Privacy policy

What we collect

• Your account: your email address and sign-in identity, through our sign-in provider, Clerk.
• Your first name, last name and mobile number, asked for once right after sign-up. The number is your account's contact number; it is not permission for SHAI to text or call you, which is a separate choice with its own wording.
• For the account owner, a check that the mobile number is yours: our texting provider, Twilio, texts a one-time code (Twilio Verify) and looks up the number's line type (mobile, landline or internet/VoIP). SHAI does not see or keep the code. To keep one account per mobile number, the verified number is also kept as a one-way keyed hash.
• If you turn on texts or calls: the exact consent wording you agreed to, when you agreed, and the address and browser the agreement came from, plus your quiet hours and every opt-out.
• Only if you choose to give them: the holidays you celebrate, and the birthdays and anniversaries that matter to you — a first name, who they are to you and the date, nothing else about anyone.
• Your business profile: what you sell, to whom, at what price, in your words.
• Your runs, their transcripts, the messages you send SHAI, and what each run cost.
• Credentials for the tools you connect, encrypted at rest.
• When you use SHAI: the times you sign up, sign in and sign out; the network (IP) address each came from and its approximate city and region, as our hosting provider reports it; your device and browser; the pages you open and the main things you do — runs started, tools connected, files downloaded and messages sent (that a message was sent, never what it said); when you accepted the terms and the automatic-renewal disclosure, and which version; and when your email address and mobile number were verified.

How we use it

• To run SHAI for you: do the work you ask for, show you its results, and ask for your approval where an action needs it.
• To reach you the way you chose: in the app, by email, and — only if you opted in — by text or call.
• To bill you, when a paid plan is switched on. Stripe tells us whether a card is prepaid (never its number), because prepaid cards are not accepted.
• To send you tips, reminders and offers about your SHAI account by email, each with a one-click unsubscribe — and by text only if you ticked "news and offers". If you cancel, the reason you choose to give helps us improve SHAI.
• To answer you when you write to us, and so a person on the SHAI team can reach you about your account.
• To secure accounts, prevent fraud and respond to payment disputes: SHAI records sign-in IP addresses, times, devices and activity. When a charge on your account is disputed, we may give those records to Stripe, our payment processor, and through it to the card issuer, to answer the dispute. Only the SHAI team can read them, and each time they do is recorded.
• Which holidays you celebrate can say something about your faith, so that answer is used only to remind you, never shared and never used for marketing.

Text messages and calls

SHAI texts or calls you only after you tick a box that is not ticked for you, beside the exact wording of what you are agreeing to. Texts and calls are separate boxes. Consent is not a condition of using SHAI or of buying anything.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Mobile phone numbers and text-messaging opt-in data and consent are never shared with, sold or rented to third parties or affiliates for their marketing or promotional purposes.

Your number is passed only to the companies that deliver the messages and calls for us (Twilio, and the mobile carriers), and to the SHAI team's own customer records so we can reach you about your account — never to anyone for their own marketing.

Reply STOP to any text to stop texts, START to turn them back on, and HELP for help. Message and data rates may apply, and message frequency varies. You can also turn texts and calls off in Settings at any time. The full SMS terms are at https://www.meetshai.com/legal/sms-terms.

Who we share it with

We do not sell personal information, and we do not share it for anyone else's advertising. We share it only with the service providers that run SHAI for us — listed below under Sub-processors — each for the purpose named beside it, and when the law requires it.

None of this sharing includes text-messaging opt-in data and consent: that information is never shared with any third party or affiliate for marketing or promotional purposes.

The tools you connect (your CRM, your calendar, your ad accounts) receive what you direct SHAI to send them, under your own account with that tool.

Ad accounts you connect

If you connect a Meta ad account or a Google Ads account, SHAI stores an encrypted access grant for that business only, the list of ad accounts you can manage, and the account you picked. SHAI uses them only to create, launch (with your approval), pause and report on ads in that account, as you ask. For Meta it also stores your app-scoped Meta user ID and name, to show who connected and to remove its access on disconnect.

SHAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting revokes SHAI's access at Meta or Google and deletes SHAI's copy. See https://www.meetshai.com/legal/data-deletion.

Instagram accounts you connect

If you connect an Instagram professional account, SHAI stores an encrypted access grant for that workspace only, the Instagram accounts your sign-in reaches, the one you picked and the Facebook Page it is linked to. With Facebook Login it also stores your app-scoped Meta user ID and name, to show who connected and to remove its access on disconnect.

SHAI uses them only to publish what you ask it to, read and answer comments on your own posts, answer people who messaged you within Meta's 24-hour window, and report your insights and the public posts you ask it to research. Every message and reply SHAI writes says that an AI wrote it.

Disconnecting deletes SHAI's copy and, for Facebook Login, revokes SHAI's access at Meta. See https://www.meetshai.com/legal/data-deletion.

AI processing

• The model runs on your own key, under your own agreement with the model's vendor.
• We do not train models on your data.
• Credentials you connect are never shown to the model.

Security

• Credentials are encrypted at rest with AES-256-GCM.
• One account's data is not visible to another; the database client enforces that itself.
• Card details are held by Stripe; SHAI never holds a card number.

Keeping it, exporting it, deleting it

We keep your data while your account is open. You can export everything as JSON from Settings at any time.

Deleting your account removes your rows, unlinks your repository, removes your contact from the SHAI team's own customer records within minutes, and tells you exactly what is left to do by hand. If a deployment's team keeps records of closed accounts instead, the Delete account screen says so before you confirm, and support removes them when you ask.

Fraud prevention, hashes only: so that a deleted account cannot be reopened for a second free trial straight away, we keep for 90 days only one-way keyed hashes (HMAC-SHA256 under a secret only our service holds) of the account owner's mobile number, the owner's and admins' email addresses and the business domain, with the deletion date and whether the account used its trial — never the values themselves and nothing else — and then delete them automatically.

If a dispute (chargeback) is opened against a SHAI charge, the hashes of that account's mobile numbers, owner and admin email addresses, business names and business domains are kept on a ban list until our team removes them, to stop the same person or company signing up again; public email providers such as Gmail are never banned as a domain. Deleting the account does not remove them.

A dispute can also block future sign-ups from the same network: one-way keyed hashes of the network (IP) addresses the disputing account signed up and signed in from in the 90 days before are kept for 180 days, and a new sign-up or a new trial from one of them is paused. Because many people can share one network — an office, a mobile carrier, a VPN — anyone paused by mistake can tell us why from the screen that pauses them, and our team reviews it within 24 hours.

The sign-in and activity records are kept while your account is open and are in your export. Deleting the account deletes them too, unless a payment on it was disputed or it was a paid account a dispute can still be opened on: then they are kept, to establish, exercise or defend legal claims, until two years after the account closed, and deleted after.

Your choices and rights

• See, correct, export or delete your data from Settings, or by writing to us.
• Stop texts by replying STOP, and turn texts and calls off in Settings.
• Wherever you live, you can ask what we hold about you and ask us to delete it: write to contact@meetshai.com. We do not treat you differently for asking.

Children

SHAI is for adults running their own lives and businesses. It is not directed to children under 13, and we do not knowingly collect their information.

Changes to this policy

When this policy changes, this page shows the new date at the top.

Contact

Summit Holdings And Investments LLC, doing business as SHAI. Email contact@meetshai.com.