Privacy Policy

Controller

Aurumaxis Labs Limited (United Arab Emirates) is the controller for personal data processed to run ShownInAI. Contact: [email protected]. Where we process data on behalf of business customers (for example leads captured by an agency widget), we act as a processor under the Data Processing Agreement.

What we collect

• Scan input: product or business name, category, website, city and competitors you enter.
• Account data: email address, optional name, password hash (Argon2id; we never store or see your password), Google account ID if you use Google sign-in, workspace name, plan and settings (for example a Slack webhook URL or logo).
• Session data: hashed session tokens with the IP address and browser that created them, kept until the session ends or expires (30 days).
• Billing data: handled by Stripe. We receive the customer ID, plan, status and country, never full card numbers.
• Widget leads: email addresses submitted through an agency's embedded scanner.
• Technical data: IP address, user agent and request logs, for security and rate limiting.

Why and legal bases

• Providing the service and your account (contract).
• Transactional email: sign-in links, alerts and receipts (contract).
• Security, abuse prevention and rate limiting (legitimate interests).
• Product improvement using aggregated data (legitimate interests).
• Billing records and tax (legal obligation).

We do not sell personal data and do not use it for cross-context behavioural advertising. We do not use your data to train AI models.

Sharing

We share data only with the subprocessors listed on the Subprocessors page, the agency that runs a widget you submit, and authorities where required by law.

International transfers

Our providers are mainly in the United States. For transfers from the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU-US Data Privacy Framework where the provider is certified. Transfers from the UAE follow the cross-border transfer provisions of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Retention

Account data is kept while your account is active and deleted within 30 days of a deletion request. Sign-in links expire after 15 minutes; rate-limit counters expire within an hour. Free scans without an account may be kept for up to 24 months so shared report links keep working. Billing records are kept as long as tax law requires.

Your rights

Depending on where you live, you can access, correct, delete or export your data, restrict or object to processing, and withdraw consent. Email [email protected]; we reply within 30 days. You can also complain to your data protection authority (for example in the EU, the UK ICO, or the UAE Data Office).

California (CCPA/CPRA)

We collect the categories listed above for the purposes listed above. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information. California residents can exercise the rights to know, delete and correct by emailing [email protected], and will not be discriminated against for doing so. Authorised agents may submit requests with written permission.

Children

The service is not directed at anyone under 16, and we do not knowingly collect their data.

Changes

Material changes will be emailed to account owners and listed in the Changelog.