Privacy Policy
Version 1.2, effective 4 Nov 2026
This policy explains what Shyft Studio (trading as Shyft AI Studio, "Shyft AI", "we") collects when you use shyftai.in, Shyft Social or any other Shyft AI product, or chat with us on WhatsApp or email, why we use it, and the choices you have.
1. What we collect
What you give us
- Your name, email, business name and WhatsApp number
- Your Google account name, email and profile photo, if you sign up with Google
- Your password, stored in encrypted form by our sign-in provider. We can't see it
- What you tell us in chat, such as your goals, prices, offers and the competitors you name
- Photos, videos, logos and other files you upload
- Your messages to our support team, and any feedback
Public information we read for you
- Your Google Business listing, your website, and your public Instagram and Facebook profile and posts
- The public posts and profiles of competitors you name
What we collect as you use Shyft Social
- Your device and browser type, IP address, and the pages and actions you use in the app, with times
- Error and security logs
- Cookies needed to keep you signed in, and to understand how the product is used
Payments
- Your plan, amounts, dates, payment status and Razorpay reference numbers. Razorpay collects your card, UPI or bank details. We never see them.
As Shyft Social grows, the same rules will cover:
- people you invite to your account, such as staff, and people you refer to us
- billing details, such as your GSTIN and billing address
- accounts you connect, such as Instagram, Facebook or Google Business, and what they share with us, such as account details and post performance
- your chats with us on WhatsApp, including voice notes, photos and videos you send
- videos, clips and audio you send us for reels and other content
2. Why we use it
| Purpose | What it covers | Basis |
|---|---|---|
| Make and deliver your content | Brand kit, plans, captions, designs, images, reels, and posting for you once you connect an account. In other Shyft AI products you use: assets for your business such as a website, deck, proposal, invoice or notes, made from the same brand kit and details | You gave it to us for this |
| Tell you about your posts and plan | WhatsApp and email: a post is ready, a post is due today, payment and account notices | You gave us your number for this |
| Run your account and billing | Sign-in, plan limits, payments, invoices | You gave it to us for this |
| Support | Answering your questions and fixing problems | You gave it to us for this |
| Keep Shyft Social safe | Preventing abuse, fraud and spam, rate limits, security logs | You gave it to us for this |
| Improve Shyft Social | Reviewing the quality of posts and the edits you make, fixing bugs, understanding usage | You gave it to us for this |
| Tips and offers | Shyft AI news, tips, festival offers and other Shyft AI products, on WhatsApp and email. Reminders that more posts in your plan are ready to make, only if you say yes when asked | Only if you tick the box |
| Following the law | Tax records, legal requests | Required by law |
We don't sell your data. We don't use your content to train our own AI models. Where an AI provider lets us switch off training on your data, we switch it off.
Information you or anyone else has made public is not covered by India's data protection law. We still treat it with the same care.
3. Who we share it with
We use service providers for the jobs below, and share only what each one needs to do its job for us:
| What they do | Providers we use today |
|---|---|
| Hosting, database, file storage and sign-in | Supabase, Amazon Web Services |
| AI that writes text and makes images and videos | Groq, OpenRouter, Google Gemini |
| Reading public web and social pages | Apify |
| Payments and invoices | Razorpay |
| Messaging | Meta (WhatsApp), email providers |
| Analytics, error tracking and support tools | As we add them |
We may add or change providers for these jobs. Each one only gets what it needs, and must keep it secure.
We may also share data if the law requires it, to protect our rights or users' safety, or with a buyer if our business is sold. The buyer would have to follow this policy.
4. Where your data is stored
- Your account, chats, brand kit, posts and files: Supabase, in Singapore.
- The Shyft Social app itself: Amazon Web Services, in Mumbai, India.
- AI that writes text and makes images: Groq, OpenRouter and Google Gemini process each task, mostly in the United States. They get only what that task needs, never your password.
- Reading public web and social pages: Apify, outside India.
Indian law allows this transfer. We pick providers with strong security, and we'll update this section before any of these places change.
5. How long we keep it
- While your account is open.
- After you close your account, we delete your data within 1 year.
- We keep payment and invoice records for as long as tax law requires.
- We keep a record of the consents you gave, and when, for 3 years after you close your account.
- Backups clear themselves within 30 days of a deletion.
6. How we protect it
We encrypt data in transit, keep each business's data separate from others, and limit who on our team can access it. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.
7. Your choices and rights
You can:
- ask what data we hold about you and who we've shared it with
- correct or update it
- ask us to delete it (section 8 explains how)
- withdraw any consent you gave. Reply STOP on WhatsApp or write to us. Withdrawing is as easy as giving it, and doesn't affect what we did before
- name someone to use these rights for you if you die or can't act
- complain to our Grievance Officer, and then to the Data Protection Board of India
Write to help@shyftaistudio.com or WhatsApp +91 82084 79978. We'll reply within 30 days.
8. How to delete your data
You can remove Shyft Social's access and delete your data at any time, including the data we get from Facebook and Instagram:
- Delete your account in Shyft Social: open the menu, then Account & connections, then Delete my account, and type DELETE to confirm. We delete your business, chats, posts and files, your sign-in, and your Facebook and Instagram connections, including their access tokens, straight away. This can't be undone, so download your data first if you want a copy.
- Remove us from Facebook: on Facebook, go to Settings & privacy, then Settings, then Business integrations (or Apps and websites), choose Shyft Social and tap Remove. This stops our access to your Facebook Page and Instagram account. To also delete what we already hold, use one of the other two options here.
- Ask us to delete it: email help@shyftaistudio.com with the subject "Delete my data". We'll delete your Facebook and Instagram data (access tokens, Page and account details, and post content we got from them) within 30 days, and confirm by email.
9. Children
Shyft Social is for people 18 and over. If we learn we have data from someone younger, we'll delete it.
10. Changes to this policy
If we make an important change, we'll tell you by email, WhatsApp or in the app before it applies. Each version has a date at the top.
11. Grievance Officer
Samruddhi Bothara · samruddhi@shyftaistudio.com · Shyft Studio, 16/3, E-2 Poonam Chambers, Erandwane, Karve Road, Pune 411004