Privacy Notice

1. Who we are and when this notice applies

Core Dump Consulting Ltd, company number 12927321, trading as ShinobiOps, is based in England and Wales. Registered office: 24 Palladian Gardens, London, W4 2ER. Contact contact@shinobiops.ai for privacy questions and requests.

The Provider acts as an independent controller for account administration, billing, security and fraud prevention, service communications, product analytics, support records and business records. This notice covers our website, business contacts, account administration and other processing for which we determine the purposes and essential means. Where a customer directs our processing of personal data in its connected content, Inputs, Output or memory, we normally act as its processor or subprocessor under /dpa/. The customer’s notice explains its purposes. Actual activity determines the role; calling information telemetry or support data does not automatically make us its controller.

2. Information and sources

We receive information from you, your organisation’s administrators, authorised integrations and service providers, and lawful public business sources used for requested research. Categories include names, business contact and account details, organisation membership and permissions, billing and transaction records, support communications, connection metadata, selected business documents/messages, Inputs and stored Output, and technical and usage events.

Technical information may include IP address, device/browser information, request and security logs, visited pages and interactions, and advertising click identifiers when present in a landing URL. IP addresses may indicate approximate region; we do not offer a general purpose for collecting precise location under this notice. The actual connection scopes and processing instructions determine which external content is accessed.

Our contact form asks for your name, company, email and message and sends it to our customer-relationship system so we can respond and manage the enquiry. Please avoid secrets or sensitive content in general contact forms.

3. Purposes and lawful bases

4. Required information and your choices

Account, contact and payment information needed to fulfil a purchase or legal obligation may be required; without it we may be unable to create the account, take payment or provide the requested service. You can limit connected sources through the permissions and settings available for the integration and ask your administrator about organisational controls.

5. AI processing and customer-specific memory

Requested work may send necessary content to authorised model processors and intermediaries, including routes used for generation, research and embeddings. We do not authorise training of generally available models using Customer Content under the standard agreement. Customer-specific memory and calibration support that customer’s own work; they are not a permission to disclose its content to other customers.

Model brands, versions and suppliers may change subject to the DPA, applicable notices and transfer safeguards. Model routes through OpenRouter are restricted to zero-data-retention endpoints. A future general-training purpose would require separate specific terms, required permissions and an explanation of withdrawal and the limits of reversing completed training.

Customers determine the instructions, permissions and automation settings used for their workflows. Where supported and enabled by the customer, actions may execute under standing authorisations without individual confirmation. Customers must assess significant decisions about individuals and cannot use the service for prohibited or unauthorised regulated decisions. A human-approval feature does not itself establish that every customer deployment falls outside laws on automated decision-making.

6. Recipients and payments

Information is disclosed as necessary to hosting and infrastructure suppliers, authentication providers, payment processors, support and CRM systems, analytics/advertising providers, authorised model processors and professional advisers. Supplier roles depend on the activity. See /subprocessors/ for the provider list.

Clerk supports account authentication. Stripe processes payments through its payment interface; we receive subscription, transaction and billing records rather than collecting full card numbers or card security codes in our application. Stripe’s separate processing is described at https://stripe.com/privacy. PostHog provides analytics and Conversations support. Google Ads supports advertising measurement on website and application visits. OpenRouter is used for model routing and embedding routes. Downstream model providers depend on the route; see /subprocessors/.

Hetzner provides hosting in Germany or Finland (EU). We operate Twenty CRM (self-hosted) for customer relationship management. PostHog Conversations provides the support tool. Google Workspace hosts our business email. We may use an email delivery service for particular mailings. No delivery provider has been selected. See /subprocessors/.

Google Fonts receives visitors’ IP addresses and request information when fonts load.

We may disclose limited information where legally required, to protect rights or investigate incidents on a lawful basis, or to advisers and parties involved in a corporate transaction subject to appropriate safeguards. Customer-directed content remains subject to the DPA; these categories are not unrestricted permission to disclose it. We do not sell Customer Content or authorise its sharing for cross-context behavioural advertising under the DPA.

7. International processing

Our permitted processing regions are the EU, UK and US, depending on the service and account configuration. Our policy excludes processing in China. A UK contracting company or a European hosting location does not mean all processing remains there. For transfers requiring safeguards, we use an applicable adequacy arrangement or appropriate contractual mechanisms, such as EU standard contractual clauses and the UK Addendum or IDTA, and Swiss adaptations where required, with required assessments and supplementary measures. The applicable mechanism must be established before the affected transfer.

Contact us for relevant recipient/location information and a copy or explanation of applicable safeguards, subject to necessary redactions. Visiting the website or accepting the Terms is not consent to an otherwise unlawful transfer.

8. Retention and deletion

Customer-directed content follows the DPA: a standard 30-day export window after termination, earlier return/deletion elections, active deletion within 90 days after an earlier deletion instruction or completed return and no later than day 120 after termination, and backup expiry within 90 days after active deletion and no later than day 210. Deletion includes derived personal data and supplier copies. Limited legal-retention exceptions remain protected and restricted in use.

For our own controller records, retention depends on the purpose: account administration while needed to manage the relationship; enquiries and support while needed to resolve and follow up the matter; security records for the investigation and security need; and billing/statutory records for the period required by the applicable recordkeeping law. Relevant factors include the record’s sensitivity, outstanding disputes, legal obligations and whether a less identifiable record is sufficient. We do not treat those purposes as authority to retain all customer content indefinitely.

The so_adclick attribution cookie lasts up to 90 days when a supported advertising click identifier is present. Website PostHog identifier cookies last up to 90 days and application PostHog identifier cookies last up to 365 days. Local storage persists until cleared; session storage lasts for the browser session. Google advertising and Clerk authentication storage have provider-controlled lifetimes. See /cookies/ for the inventory. Device-storage expiry is distinct from retention of events already received by a supplier.

9. Security and restricted information

We apply risk-appropriate organisational and technical measures to protect information and restrict access to authorised purposes. Implementation evolves with the service; specific contractual security commitments are in the DPA and any agreed security schedule. We do not promise absolute security or claim an unverified certification.

The service is intended for business use, not directed at children. Restricted Data under Clause 9.4 of the Terms is subject to the restrictions and exceptions in that clause. Connected content may nevertheless contain such information; contact us or the relevant customer so it can be handled lawfully. See /tos/#clause-9-4.

10. Your rights and how to use them

Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction or portability of personal data, object to processing including direct marketing, and withdraw consent where consent is the basis. Withdrawal does not affect the lawfulness of earlier processing. These rights have conditions and exceptions; objection and withdrawal of consent are different rights.

Email contact@shinobiops.ai with a privacy-request subject line. We may ask for proportionate information to verify identity and locate the data. If we process for your organisation, contact that organisation first; we will pass relevant requests to it and assist under the DPA. We will handle controller requests within applicable statutory periods and explain any permitted extension or refusal. A request does not generally require closing your account.

11. Privacy complaints

You can raise a privacy complaint at contact@shinobiops.ai. We will acknowledge it within 30 days, investigate appropriately, keep you informed as appropriate and communicate the outcome. You may also complain to the UK Information Commissioner at https://ico.org.uk/make-a-complaint/ or the competent authority in your jurisdiction. Our internal process does not remove your right to contact a regulator.

12. Updates and other websites

We may update this notice as processing changes and will show the version and update date. We will provide appropriate direct notice of significant changes affecting individuals and obtain consent where a new purpose requires it. This notice provides information: continued website use is not blanket consent to new purposes or model training.

Other websites and independently supplied services have their own notices. Linking to them does not make their processing part of our notice or remove our responsibility for suppliers processing on our behalf.