Privacy Policy

Effective date: April 19, 2026 · Last updated: September 1, 2026

This Privacy Policy explains what information Shadow AI Policy collects, how we use it, and the choices you have. Shadow AI Policy (the "Service") is operated by Simcha Fuchs ("we," "us," "our"), an individual operating a sole proprietorship doing business as Shadow AI Policy.

1. Information we collect

Information you provide

When you use the policy generator, you voluntarily provide:

• Your work email address (required for delivery)
• Your company name, industry, company size band, and your role (e.g., HR manager, Legal)
• Categories of AI tools your team uses (e.g., ChatGPT, Microsoft Copilot)
• Categories of sensitive data your company handles (e.g., Customer PII, Protected Health Information)

You choose what to enter. You may use generic or fictional values in any field except your email, which is required to deliver the generated policy kit.

Payment information

When you purchase, payment details (card number, billing address) are collected and processed directly by Stripe. We never see or store your full card number. We receive only: your name, email, country, and the amount paid.

Server logs

Our hosting provider (Netlify) automatically logs basic request information (IP address, user agent, timestamp, requested URL) for security and abuse prevention. These logs are retained by Netlify per their privacy policy.

2. Product analytics

We use PostHog, a product-analytics service, to understand how the Service is used and to detect faults. It is loaded on our pages and records:

• Usage events — pages viewed, which step you reached, whether a purchase completed and whether your document was delivered. We use these to find and fix failures; a customer who paid and did not receive their document is invisible to us without them.
• Session recordings — we do not use these. PostHog can replay a visit as a video of the page. It is switched off in our configuration, because a replay records what the page displays, not only what you type: the policy kit the Service generates for you is ordinary text on the page. We hold no recordings.
• Technical data — browser, device type, and approximate location derived from IP. We also record uncaught JavaScript errors (the error message, and the file and line that raised it) so we can find faults no one thought to instrument. Browser console messages are no longer captured; that was a feature of session replay.

PostHog stores an identifier in your browser to recognise return visits. We use the same PostHog account across our other services, which are separated by a site label; we do not combine your activity across them to build a profile.

To opt out, enable “Do Not Track” or “Global Privacy Control” in your browser: our configuration honours both signals, and PostHog will capture nothing at all. You can also email info@shadowaipolicy.com and we will delete your events.

2a. Information we do not collect

The Service does not use any of the following on the main site:

• Google Analytics, Fathom, Plausible, or any other third-party web analytics beyond PostHog as described above
• Tracking cookies or cross-site tracking pixels
• Social media tracking (Facebook Pixel, LinkedIn Insight, etc.)
• Advertising networks or retargeting
• Session replay or heatmap tools (Hotjar, FullStory, Clarity, etc.) — including PostHog's own session replay and heatmap features, which are switched off in our configuration

Stripe may set its own cookies on its hosted checkout pages; that processing is governed by Stripe's Privacy Policy linked above.

3. How we use your information

• To generate your policy kit. Your inputs are passed to Anthropic's Claude API to produce the tailored policy documents.
• To deliver your policy kit. We send the generated documents to the email address you provided, using Resend as our email provider.
• To process payment. We pass payment instructions to Stripe; Stripe handles the transaction.
• To provide subscription services. If you subscribe to the Monitor plan, we store your company profile so we can generate monthly refreshed policy kits and email them to you.
• To send occasional product updates. One-time buyers may receive an email approximately once per quarter when significant AI-policy changes warrant an update (which may include affiliate links; see “Affiliate links and partner offers”). You can unsubscribe at any time.
• To prevent abuse. We may review server logs to detect fraud, spam, or technical issues.

4. Third-party processors

The Service relies on the processors below. Your data is shared with them only as necessary to provide the Service:

• Anthropic (privacy policy) — receives your policy inputs via the Claude API to generate the policy text. Per Anthropic's commercial terms, inputs submitted via the API are not used to train their models.
• Stripe (privacy policy) — processes payments. Stripe is a PCI-DSS Level 1 certified payment processor.
• Resend (privacy policy) — delivers policy kits and subscription updates to your email.
• Netlify (privacy policy) — hosts the website and stores form session data (Netlify Blobs).
• PostHog (privacy policy) — product analytics, as described under “Product analytics”. Receives page views, named events, uncaught JavaScript errors, your IP address, browser user agent, and a randomly generated device identifier. It does not receive the contents of your policy kit: session replay and heatmaps are disabled in our configuration. Hosted in the United States.
• Cloudflare (privacy policy) — email obfuscation on our site, preventing email scraping.

We do not sell your data, share it with advertisers, or use it for marketing purposes outside of the Service.

5. Data retention

• Form sessions: your inputs are stored for up to 30 minutes while you complete checkout, then automatically deleted. If you complete a purchase, they are kept with the generated kit so it can be re-delivered and refreshed; kit records carry a 30-day expiry, renewed each month while your plan is active.
• Monitor plan subscribers: your company profile is retained for the duration of your subscription so we can generate monthly refreshes. It is deleted within 30 days of subscription cancellation.
• One-time buyers: your email, company name, and industry are retained so we can send occasional product updates (approximately quarterly). You can request deletion at any time.
• Payment records: retained by Stripe per their retention policy, which we cannot override.
• Server logs: retained by Netlify per their retention policy (typically 30 to 90 days).
• Analytics events: retained by PostHog for up to 12 months, then deleted. You can ask us to delete yours sooner at any time.

6. Your rights

All users

You can request at any time, by emailing info@shadowaipolicy.com:

• A copy of the data we hold about you (access)
• Correction of any inaccurate data
• Deletion of your data (subject to any records we are legally required to keep)
• Opt-out from any marketing emails

We respond to all requests within 30 days.

California residents (CCPA / CPRA)

If you are a California resident, you have the rights listed above plus the right to know what categories of personal information we collect, sell, or share. We do not sell or share personal information for cross-context behavioral advertising. California residents can contact us at the email above to exercise these rights.

European Union / UK residents (GDPR / UK GDPR)

If you are in the EU or UK, you have the rights listed above plus:

• The right to data portability (receive your data in machine-readable form)
• The right to object to processing based on legitimate interest
• The right to lodge a complaint with your local data protection authority

Our legal basis for processing is (a) performance of a contract (generating and delivering your policy), and (b) legitimate interest (fraud prevention and occasional product updates, which you may opt out of at any time).

7. Security

Data in transit is protected by HTTPS/TLS. Data at rest is encrypted by Netlify and Stripe using industry-standard encryption. Despite reasonable precautions, no internet transmission or storage is 100% secure; we cannot guarantee absolute security.

8. Children

The Service is intended for businesses, not individuals. It is not directed to people under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided data, contact us and we will delete it.

9. International data transfers

Our processors are located in the United States and European Union. If you use the Service from outside these regions, your data will be transferred to and processed in those jurisdictions. By using the Service, you consent to this transfer.

10. Affiliate links and partner offers

ShadowAIPolicy may earn money through affiliate partnerships. Some links in our emails or on the Service — for example, a tool or service relevant to rolling out your AI policy — may be affiliate links, which means we may earn a commission if you sign up or buy through them. This is always at no extra cost to you and never changes the price you pay the partner. We only include offers we believe are genuinely useful to teams creating an AI policy; an affiliate relationship does not change our recommendations, and an affiliate link is not an endorsement or legal advice (ShadowAIPolicy is not a law firm).

When you follow an affiliate link you leave the Service, and any information you provide on the partner’s site is governed by that partner’s privacy policy, not ours. We do not sell or hand your personal information to these partners. An affiliate network may report back to us that a referral resulted in a sign-up or purchase using an anonymous tracking identifier (not your name or email), so we can measure which recommendations are useful.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, for users on our mailing list, notify you by email. Continued use of the Service after an update constitutes acceptance.

12. Contact

For any privacy question, concern, or request:

Email: info@shadowaipolicy.com
Response time: typically within one business day (Monday–Friday).