Privacy Notice

1. What is this Privacy Notice about?

This Privacy Notice describes how ShamsAI ("we", "us") collects and processes personal data when you use our websites, including www.shams.ai and conceptify.com, use Conceptify, communicate with us, enter into a business relationship with us, or otherwise interact with us.

"Personal data" means information relating to an identified or identifiable individual. "Processing" means any handling of personal data, including collection, storage, use, disclosure, alteration and deletion.

This Notice is intended to meet transparency requirements under the Swiss Federal Act on Data Protection (the "FADP") and, where applicable, the EU General Data Protection Regulation (the "GDPR"). The applicability of these laws depends on the specific processing activity and your location.

Our services are offered primarily on a business-to-business basis. Individuals usually interact with us as employees, contractors, representatives or authorised users of a business customer.

Where a customer uploads or otherwise provides content to Conceptify that includes personal data, the customer is generally the controller and ShamsAI acts as processor. That processing is governed by our Data Processing Agreement.

2. Who is the controller for processing your data?

For processing activities described in this Notice where we determine the purposes and means of processing, the controller is ShamsAI GmbH, Lichtstrasse 35, 4056 Basel, Switzerland.

You may contact us for data protection concerns, questions about this Notice, or to exercise your rights as follows:

We have not listed a separate EU or UK representative, data protection officer, or Swiss data protection advisor in this Notice. If one is appointed or required, we will update this section.

3. What data do we process?

Depending on your relationship with us, we may process the following categories of personal data:

• Technical data: IP address, browser and device information, timestamps, request metadata, log data, error data and security events.
• Contact and business identity data: name, business email address, company, job title, phone number and similar professional contact details.
• Communication data: messages you send to us, contact form submissions, support requests, meeting notes and related metadata.
• Account and registration data: user identifiers, authentication data, organisation membership, roles, permissions and account activity.
• Contract and billing data: contract records, subscription information, invoice details, payment status and commercial correspondence. Payment card data is processed by payment providers and is not stored by us.
• Usage, analytics and security data: feature usage, audit trails, access logs, rate-limit events and aggregated or anonymised metrics used to operate, secure and improve our services.
• Customer data in Conceptify: documents, transcripts, prompts, outputs, datasets and other content uploaded or generated by customers or their authorised users. Where this content includes personal data, we generally process it as processor under the applicable customer agreement and DPA.

We do not intentionally collect health data, biometric data, intimate data or other sensitive personal data for our own controller purposes through the websites. Customers are responsible for the data they upload to Conceptify; such data may include sensitive personal data depending on the customer's use case and is governed by the customer's instructions and the DPA.

We receive most data directly from you, your employer or organisation, or from the systems you use. We may also receive limited data from service providers, business partners, public sources, security tools or payment providers where relevant to the purposes below.

4. For what purposes do we process your data?

We process personal data for the following purposes:

• Communication: to respond to inquiries, provide information, arrange demonstrations, handle support requests and communicate about our services.
• Contracting and service delivery: to enter into, administer and perform contracts, provision accounts, manage organisations and provide Conceptify.
• Customer relationship management: to manage business contacts, maintain relationship history, follow up on requests and provide service-related updates.
• Security and abuse prevention: to monitor systems, protect accounts, detect misuse, investigate incidents, maintain audit logs and defend our systems and users.
• Compliance and governance: to meet legal, accounting, tax, regulatory, audit and corporate governance obligations.
• Product improvement and analytics: to understand aggregate website and service usage, improve reliability, prioritise development and measure performance.
• Legal claims and risk management: to establish, exercise or defend legal claims, enforce agreements, conduct internal reviews and manage business risk.

5. On what basis do we process your data?

Where the FADP applies, we process personal data lawfully, in good faith and proportionately for the purposes described in this Notice.

Where the GDPR applies, we rely in particular on the following legal bases:

• Contract or pre-contractual steps: where processing is necessary to provide services, administer accounts, respond to your request or enter into a contract.
• Legal obligations: where processing is necessary for accounting, tax, regulatory, security, corporate or other legal obligations.
• Legitimate interests: where we operate, secure and improve our services, communicate with business contacts, prevent abuse, manage risk, enforce agreements or conduct ordinary business operations, provided your rights do not override those interests.
• Consent: where required or appropriate, for example for non-essential cookies, optional communications or other processing based on your consent.

You may withdraw consent at any time with effect for the future. Withdrawal does not affect processing carried out before withdrawal or processing based on another legal basis.

6. What applies in case of profiling and automated individual decisions?

We may analyse limited usage, technical and security data to understand how our services are used, improve reliability, detect misuse, prioritise development and secure our systems. We generally use aggregated or anonymised data where this is sufficient.

We do not currently make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. If we introduce such automated individual decisions, we will provide the information and safeguards required by applicable law.

