Privacy policy

Last updated: 8 November 2026

1. Who is responsible

This policy explains which personal data we process when you visit this website and use the Shewiun platform, why we do it and which rights you have.

2. Visiting the website

When you open a page, our server and the reverse proxy in front of it record technical data: IP address, date and time, requested address, status code, browser type and a random request ID. We use this to deliver the site, keep it secure and fix errors (Art. 6(1)(f) GDPR). Server logs are kept for a short period and then deleted or rotated.

The public pages set no cookies. They store only your cookie choice in your browser (local storage) so we do not ask you again.

3. Analytics

If you accept analytics in the banner, the page counts anonymous daily totals for page views and clicks on key buttons (for example "Open the workspace"). The counts are stored on our own server. No IP address, cookie, fingerprint or user ID is stored with them, and nothing is sent to third parties. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with "Cookie settings" in the footer, which has effect for the future.

4. Contact form and e-mail

If you write to us, we process your name, e-mail address, company (optional), topic and message to answer you (Art. 6(1)(b) and (f) GDPR). The form has spam protection that checks timing and a hidden field and limits how often one connection can submit; it does not use external services. We delete enquiries when they are dealt with and no business relationship follows, normally within 12 months.

5. Using the platform

If you create an account we process your e-mail address, name, organisation, role, a password hash (Argon2id) and the content you and your agents create in the workspace, to provide the service (Art. 6(1)(b) GDPR). After you sign in the platform sets cookies that are strictly necessary: a session cookie and a CSRF token. They are not used for tracking. Audit events record who did what in your organisation and are part of the service.

6. Payments

Paid plans are processed by Stripe Payments Europe, Ltd. Stripe receives the data needed to bill you and acts as an independent controller or processor as described in its own terms. We do not see or store your full card number.

7. Recipients and processors

We use a hosting provider for the servers, Stripe for payments and an e-mail provider for system e-mails and replies, each under a data processing agreement where required. If you connect a model provider or an app to an agent, the data you send there is governed by that provider and your settings.

8. Transfers outside the EU

Where a recipient is located outside the EU or EEA, we rely on an adequacy decision or standard contractual clauses.

9. Your rights

You may request access, correction, deletion, restriction, data portability and object to processing based on legitimate interests (Art. 15 to 21 GDPR). Organisation data can be exported as JSON from the Organisation page. You can also lodge a complaint with the data protection authority responsible for you.

10. Security

We use encrypted connections (HTTPS), hashed passwords, role-based access, per-organisation isolation, rate limits and security headers. No online service can promise absolute security.

11. Changes

We update this policy when the service or the law changes. The date at the top shows the current version.

12. Contact

For privacy questions write to [E-mail: set CFA_CONTACT_EMAIL] or use the contact form.