Privacy Policy

This policy explains how the provider of Shukai (we, us; our details are at the end of this page) processes personal data when we decide why and how it is processed — that is, as the controller (in Ukrainian law, the володілець).

1. What this policy covers

It covers personal data of:

• customers — people who create a Shukai account and work in the panel, and the businesses they act for;
• visitors of shukai.ai — including people who talk to the assistant on our own website;
• people who write to us.

It does not cover the conversations visitors have with the assistant on our customers’ websites and applications. There, each customer decides what is collected and why, and we process that data only on the customer’s behalf, under our Data Processing Agreement. If you talked to an assistant on someone else’s site, that site’s privacy notice applies, and your requests should go to its owner.

2. What we collect

2.1. Your account

• Your name and email address, and your password, which we store only as a one-way hash.
• If you sign in with Google: the name and email address Google gives us. We do not receive your Google password.
• What you add and configure in the panel: your sites, the pages and files the assistant reads, the assistant’s settings, API keys (we keep only a hash of management keys), and the credentials of tools you connect (encrypted).
• Records of how you use the Service: credits spent, when you signed in, plan and payment history.

The panel sets two cookies that it needs to work: a session cookie that keeps you signed in, and a cookie that protects forms against cross-site request forgery. It also remembers in your browser which site you had open and the language you chose. We use no advertising or analytics cookies.

The panel has a Shukai assistant of its own. When you talk to it, it works like the assistant on any site: your messages, and the names and values of the fields on the panel screen in front of you, go to the language model providers listed on the Subprocessors page so that it can answer you and act on the screen, and it uses a token that identifies you to read your own account’s data. These conversations are kept like those on shukai.ai (section 6).

2.2. Payments

Payments are taken by WayForPay. You enter your card details on WayForPay’s own page; we never receive them. We receive the payment result, the last digits of the card and a token that lets WayForPay charge the same card for renewals; we store the token encrypted. We pass WayForPay your name and email address.

2.3. Our website and our assistant

shukai.ai sets no cookies and loads no analytics or advertising scripts. It keeps one setting in your browser (local storage): the site’s language, so that it opens in that language next time.

When you talk to the assistant on shukai.ai we process:

• your messages, and your voice if you speak to it — the voice is streamed for speech recognition and is not recorded or stored;
• contact details you choose to leave so that we can reply to you, stored encrypted;
• technical context: the type of device, operating system and browser (from the user-agent string), your browser’s language, your time zone, the address of the page you are on, the address you came from and the campaign tags in it, and, where our network provides it, your approximate location (country, region, city). We do not store your IP address. To protect the assistant from automated abuse we count requests per address: the address is turned into a one-way keyed code that is kept in memory for at most 24 hours and is never written to a database or a log.

The assistant keeps your recent conversations in your own browser (local storage), so that you can continue them: up to 10 conversations, for 7 days. It also remembers there a few preferences, such as where you moved it on the screen; these stay until you clear them. You can clear this by clearing the site’s data in your browser.

2.4. Correspondence

When you write to us, we keep your message, your address and our reply.

3. Why we process it, and on what basis

Purpose	Legal basis
Providing the Service: your account, the panel, your assistants, support	Performance of our contract with you
Taking payments and keeping accounting records	Contract; our legal obligations under tax and accounting law
Emails about your account: verification, security, plan limits, changes to the Terms	Contract; legitimate interest in running the Service safely
Answering visitors on shukai.ai and replying to people who leave their contact details	Legitimate interest in answering questions about our product; your request
Protecting the Service against abuse and finding faults	Legitimate interest in a secure and working Service

We do not sell personal data, do not use it for advertising, and do not use it to train artificial intelligence models. We do not make decisions about you by automated means that have legal or similarly significant effects on you.

4. Who receives it

Personal data is processed by the companies that run parts of the Service for us — hosting, language models, speech recognition and synthesis, email and payments. They are listed, with what each one receives and where, on the Subprocessors page. Each processes the data only to perform its part of the Service.

We disclose personal data to public authorities only when Ukrainian law obliges us to.

5. Transfers outside Ukraine and the European Economic Area

Our servers and database are in the European Union (Frankfurt, Germany). Some providers — for example, the language model providers — are in the USA. We transfer data to them under their data processing terms, including the European Commission’s standard contractual clauses where those apply, and only to the extent needed for their part of the Service.

6. How long we keep it

• Account data — while your account exists. When you delete your account, its data is deleted from our database at once and from our backups within 14 days.
• Payment and accounting records — for as long as tax and accounting law requires.
• Conversations with our assistants on shukai.ai and in the panel — deleted 90 days after the conversation was last active; daily totals with no text and no identifiers are kept for statistics.
• Contact details left with our assistant, and correspondence — until the matter is resolved and for no longer than 3 years after it.

7. Your rights

You have the right to:

• know what personal data we hold about you and get a copy of it;
• have it corrected or completed;
• have it deleted, or its processing restricted;
• object to processing based on our legitimate interest;
• receive the data you gave us in a machine-readable format.

In the panel you can export your account’s data and delete your account yourself (Account → Data & privacy, and Account → Danger zone). For anything else, write to info@shukai.ai; we answer within 30 days.

You may also complain to the Ukrainian Parliament Commissioner for Human Rights, or, if you are in the European Union, to the data protection authority of your country.

8. Security

Data travels encrypted (HTTPS). Contact details visitors leave, payment tokens and tool credentials are encrypted in the database; passwords and management API keys are stored as hashes. Each customer’s data is kept apart from every other customer’s, and only we have access to the servers.

9. Children

The Service is for businesses; you must be 18 or older to create an account. Our website and assistant are not directed at children.

10. Changes to this policy

We publish the current version on this page with the date of the last change. If a change affects how we use data you have already given us, we tell customers by email before it takes effect.

11. Contact

Write to info@shukai.ai. Our details are below.