This privacy policy explains which personal data Shypr collects, why we collect it and what your rights are. It applies to our website www.shypr.app, the Shypr app at web.shypr.app, our API and our MCP server.
Who we are
Shypr is located at Schweitzerlaan 24, 1187 JD Amstelveen, The Netherlands. You can contact us at hello@shypr.app.
For the data that we collect about visitors of our website and holders of a Shypr account, Shypr is the controller under the General Data Protection Regulation (GDPR). For the data that our customers put in their workspace, the customer is the controller and Shypr is the processor. See Data in your workspace.
Data we collect
When you visit our website
Our website does not use analytics, advertising or tracking cookies. Our hosting provider records technical data, such as your IP address and browser type, in server logs. We need these logs to deliver the website and to protect it against abuse.
We store one setting in your browser: whether you chose the light or the dark theme. This setting does not leave your device.
When you send us a message
When you use the contact form, we receive your name, email address and message. We also receive your company name and phone number if you give them. We use these details only to reply to you and to follow up on your question.
The legal basis is your consent, which you give with the checkbox on the form. You can withdraw your consent at any time.
When you create an account
When you register, we collect your name, email address, password and the details of your workspace. We store your password only in encrypted (hashed) form. If you sign in with Google or Microsoft, we receive your name and email address from that provider. If you use a passkey, we store only its public key.
We use this data to give you access to Shypr, to secure your account and to send you messages about the service, such as password resets and important changes. The legal basis is the performance of our agreement with you.
When you use the app
We record technical and usage data, such as IP addresses, sign-in times and error reports. The audit log of your workspace records which user changed what, and when. We use this data to keep Shypr secure and reliable, to find and fix errors and to answer your support questions. The legal basis is our legitimate interest in a secure service that works well.
When you use the AI assistant
When you ask the AI assistant a question, we send your question and the workspace data that is necessary to answer it to OpenAI, which generates the answer. The assistant asks for your approval before it changes data in your workspace.
Data in your workspace
Our customers use Shypr to manage their business. Their workspace can contain personal data, such as the names and contact details of their customers, suppliers and contacts. The customer decides which data goes into the workspace and why.
For this data, the customer is the controller and Shypr is the processor. We process the data only to provide Shypr to the customer, and only on the customer's instructions. