's localStorage to save your scanned book library on your device. This data never leaves your browser unless you explicitly submit the waitlist form. We do not use tracking cookies on the ShelfScanner landing page itself.

Third-party services embedded in the page (e.g., Google Fonts) may set their own cookies. We use Google Fonts solely to render the page typography; no personal data is passed to Google Fonts beyond the standard HTTP request your browser makes.

8. Data retention

We retain your personal data in our CRM (GoHighLevel) for as long as you are on the ShelfScanner waitlist or active as a user, plus a reasonable period thereafter for record-keeping purposes (typically 2 years after last engagement). You may request deletion at any time (see Section 9).

9. Your rights under the Philippines Data Privacy Act

As a data subject under R.A. 10173, you have the right to:

  • Be informed — know what personal data we hold about you and how it is used.
  • Access — request a copy of your personal data.
  • Correct — have inaccurate or incomplete data corrected.
  • Erase or block — request deletion or blocking of your data if it is no longer necessary for the purpose it was collected, or if you withdraw consent.
  • Object — object to the processing of your personal data.
  • Data portability — receive your data in a structured, commonly used format.
  • Damages — be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of personal data.
  • File a complaint — lodge a complaint with the Philippines National Privacy Commission (NPC) at privacy.gov.ph.

To exercise any of these rights, email us at marismacabuhay@metathriving2dmax.site with the subject line "Privacy Request." We will respond within 15 business days.

10. International data transfers

Our primary CRM (GoHighLevel) stores data on servers in the United States. By submitting your information, you acknowledge that your data may be transferred to and processed in the United States or other countries whose data protection laws may differ from those in the Philippines. We take reasonable steps to ensure your data is treated securely in accordance with this policy.

11. Children's privacy

ShelfScanner is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with their data, please contact us at marismacabuhay@metathriving2dmax.site and we will promptly delete it.

12. Security

We use industry-standard measures to protect your personal data, including HTTPS encryption for all data in transit and secure, access-controlled storage within GoHighLevel. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security — but we take reasonable precautions to protect your information.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of ShelfScanner after changes are posted constitutes your acceptance of the updated policy.

14. Additional rights — EU, EEA & UK users (GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data. In addition to the rights in §9 above, you have the right to:

  • Withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Restriction of processing — request that we limit how we use your data in certain circumstances (e.g., while a dispute is being resolved).
  • Lodge a complaint with your local data protection authority. For a list of EU supervisory authorities, visit edpb.europa.eu. UK users may contact the Information Commissioner's Office at ico.org.uk.

Legal basis under GDPR: We process your personal data on the basis of consent (Article 6(1)(a) GDPR). Where we have a legitimate interest (e.g., fraud prevention, security), we rely on Article 6(1)(f). You may withdraw consent or object to legitimate interest processing at any time by contacting us.

Data transfers: Your data is transferred to GoHighLevel (USA) under standard contractual clauses (SCCs) approved by the European Commission and, where applicable, under the UK International Data Transfer Agreement (IDTA).

Data Protection Officer: We do not currently meet the threshold requiring a formal DPO appointment. For all GDPR-related requests, contact marismacabuhay@metathriving2dmax.site with subject line "GDPR Request."

15. Additional rights — California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following additional rights:

  • Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, our business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
  • Right to Delete — request deletion of personal information we have collected, subject to certain exceptions.
  • Right to Correct — request correction of inaccurate personal information.
  • Right to Opt Out of Sale or Sharing — we do not sell or share your personal information for cross-context behavioural advertising. No opt-out is required, but you may contact us to confirm this at any time.
  • Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information as defined under the CPRA.
  • Right to Non-Discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of personal information collected: Identifiers (name, email address); Internet or other electronic network activity information (browser type, referrer, UTM parameters); and customer records (library size selection).

Purpose of collection: Waitlist management and email communications (as described in §3 above).

To submit a verifiable consumer request: email marismacabuhay@metathriving2dmax.site with subject line "CCPA Request." We will respond within 45 calendar days. Requests may be submitted by an authorised agent with proof of authorisation.

16. Contact us

For any privacy questions, requests, or complaints: