This Privacy Policy explains how Shook Digital Oy, trading as ShookAI ("ShookAI"), processes personal data of visitors to the ShookAI website, users of the ShookAI service and contact persons of our customers and prospective customers.
1. Controller and contact details
- Shook Digital Oy (ShookAI), Business ID 3217492-9
- Käenkuja 3 a A, 00500 Helsinki, Finland
- Email: [privacy@shook.ai]
You can contact us at the email address above with any questions about this Privacy Policy or the processing of your personal data.
2. Scope of this Privacy Policy
This Privacy Policy applies when ShookAI processes personal data as a controller, which covers:
- visitors to the ShookAI website at shook.ai;
- users of the ShookAI service at app.shook.ai, such as employees of our customers who have a user account; and
- contact persons of our customers, prospective customers and partners.
When our customers use the ShookAI service, the service may also process personal data contained in their own data, such as advertising data and creatives. In that case ShookAI acts as a processor on behalf of the customer under the ShookAI Data Processing Addendum, and the customer's own privacy policy applies. This Privacy Policy does not cover that processing.
3. Personal data we process
| Data subjects | Personal data |
|---|---|
| Website visitors | Usage data such as pages viewed, interactions, referring website, browser and device type, approximate location derived from the IP address, and cookie or similar identifiers. Information submitted through contact or demo request forms, such as name, email address, company and message |
| Service users | Name, email address, role, Organization and user account details; login and authentication data; data about how the service is used, such as features used, events, timestamps, technical logs and session recordings of interactions in the service; support requests and related communications |
| Customer and prospect contacts | Name, email address, phone number, company, title and other business contact details; communications and meeting notes, including recordings and transcripts of sales and customer calls where participants have been informed; registration details for events and webinars; contract, order and billing details, such as invoicing contacts and payment information processed by our payment provider |
We do not intend to process special categories of personal data. Please do not include such data in your messages to us.
4. Sources of personal data
We collect personal data mainly from you, for example when you use the website or the service, create an account or contact us. Your employer or another customer administrator may also provide your details when they invite you to the service or name you as a contact person. We may supplement business contact details from public sources, such as trade registers, company websites and professional social media profiles, and from business contact data providers.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service, including user accounts, authentication and support | Performance of a contract with our customer, and our legitimate interest in providing the service to our customer's users |
| Keeping the website and service secure, preventing misuse and investigating incidents | Legitimate interest in securing our systems |
| Product analytics and session recordings to understand how the service is used, troubleshoot issues and improve it | Legitimate interest in developing the service |
| Website analytics | Consent, given through the cookie settings on the website |
| Responding to enquiries and handling sales and customer relationships | Legitimate interest in managing business relationships, or steps taken at your request before entering into a contract |
| Recording and transcribing sales and customer calls to keep accurate notes and improve our sales and customer service, where participants have been informed | Legitimate interest in documenting business discussions. You can ask us not to record a call |
| Customer feedback surveys | Legitimate interest in improving the service |
| Organising events and webinars | Performance of a contract when you register, or consent where required |
| Contracts, invoicing and accounting | Performance of a contract and compliance with legal obligations, such as accounting legislation |
| Business-to-business marketing, such as product updates and event invitations | Legitimate interest in marketing to business contacts, or consent where required. You can opt out at any time |
Where we rely on legitimate interest, we have balanced our interest against your rights. You can object to such processing as described in Section 10.
6. Cookies and analytics
On the ShookAI website (shook.ai), we use Google Analytics 4, loaded through Google Tag Manager, and Vercel Analytics to measure how the website is used. In the ShookAI service (app.shook.ai), we use PostHog for product analytics and session recordings to understand how features are used, troubleshoot issues and improve the service. The website analytics tools may use cookies or similar technologies to recognise returning browsers.
On the website, analytics tools are only activated after you have given your consent through the cookie banner. You can change or withdraw your consent at any time in the cookie settings. Cookies that are strictly necessary for the website or service to work, such as login and security cookies, do not require consent.
You can also block or delete cookies in your browser settings. Some features may not work if you do so.
7. Recipients of personal data
We share personal data only as needed for the purposes described above, with:
- service providers that process personal data on our behalf, such as cloud hosting, website analytics (Google Analytics and Vercel Analytics), product analytics (PostHog), email, communication and meeting note-taking tools, customer relationship management, e-signature (PandaDoc), payment processing (Stripe) and accounting services;
- professional advisers, such as lawyers and auditors, where needed; and
- authorities, where required by law.
In connection with a merger, acquisition or other transfer of the ShookAI business, personal data may be transferred to the acquiring party.
We do not sell personal data.
8. Transfers outside the EU/EEA
We primarily process personal data within the EU/EEA. If a service provider processes personal data outside the EU/EEA, we ensure that the transfer complies with the GDPR, for example on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses.
9. Retention
We keep personal data only as long as needed for the purposes for which it was collected:
| Data | Retention period |
|---|---|
| User account data | For as long as the user account is active, and deleted within [90 days] after the account or the customer's subscription ends |
| Product and website analytics data, including session recordings | [24 months] from collection |
| Support communications | [3 years] after the request is closed |
| Call recordings and transcripts | [12 months] from the call |
| Customer and prospect contact data | For as long as the business relationship continues, and [3 years] after the last contact |
| Contracts, invoices and accounting records | As required by Finnish accounting legislation, generally six (6) to ten (10) years |
| Security logs | [12 months], unless needed longer to investigate an incident |
10. Your rights
Under the GDPR, you have the right to:
- access your personal data;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, in certain circumstances;
- restrict the processing of your data, in certain circumstances;
- object to processing based on legitimate interest, and to object at any time to direct marketing;
- receive your data in a machine-readable format and have it transferred to another controller, where processing is based on consent or contract; and
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, contact us at [privacy@shook.ai]. We respond within one (1) month. We may need to verify your identity before responding.
If you are a user of the service and your request concerns data that your employer controls under its own agreement with ShookAI, we may refer the request to your employer.
11. Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
12. Security
We protect personal data with appropriate technical and organisational measures, such as encryption, access controls and logging, and require the same of our service providers.
13. Right to lodge a complaint
If you believe that we process your personal data in breach of data protection law, you have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, P.O. Box 800, 00521 Helsinki, tietosuoja@om.fi, tietosuoja.fi).
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The current version is always available at https://shook.ai/legal/privacy, and it states its effective date. We notify users of the service of material changes by email or in the service.