This Privacy Policy explains how Shkirap Inc. ("Shkirap", "we", "us" or "our") collects, uses, shares and protects personal information in connection with Reshape GTM at performance.shkirap.com, including the web application, the public demo and our marketing pages (the "Service"). It should be read together with our Terms of Service.
1. Two roles: customer data and our own data
1.1 Customer Data (we are a processor). Businesses that subscribe to the Service ("Customers") use it to rate and track the performance of their employees, contractors and other team members. Information that a Customer or its users enter about those individuals — such as name, title, team, designation, manager, start date, optional work email, CAGE ratings, quota attainment, notes and summaries ("Employee Data") — is controlled by the Customer. The Customer is the controller (or "business"), and Shkirap is its processor (or "service provider"). We process Employee Data only on the Customer's behalf and instructions, to provide, secure and support the Service. If you are an individual whose information was entered by an employer or manager, please contact that organization to exercise your rights; we will assist our Customers in responding to such requests.
1.2 Account and website data (we are a controller). For information about the people who sign up for and use the Service ("Users") and visitors to our website, Shkirap is the controller and this Policy describes our practices directly.
2. Information we collect
2.1 Account information. Name, work email address, password (stored only as a salted hash by our authentication provider), workspace (company) name, logo you upload, role and membership in a workspace, and invitations you send or receive.
2.2 Terms acceptance. The version of our Terms of Service and Privacy Policy you accepted and the date and time of acceptance.
2.3 Billing information. Plan, billing interval, subscription status and history, and billing contact details. Payment card details are collected and stored by Stripe; we receive only limited information such as card brand, last four digits and expiry, and never your full card number.
2.4 Customer Data. The Employee Data and other content you enter, import (for example by CSV) or generate in the Service, including framework settings, teams, ratings and reports.
2.5 Technical and usage information. When you use the Service, our hosting and infrastructure providers automatically process technical data such as IP address, browser type, device information, pages and API endpoints requested, timestamps and error logs. We use this to deliver, secure and debug the Service.
2.6 Communications. If you contact us, we keep the content of your message and our reply.
We do not knowingly collect information from children, and the Service is not directed to anyone under 16.
3. How we use information
We use personal information to: (a) provide, operate and maintain the Service, including authenticating Users and enforcing workspace access controls; (b) process payments, manage subscriptions and free trials, and prevent fraud; (c) send service communications such as account confirmation, password reset, invitations, security notices, billing notices and changes to our terms; (d) provide support and respond to requests; (e) monitor, secure and improve the Service, including troubleshooting and analyzing aggregated, de-identified usage; (f) record your acceptance of our terms; and (g) comply with law and enforce our agreements.
We process Customer Data only as described in Section 1.1. We do not sell personal information, we do not "share" it for cross-context behavioral advertising, and we do not use Customer Data to train models for other customers or for advertising.
Legal bases (EEA/UK). Where the GDPR or UK GDPR applies to our role as controller, we rely on: performance of a contract (to provide the Service you signed up for); our legitimate interests (to secure, support and improve the Service and communicate with business users, balanced against your rights); compliance with legal obligations (for example, tax and accounting); and consent where required.
4. How we share information
We share personal information only as follows:
- Subprocessors and service providers that help us run the Service, under contracts that require them to protect it and use it only to provide services to us:
| Provider | Purpose | Data |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | Account data, Customer Data, logos |
| Netlify, Inc. | Website and application hosting, serverless functions, delivery network | Technical data; Customer Data in transit |
| Stripe, Inc. | Payment processing, subscriptions and the billing portal | Billing information, account email |
| Resend, Inc. | Transactional email delivery (for example confirmations, password resets and invitations) | Name, email address, message content |
Our pages also load fonts and open-source code libraries from public content-delivery networks (Google Fonts, unpkg and jsDelivr), which receive your IP address and browser information when the page loads. They do not receive Customer Data. - Within your workspace. Information you enter is visible to other authorized users of the same workspace according to their role. - Legal and safety. When we believe in good faith that disclosure is required by law or legal process, or necessary to protect the rights, property or safety of Shkirap, our Customers or others. - Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to this Policy's protections. - Integrations you turn on. If your workspace connects an integration such as Slack, we send the messages you choose (for example, a person's name, placement and CAGE points, or a quarterly team summary) to the destination you configure. That provider handles them under its own terms and privacy policy. You can disconnect at any time in Settings. - With your direction or consent.
5. Cookies and local storage
We use only strictly necessary cookies and similar browser storage (such as local storage) to keep you signed in, remember your selected plan, team filter, quarter and appearance settings, and protect the Service. We do not use advertising or cross-site tracking cookies, and we do not use third-party analytics cookies on the Service. Because these technologies are essential, they do not require consent; you can clear them in your browser, but parts of the Service may stop working.
6. Security
We use reasonable administrative, technical and physical safeguards designed to protect personal information, including TLS encryption in transit, encryption at rest by our hosting providers, row-level access controls that isolate each workspace's data, hashed passwords, least-privilege access for our personnel, and server-side validation of requests. No method of transmission or storage is completely secure. If we learn of a security incident affecting your personal information, we will notify affected Customers and, where required, individuals and regulators.
7. Retention and deletion
- Customer Data is kept while the workspace exists. After a subscription ends the workspace becomes read-only so you can export your data. We delete Customer Data within 30 days of a verified deletion request from the workspace owner, and may delete workspaces with no active subscription for 12 months after notice. Encrypted backups roll off in the ordinary course (typically within a further 30 days).
- Account data is kept while your account is active and deleted on request, subject to the exceptions below.
- Billing records and terms-acceptance records are kept as long as required for tax, accounting, legal or dispute-resolution purposes (generally up to 7 years).
- Technical logs are kept for a limited period by our providers for security and troubleshooting.
8. Your rights
Depending on where you live, you may have the right to: access the personal information we hold about you; correct it; delete it; receive a portable copy; object to or restrict certain processing; withdraw consent where processing is based on consent; and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You can update much of your account information in the app (Settings → Account) and export workspace data at any time.
EEA/UK. You may also lodge a complaint with your local data-protection authority. Where personal information is transferred from the EEA, UK or Switzerland to the United States, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) with our providers.
California (CCPA/CPRA). California residents have the right to know what personal information we collect, use and disclose; to request deletion and correction; and to opt out of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined. We use sensitive personal information (such as account passwords) only to provide the Service, and we will not discriminate against you for exercising your rights. In the past 12 months we collected the categories described in Section 2 (identifiers, commercial information, internet or network activity, and professional or employment-related information entered by Customers) for the business purposes in Section 3, and disclosed them only to the service providers in Section 4.
How to make a request. Email us at the address below. We will verify your request using information associated with your account and respond within the time required by law (for example, 30 days under the GDPR or 45 days under the CCPA). You may use an authorized agent where the law allows. If your request concerns Employee Data entered by your employer, we will refer it to the relevant Customer and assist them as their processor.
Automated decisions. The Service calculates scores and placements from ratings that people enter. It does not make employment decisions; Customers are responsible for meaningful human review of any decision about an individual.
9. International users
The Service is operated from the United States, and our providers process data in the United States and other countries. By using the Service you understand that your information will be processed in those countries, with the safeguards described above.
10. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new version number and effective date and, for material changes, notify Customers by email or in the app before the changes take effect.
11. Contact
Shkirap Inc. · Menlo Park, California, USA Privacy and data-protection requests: neej@shkirap.com