Privacy

Last updated October 4, 2026

This policy explains what personal data Shay collects, how we use it, who we share it with, and the choices and rights you have. It covers the Shay website, the Shay app, and the waitlist.

1. Who is responsible

Shay, with its address at Second Floor, Al Abraaj Centre, F-6 Markaz, Islamabad, Pakistan, is responsible for your personal data as described here (the “controller” under EU and UK data protection law).

Contact: hello@shay.me.

2. Data we collect

Account and profile: your name, email address, sign-in details, time zone, and what you tell Shay about yourself during setup.
Chats and uploads: the messages you send, Shay’s replies, and the files you attach.
Memory: facts Shay keeps about you so it can help you better, such as goals, preferences, people, and projects. You can see, edit, and delete them in Settings.
Data from connected apps: when you connect an app such as email, calendar, or Slack, Shay reads the data it needs for the task you asked for or the routine you set up, such as messages, events, contacts, and files.
Tasks and activity: the tasks, routines, approvals, and standing permissions you create, a record of the actions Shay took, and any feedback you give on Shay’s work.
Usage and device data: technical data such as IP address, browser, device, and logs of how the service is used, which we need to run and secure it.
Billing data: Polar is the seller of record. Polar collects the payment details needed to charge you, including your card, billing address, and tax information. We send Polar your email, your Shay account id, and how many extra credits you used, so they can bill your plan. We receive your plan, payment status, and billing period. We do not receive your full card number.
Waitlist: your email address if you join the waitlist.
Messages to us: anything you send when you contact us.

Health and money details are sensitive. Shay does not keep them in long-term memory unless you turn that on in Settings. You can turn it off at any time.

3. How we use your data

to provide Shay: answer you, carry out the tasks you approve, and run your routines;
to remember what you ask Shay to remember;
to keep Shay secure, prevent abuse, and fix problems;
to improve Shay, using records of how it is used, such as which actions you approved or turned down and whether tasks worked, and any feedback you give;
while Help improve Shay is on, to train and improve Shay’s AI model, as described in section 5;
to manage your account, plan, and billing;
to reply to you and send important notices about the service;
to meet legal duties and to protect our rights.

We do not sell your personal data, share it for advertising, or use it to decide credit or lending.

4. Our legal reasons (EU, UK, and similar laws)

Contract: to provide the service you signed up for.
Legitimate interests: to keep Shay secure and reliable, to prevent abuse, and to improve Shay from records of how it is used, where your rights do not outweigh those interests. Outside the EEA, the UK, and Switzerland, this is also our reason for using your chats and feedback to improve Shay’s AI model while Help improve Shay is on. You can object at any time by turning it off.
Consent: in the EEA, the UK, and Switzerland, we use your chats and feedback to improve Shay’s AI model only if you turn on Help improve Shay.
Explicit consent: to keep health and money details in memory.
You can withdraw consent or object at any time in Settings, without affecting what happened before.
Legal obligation: to keep records the law requires, such as tax records.

5. How AI is used

To answer you, Shay sends your request and the context it needs to one AI model provider, through Vercel AI Gateway.
Those requests use zero data retention: the AI provider does not keep a copy after answering, and does not use them to train its models.
Shay itself stores your chat transcripts, uploads, and memory, so you can see your history and Shay can continue your work. We keep and delete them as described in section 9.

Help improve Shay

Help improve Shay is a setting in Settings. If you sign up from the European Economic Area (EEA), the UK, or Switzerland, it starts off and stays off unless you turn it on. Everywhere else, it starts on, and we tell you when you sign up. You can turn it off at any time.
While it is on, we may use what you write to Shay, Shay’s replies, and your feedback, such as ratings and corrections, to train, fine-tune, and test the AI model Shay runs on. We only use data from while it is on.
We never use data from your connected apps for this, such as email, calendar events, Slack messages, or files Shay reads from them, even when you quote them in a chat.
We never use health or money details for this, or data from anyone under 18.
Before we use it, we remove details that identify you directly, such as your name, email address, and phone number.
If you turn it off or delete your account, we stop using your data for new training and delete the copies we set aside for it. A model that was already trained cannot unlearn it, but it will not contain your name or contact details.
If it is off, we do not use your content to train or fine-tune any AI model.

6. Google user data

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data only to provide and improve features you can see and use in Shay.
We do not sell it, use it for ads, or transfer it except as that policy allows.
We do not use it to train or improve AI or machine learning models.
People do not read it unless you ask us to, it is needed for security such as investigating abuse, or the law requires it.

8. International transfers

Our main database is in the United States, and our providers may process data in the United States and other countries. When EU or UK law requires it, we rely on safeguards such as the standard contractual clauses approved for those transfers.

9. How long we keep data

Account data, chat transcripts, uploads, and memory are kept until you delete them or close your account.
Attachments you add but never send are deleted automatically.
A working copy of each chat, used only so Shay can continue it, is kept while the chat is open. Closing your account ends those copies, and they are deleted within 7 days.
After deletion, copies may stay in our database’s restore history for up to 30 days before they are gone.
Billing and tax records are kept for as long as the law requires.
Security logs are kept only as long as needed to protect the service.

To close your account, delete it from your account settings. Shay then deletes your account, chats, uploads, memory, tasks, routines, connected apps, billing customer, product analytics, and any data set aside to improve Shay. Email hello@shay.me if you want us to do it for you.

10. Security

We use reasonable safeguards, including encryption in transit, access controls, and reputable providers. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities where the law requires it.

11. Your rights

Depending on where you live, you may have the right to:

access your data and get a copy of it;
correct it;
delete it;
receive it in a portable format;
object to or restrict how we use it;
withdraw consent at any time;
complain to your data protection authority.

To use these rights, email hello@shay.me. We may need to confirm your identity. We will reply within the time the law requires, usually one month. You can also disconnect apps, delete memory, and revoke standing permissions yourself in the app.

12. California residents

In the last 12 months we collected the categories of data listed in section 2: identifiers, account details, content of communications from connected apps, internet activity, and, with your consent, sensitive details kept in memory. We use them only for the purposes in section 3.

We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. We honor Global Privacy Control signals. You have the right to know, correct, and delete your personal information, and we will not treat you differently for using these rights. Email hello@shay.me to make a request.

13. Children

Shay is not meant for anyone under 18, and we do not knowingly collect their data. If you think a child has given us personal data, email hello@shay.me and we will delete it.

14. Cookies

We use cookies and similar browser storage to keep you signed in, to remember settings such as your theme and sidebar, and to understand how Shay is used. Product analytics is run by PostHog. We use it to see which parts of Shay people use. We do not use it for advertising, and we do not record session replays. If your browser sends a Global Privacy Control signal, we do not collect this analytics data from that browser.

15. Changes and contact

We may update this policy. We will post the new version here with a new date and tell you about material changes before they apply. If a change affects how we use Google data, we will ask for your consent first.

Questions: hello@shay.me, or the contact page. See also our Terms.