7. With whom do we share your data?

We may disclose personal data to the following categories of recipients where necessary for the purposes described in this Notice:

• Service providers and subprocessors: hosting, infrastructure, database, storage, security, monitoring, authentication, communications, support, payment, electronic-signature, compliance and artificial-intelligence service providers.
• Customers and organisation administrators: where you use Conceptify through an organisation, that organisation may access and manage account, usage and Customer Data associated with its workspace.
• Professional advisers: lawyers, auditors, accountants, insurers and other advisers where necessary for governance, compliance, risk management or legal claims.
• Authorities and courts: where we are legally obliged or entitled to disclose data, or where disclosure is necessary to protect our rights, users, systems or business.
• Transaction parties: potential or actual acquirers, investors, financing parties or advisers in connection with a merger, acquisition, financing, reorganisation or similar transaction, subject to appropriate safeguards.

Where we act as processor for Customer Data, subprocessors are governed by the DPA. The current subprocessor information is available at /subprocessors.

We do not sell personal data.

8. Is your personal data disclosed abroad?

We and our service providers may process personal data in locations including Switzerland, the European Economic Area, the United States for a limited number of service providers.

Where personal data is transferred to a country without an adequate level of data protection, we implement appropriate safeguards, such as the European Commission Standard Contractual Clauses with the Swiss addendum where required, or rely on another lawful transfer mechanism or exception.

Internet communications may also transit through other countries even where sender and recipient are located in the same country.

9. How long do we process your data?

We process personal data for as long as necessary for the purposes described in this Notice, as long as legal retention periods apply, or as long as we have a legitimate interest in retaining documentation and evidence.

• Customer Data: managed by the relevant customer and deleted or returned in accordance with the DPA and customer agreement.
• Application performance logs: 7 days.
• General application logs: 30 days.
• Audit logs: 90 days.
• Security logs: 365 days.
• Backups: residual copies may remain for up to 1 year, depending on backup cycles.
• Billing and contract records: 10 years, where required by Swiss accounting law.

Longer retention may apply where required by law, necessary for legal claims, required to enforce agreements, or technically necessary for backup and disaster-recovery systems.

10. How do we protect your data?

We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration, unauthorised disclosure and unauthorised access.

Measures may include encryption in transit and at rest, access controls, logging, monitoring, backup procedures, least-privilege access, confidentiality obligations, vulnerability management and incident response processes. No method of transmission or storage is completely secure, so residual risks cannot be excluded.

11. What are your rights?

Depending on the applicable data protection law, you may have the right to request information about personal data we process about you, request correction, request deletion, request restriction of processing, object to processing, request data portability, withdraw consent and request review of automated individual decisions where applicable.

To exercise your rights in relation to our controller processing, contact us at [email protected]. We may need to identify you before responding to prevent misuse.

If your request concerns Customer Data processed by us as processor, please contact the relevant customer or organisation administrator first. We support customers in handling such requests in accordance with the DPA.

These rights may be subject to conditions, exceptions or restrictions under applicable law. You may also lodge a complaint with a competent supervisory authority. In Switzerland, this is the Swiss Federal Data Protection and Information Commissioner. For the EEA, you can find supervisory authorities through the European Data Protection Board.

12. Do we use online tracking and online advertising techniques?

We use cookies and similar technologies to operate the website, remember preferences, manage consent and, where you allow it, measure aggregate usage. You can manage optional categories through Privacy Settings.

We distinguish the following categories:

• Necessary cookies and storage: required for basic website functionality, security, consent storage, language settings and similar essential functions.
• Functional cookies and storage: used for optional preferences and enhanced functionality where enabled.
• Analytics: used only if you grant analytics consent. Analytics help us understand aggregate usage and improve the website and services.
• Marketing: reserved for marketing or advertising technologies if introduced and enabled with appropriate consent. We do not currently use third-party advertising or cross-site tracking cookies on the websites.

If we introduce additional analytics, advertising or embedded third-party services, we will update this Notice and, where required, request consent before loading non-essential technologies.

13. What data do we process on our social network pages?

We maintain official Conceptify profiles or pages on third-party platforms. If you interact with us there, we may process your profile information, comments, messages, reactions and other data made available to us by you or the platform.

• Conceptify on LinkedIn
• Conceptify on X
• Conceptify on Instagram

The platform operators process data for their own purposes as separate controllers, including analytics, platform security, advertising and content personalisation. Please review the privacy notices and settings of the relevant platforms for details.

14. Can we update this Privacy Notice?

We may update this Privacy Notice from time to time. The version published on this website is the current version. The "Last updated" date indicates when this Notice was most recently changed.

For the authoritative current version of this Notice, please refer to https://www.shams.ai/privacy.