Privacy Policy

1. Who is responsible

SHYWAI is operated by Sergey Pinigin, sole proprietor, based in Varna, Bulgaria. He is the data controller for personal data processed through this service. For questions or requests, contact privacy@shywai.com.

This policy covers accounts, practice scenarios, private reports, public evidence pages, support and purchases through SHYWAI. For a short overview, see Your data.

2. What we process

• Account information: your email address, password hash and optional display name. We do not store your password in readable form.
• Your work: intake answers, messages, prompts, AI replies, reflection answers, run events and the reports generated from them.
• Service records: credit grants, spending and reversals, session records, security events and technical request information such as IP addresses and browser information in infrastructure logs and, for actions in your account, in the activity log described under Account activity below.
• Account activity: a log of actions in your account, such as signing up and signing in, pages you open and forms you send (not what you type), starting and finishing runs, publishing, purchases, refused actions and errors, with their time and, for actions taken in your browser, the IP address and browser they came from. Failed attempts to sign in to your account are logged with the IP address and browser they came from. Failed sign-up attempts are logged without an IP address or browser details.
• Usage statistics: the type of page visited (never an address that identifies you, your run or your public link), the site you came from, your browser, operating system, device type, screen size and language, an approximate location derived from your IP address (country, region and city) and the names of a few key steps, such as signing up or starting a run, and the kind of problem when the sign-up form shows an error or you do not have enough credits to start a run (never what you typed). This is collected without cookies and is not linked to your account. Umami does not store your IP address. See the Cookie Policy.
• Published evidence: the moments you select, your chosen public name, the scenario title and date.
• Support and purchases: messages you send us and, when you buy credits, purchase references, payment status and information needed for billing, tax and refunds. Stripe processes payment details; we do not receive or store your full card number or security code.

Do not submit employer or client secrets, credentials, sensitive personal data or someone else's information without permission.

3. Why we use it

Providing the service (GDPR Article 6(1)(b)): creating and securing your account, running scenarios, generating reports, maintaining your credit balance, handling purchases and responding to service requests. Your email, password and scenario inputs are needed for these features; your display name and public sharing are optional.

Legitimate interests (Article 6(1)(f)): preventing abuse and repeat sign-up bonuses, investigating failures, protecting the platform, reviewing run records to improve scenarios and keeping an activity log of each account so that we can help with support requests, investigate errors and protect your account from unauthorised sign-in attempts, and measuring how the site is used, with statistics that need no cookies and are not linked to your account, so that we can see which pages and steps work. We balance these purposes against your rights; you can object to this processing. To object to usage statistics, use the switch on the Cookie Policy page (no sign-in needed), turn on Do Not Track in your browser (after which nothing is sent), or email privacy@shywai.com.

Legal obligations (Article 6(1)(c)): maintaining required billing and tax records and responding to lawful requests. Where optional processing requires consent, we ask separately and you can withdraw it without affecting earlier lawful processing.

4. Who can access your work

Your private report is available in your account. Authorised platform operators can access run records for support, troubleshooting and scenario improvement. We do not provide private reports or scores to employers through the service.

A public evidence page is created only when you choose to publish. It shows your selected moments and their quotes, your chosen name, the scenario title and date. It does not show your private scores or the complete transcript. Anyone with its link can read or copy it.

You can revoke publication from your account. The link then stops working. We ask search engines not to index public evidence pages, but cannot remove copies, screenshots or caches held by others.

5. AI and service providers

Your messages and answers are sent to language model providers through OpenRouter to run conversations and analyse your work. Analysis may include your intake and reflection answers as well as the run transcript. Providers' processing and retention depend on the models and services used.

Infrastructure providers process data to host the application, database, logs and backups. Our pages load the HTMX library from the unpkg.com content delivery network; that network receives technical information needed to serve the resource, such as your IP address.

Usage statistics are collected with Umami, which we run on our own server. They are not processed by a third-party analytics service and are not passed to advertising companies.

We use an email provider to send account emails (sign-up confirmation, password reset, report ready). It processes your email address and the message. We keep a log of sent messages with a masked address and a keyed hash, not the full address. Unconfirmed sign-up requests are deleted after 24 hours.

When you make a purchase, Stripe processes payment and fraud-prevention data under its Privacy Policy. Support email providers process the messages you send us. We do not sell your personal data.

Some providers may process data outside the European Economic Area. International transfers must have a valid basis under GDPR, such as an adequacy decision or appropriate safeguards. Contact privacy@shywai.com for information about the providers, locations and transfer arrangements applicable to your data.

6. Storage and deletion

We keep your account, saved runs and reports while your account remains active so you can return to your work. Saved runs do not currently expire automatically. You can request deletion or use Delete account in your cabinet and confirm with your password.

Account deletion removes your name and email, wipes stored run and report text, revokes sessions and public pages, and leaves records without your name, email or run text. A one-way, keyed marker of your email address is retained to prevent a second sign-up bonus. This marker is pseudonymous data, not a claim that every retained record is anonymous.

The activity log has no fixed deletion date. When you delete your account, its entries stay without your IP address or browser details, and the account itself no longer has your name or email.

Deletion does not immediately remove infrastructure logs, backups or data already processed by AI providers. These have separate retention arrangements. Financial records required by law and limited records needed to prevent fraud or resolve disputes may be retained for those purposes. Contact us for the retention arrangements relevant to your request.

7. Your rights

Under GDPR, where applicable, you can request access to and a copy of your data, correction, deletion, restriction of processing and portability. You can object to processing based on legitimate interests and withdraw consent for processing that relies on it.

Email privacy@shywai.com from your account address. We may ask for information needed to verify your identity. We respond without undue delay, normally within one month; if a permitted extension is necessary, we explain it within that first month.

You can complain to your local data protection authority or Bulgaria's Commission for Personal Data Protection.

8. AI feedback and security

Reports use automated analysis of your work to provide practice feedback. They can be wrong or incomplete. SHYWAI does not use these reports to make hiring decisions or other decisions with legal or similarly significant effects on you.

We use password hashing, server-side sessions and access controls to protect accounts and private records. No service can guarantee absolute security.

9. Changes

We update this policy when our processing changes and publish the effective date above. Material changes will be brought to your attention before they take effect where required.