Privacy and Cookies

Shoten AI Technologies Private Limited ("Shoten AI", "we", "us") provides an intelligence layer that connects a company's departments, knowledge bases and agents so that decisions can be monitored, made and acted on. This policy explains what personal data we handle when you visit our website or use the platform, why we handle it, and what you can ask us to do about it.

For personal data about our own customers, prospects and website visitors, we act as the data controller. For personal data contained inside the business data a customer connects to the platform, the customer is the controller and we act as a processor under their instructions and our services agreement.

You can reach us about anything in this policy at palshubham8960@gmail.com.

We collect three broad categories of data, and we try to keep each of them to what the service actually needs.

• Account and contact data. Name, work email, phone number, company name, job title, billing details, and the contents of enquiries you send us.
• Customer business data. The documents, records, tickets, metrics and system data a customer connects to their knowledge base, together with the decisions, approvals and agent actions produced by the layer. This may incidentally contain personal data about a customer’s own staff or customers.
• Usage and technical data. IP address, browser and device type, pages viewed, referring page, feature usage, performance timings, and error logs.

We do not ask for, and ask that you do not upload, special category data such as health records or biometric identifiers unless it has been agreed in writing and covered by an appropriate data processing agreement.

• To provide the platform: building and maintaining the knowledge base, running agents, producing decisions and routing approvals.
• To authenticate users, apply approval tiers and keep an audit record of what the layer decided and who approved it.
• To support you, investigate issues and respond to enquiries.
• To bill you and keep accounting records.
• To monitor reliability, diagnose faults and improve performance.
• To send service notices, and, where you have agreed or where we are permitted to, occasional product updates. You can opt out of marketing at any time.
• To detect abuse and to meet legal, tax and regulatory obligations.

Where the UK GDPR or EU GDPR applies, we rely on the following bases.

• Performance of a contract, for providing the platform and supporting your account.
• Legitimate interests, for securing the service, preventing abuse, improving reliability and communicating with business contacts about the product, balanced against your rights.
• Consent, for non-essential cookies and for marketing email where consent is required. You may withdraw consent at any time.
• Legal obligation, for tax, accounting and lawful requests from authorities.

We do not use customer business data to train foundation models, and we do not permit our model providers to train on it either. Data sent to a model provider for inference is transmitted under zero-retention or limited-retention terms.

Within a customer’s own workspace, the layer does learn from outcomes: feedback on a decision improves later decisions for that customer. That learning stays inside the customer tenancy and is never pooled across customers.

If we ever want to use customer data to improve a shared model, we will ask for explicit opt-in first, and not using it will never degrade the service you pay for.

We do not sell personal data. We share it only with the service providers needed to run the platform, each under a written agreement with confidentiality and security obligations.

• Cloud hosting and storage, for running the platform and holding your data at rest.
• Model providers, for inference, under zero-retention or limited-retention terms.
• Payment processing, for subscriptions and invoices. We do not store full card numbers.
• Product analytics and error monitoring, for reliability and usage insight.
• Email and support tooling, for service notices and correspondence.

A current list of sub-processors is available on request, and customers on an annual plan are given advance notice of additions so they can object.

We may also disclose data where we are legally required to, or in connection with a merger or acquisition, in which case we will tell affected customers before their data becomes subject to a different policy.

• Account data: for the life of the account, then up to 12 months after closure.
• Customer business data: for the life of the subscription. On termination it is deleted or returned within 30 days, unless you ask us in writing to do so sooner.
• Decision and approval audit records: retained for the contracted audit period, since their value is in being complete.
• Billing and tax records: as long as tax law requires, typically up to 8 years.
• Support correspondence: up to 24 months after the conversation closes.
• Server and security logs: up to 12 months.

• Encryption in transit with TLS, and at rest with AES-256.
• Logical tenant isolation, so one customer’s knowledge base is never queryable from another.
• Role-based access control and least privilege for our own staff, with access reviewed periodically.
• Audit logging of decisions, approvals and agent actions.
• Secrets management, dependency scanning and periodic penetration testing.
• A documented incident response process. Where a breach is likely to affect your rights, we notify affected customers and the relevant supervisory authority without undue delay.

No system is perfectly secure, and we do not claim otherwise. We aim to reduce risk and to be straightforward with you when something goes wrong.

We are based in India and use providers located in India, the European Economic Area and the United States. Where personal data moves out of the UK or EEA, we rely on adequacy decisions where they exist, and otherwise on Standard Contractual Clauses together with additional technical measures.

Enterprise customers with data residency requirements can ask about a region-pinned or in-VPC deployment.

Depending on where you live, you may have some or all of the following rights.

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete data, where we have no overriding obligation to keep it.
• Restrict or object to processing, including profiling and direct marketing.
• Portability, to receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.

If you are a California resident, you also have the right to know what is collected, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA.

Write to palshubham8960@gmail.com to exercise any of these. We will respond within 30 days. If the data sits inside a customer’s workspace, we will route your request to that customer, since they control it. You may also complain to your local supervisory authority.

We use cookies and similar technologies to keep the site working, remember your preferences and understand how the site is used. Strictly necessary cookies are set automatically. Everything else is set only after you agree.

The table below describes the categories we use. You can change your choice at any time, and you can block or delete cookies in your browser settings. Blocking strictly necessary cookies will break parts of the site.

The platform is a business product and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We update this policy as the product and the law change. The date at the top of this page always reflects the current version. If a change materially affects your rights we will tell you by email or in the product before it takes effect.

Questions, requests or complaints about privacy can go to palshubham8960@gmail.com, or by phone on +91 81276 65063.

• Shoten AI Technologies Pvt. Ltd.
• WeWork Galaxy, 43 Residency Road
• Bengaluru, Karnataka 560025
• India