We collect only what the product needs to function.

• Account information. Your name, work email address, and organization name, collected when you create an account. Authentication is handled by our identity provider, and we never receive or store your password.
• Workspace content. The ideal customer profile you configure, the leads and companies surfaced for you, campaign settings, and outreach drafts you create or approve.
• Connected account data. Data made available by integrations you explicitly connect. This is described in detail below.
• Usage and diagnostic data. Log records such as request timestamps, error traces, and feature usage, retained to operate and debug the service.

We do not collect special category personal data, and we do not use advertising trackers or sell data to advertisers.

If you choose to connect a Google account, Shaku AI requests these OAuth scopes and no others:

• https://www.googleapis.com/auth/gmail.send, which permits sending email on your behalf and nothing else.
• openid and https://www.googleapis.com/auth/userinfo.email, used only to read the address of the account you are connecting, so we can show you which mailbox is linked.

This scope does not grant the ability to read, browse, search, modify, or delete any message in your mailbox, and we do not request any scope that would. We use it for exactly one purpose: to send the outreach messages that you have configured and approved, from your own address, so replies return directly to you and the message appears in your Sent folder.

We store the OAuth access token and refresh token issued by Google so that scheduled sequences can continue sending without asking you to sign in again. We store no mailbox content. You may revoke our access at any time from the Shaku AI integrations page, or directly through your Google Account permissions page, which immediately invalidates the stored tokens.

Limited Use disclosure. Shaku AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer this data to others except as necessary to provide or improve the feature you requested, to comply with applicable law, or as part of a merger or acquisition. We do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your explicit consent, to resolve a support issue you have raised, for security purposes such as investigating abuse, or where required by law.

If you connect a Microsoft account, we request the Microsoft Graph permissions Mail.Send, User.Read, and offline_access. These allow us to send messages on your behalf, read your basic profile so we can display which account is connected, and refresh access without repeated sign in prompts.

As with Google, we request no permission that would let us read the contents of your mailbox, and we store no mailbox content. Access can be revoked from the Shaku AI integrations page or from your Microsoft account settings.

• LinkedIn. With the scopes openid, profile, and email, we read your basic profile to confirm the connected identity. We do not post on your behalf and we cannot read your messages.

• To operate the service: discovering companies and contacts matching your ideal customer profile, scoring them against buying signals, and drafting outreach for your review.
• To send the messages you configure, through the email account you connected.
• To notify you of activity, such as a completed sourcing run.
• To secure the platform, investigate abuse, and meet legal obligations.
• To debug failures and improve reliability.

We do not use data from your connected mail accounts to train machine learning models.

We rely on a small number of processors, each bound by contract to handle data only on our instructions:

• Cloud hosting and managed database infrastructure.
• Authentication and identity management.
• Large language model providers, used to generate research summaries and outreach drafts.
• Business data enrichment providers, used to verify publicly available professional contact details.
• Transactional email delivery, used for system notifications such as team invitations.

We do not sell personal information, and we do not share it with advertisers or data brokers.

• All traffic runs over TLS, and data is encrypted at rest by our managed database provider.
• OAuth tokens are stored in an access controlled database and are never exposed to the browser or written to client side storage.
• Every record is scoped to your organization, and queries are filtered by tenant so one customer cannot reach another customer data.
• Administrative access is restricted to personnel who need it to operate the service.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you promptly and as required by applicable law.

We keep account and workspace data for as long as your account is active. When you disconnect an integration, the associated tokens are deleted immediately.

When you delete your workspace from Settings, we stop all processing for it straight away: outreach sending halts, scheduled steps stop, and lead sourcing stops. The data itself is permanently erased seven days later. That short window exists so an accidental deletion can be undone from the same screen, and nothing is sent or collected during it. After those seven days the erasure cannot be reversed.

• Download everything in your workspace at any time from Settings, as a machine readable JSON file. No request or waiting period.
• Delete your workspace and everything in it at any time from Settings.
• Access or correct the personal data we hold about you.
• Disconnect any integration at any time, which revokes our access immediately.
• Object to or restrict certain processing, where applicable law provides that right.

Depending on where you live, you may have rights under the GDPR, the UK GDPR, PIPEDA, or the CCPA. To exercise any of them, write to us at connect@shakuai.io. We respond within 30 days.

Shaku AI surfaces business contact information about people at prospective customer companies, sourced from publicly available professional records and licensed business data providers. We process this on a legitimate interest basis for business to business communication. If you are one of these individuals and want your information removed, contact us at connect@shakuai.io and we will remove it and suppress it from future sourcing.

We operate in North America, and your data may be processed in the United States or Canada. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses.

Shaku AI is a business product and is not directed to anyone under 18. We do not knowingly collect data from children.

We may update this policy as the product evolves. Material changes will be announced in the application or by email before they take effect, and the date at the top of this page will be revised.

Questions about this policy or about how we handle your data can be sent to connect@shakuai.io.