Privacy Policy.

Who is the controller.

SHIFT (Riga, Latvia) is the data controller for ARK. Contact: hello@shift.studio.

What we store.

• Account: email and hashed password.
• Profile: name, role, industry, hated task, language, level, streak.
• Records: your notes, reps, captured artefacts.
• Team data: memberships and (only when explicitly shared) shared records.
• Product analytics: anonymised event names for reliability and roadmap.
• Billing: customer id, subscription status, invoices (via Stripe when enabled).

Lawful bases.

Contract (running your account and paid plan), legitimate interest (product analytics and security), consent (optional emails/telegram nudges), legal obligation (invoices).

Retention.

Account and record data: for as long as your account exists, plus 30 days after deletion request. Invoices: 7 years (legal requirement). Product analytics: 24 months, aggregated.

Processors (subprocessors).

Our full current list lives at /legal/subprocessors. In summary: managed infrastructure (Supabase / Lovable Cloud) in the EU region for database, auth and storage; a server-side AI gateway when you use AI features; Stripe for billing (when connected); Resend for transactional email (when connected); Telegram for capture (when linked by you).

Your rights (GDPR).

Access, rectification, erasure, portability, restriction, objection. Use "EXPORT MY DATA" inside settings, or contact hello@shift.studio. You can also complain to your local data-protection authority.

Security.

See /security: TLS in transit, encryption at rest by the infrastructure provider, row-level security on every table, server-side AI calls only, no training of external models on customer data.

Children.

ARK is not intended for people under 16.