Privacy Notice
How SHEMANE acts as controller for account, security and business administration data.
Roles
SHEMANE is controller for account identity, authentication, service security, support and business administration. For customer-supplied credentials, page content, screenshots and run evidence, the customer is normally controller and SHEMANE is processor.
Purposes and lawful bases
Service delivery relies on contract or pre-contractual steps where the individual is a contracting party; managing a corporate customer’s operator account otherwise relies on legitimate interests in the B2B relationship. Security, abuse prevention and reliability rely on legitimate interests. Applicable legal recordkeeping duties rely on legal obligations. Marketing consent, if introduced, will be separate and optional.
Categories and recipients
We process account email and authentication records; projects, monitors and steps; run timings, failures, screenshots and incidents; minimized security logs; and alert delivery metadata. Recipients are authorized personnel and listed processors.
Retention
Proposed defaults are 7 days for failure screenshots and 30 days for run evidence, configurable within documented bounds. Automated enforcement and permanent account deletion are not yet active and require operator follow-up; this blocks commercial launch. Deletion is subject to a narrowly documented legal or security hold.
International transfers
Supabase data is configured in Frankfurt, but supplier support/subprocessors can involve other countries. Resend processes data in the United States, and Vercel or Railway chains may involve non-EEA processing. Contractual safeguards and transfer assessments must be verified before launch.
Rights and complaint
Subject to GDPR conditions, individuals may request access, rectification, erasure, restriction, portability or object and may complain to the Belgian Data Protection Authority. For monitored customer data, contact the customer controller; SHEMANE assists that customer.
Contact and security
The privacy contact is not yet supplied, so commercial launch is blocked. Do not send credentials in support messages. See the Security page for current controls and limitations.
Last substantive version: 2026-09-16. Seek qualified Belgian legal advice before relying on this draft for commercial contracting.