SHAPPYour connected data and Shappy
This notice describes how managed integrations work in SHAPP, which lets you create and use business applications with Shappy.
What you authorize
Each connection uses the account you choose with the provider. SHAPP stores the account identity, connection status and tokens needed to use and renew that access. Tokens are encrypted in the server vault. They are separate from the AI model provider’s keys.
Accessible data
Depending on the permissions granted, data may include Drive file content and metadata, Sheets cells, Calendar events and availability, Gmail messages and drafts, Notion pages, Airtable records, CRM contacts, Slack messages or Stripe objects. Some permissions cover the entire authorized account; page, base and channel selections depend on the provider.
What the data is used for
Connected applications use this data for operations you request: finding information, populating a business application, preparing a response or creating and updating a record. An action can also write to the provider, send a message or change an invoice when that functionality is used. Check the requested resource and operation.
When you use Shappy
Your requests, conversation context and results of the tools used may be sent to the AI model service to produce a response or perform the requested work. The managed Shappy service currently uses Anthropic models through Amazon Bedrock, operated by AWS. SHAPP provides this access: you do not need to bring your own model key. Connecting a provider therefore does not mean its content stays exclusively with that provider when you use it with Shappy.
What may remain in your workspace
Conversations, responses and execution records may contain data from connected services. Tool inputs and outputs are recorded in the agent history; data copied into a business application becomes part of its data. Removing a connection does not automatically erase those records or operations already performed with the provider.
Remove access and request deletion
In SHAPP, removing a connection from an application stops its use in that application. Disconnecting the account deletes the connection and its stored tokens from SHAPP. Also revoke SHAPP or Shappy in the provider’s settings to remove its authorization. For requests about data retained in SHAPP, contact your company administrator or legal@rootcx.com; identify the company and relevant data without sending secrets.
Google data
Google permissions and their consequences are presented before connection. The Google API Services User Data Policy, including applicable Limited Use requirements, governs uses and transfers of this data. Review the requested access and this notice before authorizing SHAPP.
Google API Services User Data Policy ↗RootCX privacy policy
This notice supplements the RootCX policy, including its information about recipients, retention, your rights and its commitment concerning model training. It does not replace the terms of the provider you connect.
RootCX privacy policy ↗