Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how Mediashelf ("Mediashelf", "we", "us" or "our") collects, uses, and protects your personal data when you use the Mediashelf mobile application (the "App"). We are committed to protecting your privacy and handling your data in an open and transparent manner, in accordance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and the Data Protection Act 2018.

1. Who we are

Mediashelf is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, you can contact us at support@mediashelf.co.uk.

2. The information we collect

We collect the following categories of personal data:

Account information

During this testing phase, public sign-up is disabled and we do not collect registration details from you. Instead, we provide pre-provisioned test accounts, which contain placeholder profile information — such as a username, display name, date of birth, profile picture, and bio — that we have created. Account credentials are managed securely through Amazon Cognito. If you update any profile details on a test account, those changes are stored against that account.

Content you create

We store the content you choose to create while testing the App, including posts (text and images), comments, and reactions (likes). Images you upload are stored securely in Amazon S3. Please avoid sharing real personal or sensitive information in test content.

Creating posts from a link

Mediashelf can create a post automatically from a web link you provide. When you use this feature:

• the link you submit is sent to Tavily (a third-party content-extraction service) to retrieve the page's title, text, and images;
• the website's domain is sent to Context.dev to retrieve branding information (such as logos and colours) used to style your post; and
• the retrieved content is processed by AI models running on Amazon Bedrock to generate a summary and title and to select a relevant image.

We store the resulting post content that you choose to share. Please only submit links you are comfortable processing in this way.

Social connections

To provide social features, we store information about your connections, such as the accounts you follow, the accounts that follow you, and pending follow requests. During the pre-release testing phase, the only accounts available to follow are the other test accounts.

Music search

When you search for music — such as tracks or albums — to attach to a post, your search terms are sent to Spotify's API so we can return matching results. We store only the details of any track or album you choose to attach to a post (such as the title and artwork).

Technical data

When you use the App, our infrastructure provider (Amazon Web Services) automatically processes limited technical data — such as your IP address and basic connection information — for the purposes of delivering the service, security, and preventing abuse. We do not use third-party advertising or analytics tracking, and we do not collect your location. Future releases of the App may introduce features that use your device's location; if and when they do, we will request your permission and update this policy to explain how that data is used.

3. How and why we use your information

Purpose	Lawful basis (UK/EU GDPR)
To provide and manage test accounts and authenticate you	Performance of a contract
To display your posts, comments, and profile, and to power social features such as following and feeds	Performance of a contract
To return music search results from Spotify	Performance of a contract
To generate a post from a link you provide (retrieving the page, and creating a summary, title, image, and theme)	Performance of a contract
To keep the App secure, prevent abuse, and diagnose technical problems	Our legitimate interests in running a safe service
To comply with our legal obligations	Legal obligation

4. Who we share your information with

We do not sell your personal data. We share data only with the service providers that are necessary to operate the App:

• Amazon Web Services (AWS) — hosting, authentication (Amazon Cognito), database (AWS AppSync), file storage (Amazon S3), and AI processing (Amazon Bedrock) that powers the create-a-post-from-a-link feature. Your account and content data is hosted in AWS's London (eu-west-2) region.
• Spotify — when you search for music, your search terms are sent to Spotify's API to return results. Spotify processes these searches under its own privacy policy.
• Tavily — when you create a post from a link, the link you submit is sent to Tavily to extract the page's content (title, text, and images). Tavily processes this under its own privacy policy.
• Context.dev — when you create a post from a link, the link's domain is sent to Context.dev to retrieve branding information used to style your post. Context.dev processes this under its own privacy policy.

We may also disclose your information where we are legally required to do so, or to protect the rights, safety, or property of Mediashelf or others.

5. Where your data is stored and international transfers

Your account and content data is stored on AWS servers located in the United Kingdom (London / eu-west-2 region). Some processing takes place outside the UK or European Economic Area (EEA):

• When you create a post from a link, part of the AI processing (image selection) runs on Amazon Bedrock in the United States (us-east-1 region).
• Third-party services you interact with — Spotify, Tavily, and Context.dev — may process data outside the UK/EEA under their own privacy policies.

Where such transfers occur, they are governed by the relevant provider's own data transfer safeguards. We otherwise store your personal data within the UK.

6. How long we keep your data

We keep test-account data and the content created during testing for the duration of the testing programme. Test data may be cleared periodically or when the testing phase ends. If you would like the content associated with a test account, or the account itself, removed sooner, contact us and we will delete it manually — see "Your rights" below.

7. Your rights

Under the UK and EU GDPR, you have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Objection — object to processing based on our legitimate interests.
• Portability — request your data in a portable format.
• Withdraw consent — where we rely on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@mediashelf.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local data protection authority.

8. Security

We take reasonable technical and organisational measures to protect your personal data. Authentication and passwords are handled by Amazon Cognito, data is transmitted over encrypted connections, and access to stored content is restricted. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

Mediashelf is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will take steps to delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time as the App evolves or as required by law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact us

If you have any questions or concerns about this Privacy Policy or your personal data, please contact us at support@mediashelf.co.uk.

← Back to home