SHAPP privacy policy

1. Scope

This policy applies to visitors of shapp.ai, to SHAPP customers and the members of their companies, to people who use Shappy from SHAPP, a messaging channel or a connected AI assistant, and to people who contact us.

The data a company stores in its SHAPP applications (for example its customers, quotes and invoices) belongs to that company. For that data, the company is the data controller and we act as its processor; questions about it should go to the company first. For the data we collect for our own purposes (accounts, billing, security, website), we are the controller.

2. Data we collect

• Identity and contact: name, email address, phone number when you sign in with it, company name.
• Credentials: hashed passwords, sign-in tokens, and the encrypted tokens of the services you connect.
• Company data: the records you and your team create in SHAPP applications, and the files you add.
• Conversations with Shappy: your requests, the context needed to answer them and the results of the tools used.
• Technical and usage data: IP address, browser and device information, pages visited, feature usage.
• Billing: company address, VAT number, subscription records; card payments are processed by Stripe.
• Communications: support requests and emails.
• Audit logs: actions taken in a company, such as sign-ins, data access and changes, including those made by Shappy or a connected assistant on your behalf.

We do not intentionally collect special categories of data (for example health or biometric data). If such data was submitted by mistake, contact us so we can delete it.

3. Why we process it

• Provide SHAPP and manage your account and company (performance of a contract).
• Bill and collect payments (performance of a contract).
• Send service messages such as sign-in codes, security alerts and receipts (performance of a contract).
• Answer support requests (performance of a contract or legitimate interest).
• Keep the service reliable, secure and improve it, including aggregated, de-identified statistics (legitimate interest).
• Comply with tax, accounting and legal obligations (legal obligation).
• Send product news or marketing, only with your consent (consent).

Where we rely on legitimate interest, we have assessed that it does not override your rights and freedoms. You can ask us for details.

4. Shappy, AI models and connected assistants

Your requests, the conversation context and the results of the tools used may be sent to an AI model service to produce an answer or do the requested work. Shappy currently uses Anthropic models through Amazon Bedrock, operated by AWS. You do not need to bring your own model key.

When you connect SHAPP to ChatGPT, Grok Bot or another compatible assistant, that assistant may receive your company name, the list of its applications and how to use them, and the records you ask it to read or change. SHAPP sends only the data needed for the requested action, applies your existing role and permissions, keeps the connection credentials, and records changes in the company audit log. The assistant provider processes this data under its own terms and privacy policy. You can disconnect the assistant at any time to stop future access.

We do not use your data to train AI models. We do not operate our own foundation models. Model and assistant providers are third parties; their handling of data is governed by their terms.

AI answers can be inaccurate. Shappy never sends messages or signs documents for you: you do that in the application.

5. Who receives data

We do not sell personal data. We share it only as follows:

• Service providers that help us run SHAPP: cloud hosting, AI model services, payment processing (Stripe), transactional email and error monitoring. They act on our instructions under data processing agreements.
• Services you choose to connect, such as Google, Notion, Airtable, HubSpot, Slack or Stripe, and the assistants or messaging channels you link (for example ChatGPT, Grok Bot, WhatsApp or Telegram). Data then flows to them under your control and their terms.
• Authorities, where the law or valid legal process requires it, or to protect the rights and safety of people or of the service.
• A buyer or successor in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different policy.
• Professional advisers bound by confidentiality, such as auditors and lawyers.

A list of our subprocessors is available on request at legal@rootcx.com.

6. International transfers

We are based in Belgium. Some providers operate outside the European Economic Area. In that case we rely on European Commission adequacy decisions, Standard Contractual Clauses, and additional measures where needed.

7. How long we keep data

• Account data: for the duration of the contract, plus 90 days.
• Company data: for the duration of the subscription; it can be exported for 30 days after termination, then it is deleted.
• Billing data: as long as Belgian and EU financial rules require (usually 7 years).
• Audit logs: 7 days on the free trial, 30 days on Solo, 1 year on Team and Business.
• Support communications: up to 365 days after resolution.
• Website analytics: 26 months, aggregated and de-identified where possible.

When data is no longer needed, we delete or anonymize it. Backups are erased on their normal rotation.

8. Security

We protect data with encryption in transit and at rest, role-based access controls, an encrypted vault for credentials and tokens, audit logs of administrative and data access events, and regular security reviews. No system is completely secure. If a breach affects your personal data, we will notify you and the competent authority as required by the GDPR (within 72 hours where feasible).

9. Your rights and controls

Under the GDPR you can ask to access, correct, delete, restrict or receive a copy of your personal data, object to processing based on legitimate interest, and withdraw your consent at any time. Write to legal@rootcx.com; we answer within 30 days and may ask you to prove your identity. Some data may be kept where the law requires it, such as billing records.

In SHAPP, a company administrator manages members and roles, and you can disconnect a connected service or assistant at any time. Also revoke SHAPP or Shappy in the settings of that service to remove its authorization. Removing a connection does not erase data already copied into an application or operations already performed.

You can complain to the Belgian Data Protection Authority or to the authority of your country of residence.

10. Cookies

We use strictly necessary cookies (sign-in, session, security) and functional cookies (language, preferences), which do not require consent, and analytics cookies only with your consent. We do not use advertising cookies. You can manage cookies in your browser; blocking necessary cookies may prevent SHAPP from working.

11. Children

SHAPP is a service for businesses and is not directed at children. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. For a material change, we will notify you at least 30 days in advance by email or in the product. The date at the bottom of this page shows the latest version.

13. Contact

For privacy questions and requests: legal@rootcx.com. For general questions: contact@rootcx.com. SHAPP is operated by RootCX, Belgium.