Legal

Privacy Policy

Effective September 14, 2026

What we collect

• Your email address — required to deliver your matrix and receipt, and to answer refund requests.
• The documents you upload and the text, requirements and metadata extracted from them.
• Payment data — handled entirely by Stripe. We never see your card number; we receive a payment confirmation, the amount, and your email.
• Technical logs — timestamps, job status, error messages and anonymous usage counts needed to run and debug the service.

How we use it

Only to build and deliver your compliance matrix, process payment, provide support and refunds, and keep the service secure. We do not sell personal data and we do not use your documents to train machine-learning models.

Processors

• Google Cloud / Firebase (United States) — encrypted storage of files, extracted text and job records.
• Anthropic (United States) — the language model that reads your document text to extract requirements. Anthropic does not train on API inputs.
• Stripe — payments and receipts.
• Resend — delivery emails.
• Vercel — hosting.

Retention

Uploaded files, extracted text, results and the Excel file are deleted automatically 30 days after upload. Job records (email, status, timestamps, payment reference) are kept for accounting purposes as required by law. You may ask us to delete your data earlier by replying to any Shallist email.

Security

Data is encrypted in transit (TLS) and at rest. Results are reachable only through a private, unguessable link; treat that link like a password. We recommend not uploading classified information.

Cookies and analytics

Shallist sets no advertising cookies. We may use privacy-preserving, cookie-free page analytics to count visits.

Your rights

You can request access to, correction of, or deletion of your personal data at any time by replying to a Shallist email. We answer within 30 days.

Changes

We will post any changes to this page with a new effective date.