Privacy Policy

Shadow AI ("Shadow AI", "we", "us", or "our") operates the website at https://www.shadowai.work and the Shadow AI application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use the Service.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

2. How We Use Your Information

• ●To provide and operate the Service, including running AI-powered experiment design, literature search, and protocol generation
• ●To personalise the Service based on your research field, role, and usage patterns
• ●To send service-related communications (account confirmations, security alerts, important policy updates)
• ●To send product and marketing communications where you have opted in (you can opt out at any time)
• ●To analyse usage and improve the Service
• ●To detect and prevent fraud, abuse, and security incidents
• ●To comply with legal obligations

3. AI Processing of Your Content

Shadow AI uses large language models (LLMs) and other AI systems to process the research questions, problem statements, and other content you provide in order to generate experiment designs, hypotheses, and protocols.

Your content is sent to AI model providers (including Microsoft Azure OpenAI Service) to generate responses. These providers process your content as a data processor on our behalf and are contractually restricted from using your content to train their models.

We do not use your research content to train our own AI models without your explicit consent.

You retain ownership of the content you create in the Service. By using the Service, you grant us a limited licence to process that content for the purpose of providing the Service to you.

4. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

• ●Service providers: we share information with third-party vendors who provide infrastructure, analytics, AI processing, and payment services on our behalf. These providers are bound by contractual data processing terms
• ●AI model providers: your content is processed by AI model providers (e.g. Microsoft Azure) as described in Section 3
• ●Analytics: we use Vercel Analytics to understand usage patterns. This data is aggregated and does not identify you individually
• ●Legal requirements: we may disclose information if required by law, court order, or to protect the rights and safety of Shadow AI, our users, or others
• ●Business transfers: if Shadow AI is acquired, merged, or its assets are transferred, your information may be transferred as part of that transaction. We will notify you before your information is subject to a materially different privacy policy
• ●With your consent: we may share your information for other purposes with your explicit consent

5. Cookies

We use the following types of cookies:

• ●Essential cookies: required for the Service to function (e.g. session authentication). These cannot be disabled
• ●Preference cookies: remember your settings and preferences (e.g. theme, notification preferences)
• ●Analytics cookies: help us understand how the Service is used (via Vercel Analytics)
• ●Referral cookies: track affiliate or influencer referral codes so we can attribute signups correctly

You can control non-essential cookies through your browser settings. Note that disabling cookies may affect Service functionality.

6. Data Retention

We retain your account information and content for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required to retain it for legal, compliance, or fraud-prevention purposes.

Aggregated, anonymised usage data may be retained indefinitely for product improvement purposes.

7. Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews.

No method of transmission or storage is 100% secure. If you become aware of a security vulnerability or incident, please contact us immediately at privacy@shadowai.work.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• ●Access: request a copy of the personal information we hold about you
• ●Correction: request correction of inaccurate or incomplete information
• ●Deletion: request deletion of your personal information (subject to legal retention requirements)
• ●Portability: request your information in a structured, machine-readable format
• ●Objection: object to certain processing of your information
• ●Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time

To exercise these rights, contact us at privacy@shadowai.work. We will respond within 30 days.

9. Children's Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will delete it promptly.

10. International Data Transfers

Shadow AI operates globally. Your information may be transferred to and processed in countries other than the country in which you reside, including the United States. We ensure that any such transfers comply with applicable data protection law through appropriate safeguards (such as standard contractual clauses).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice in the Service. Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your information, please contact us at: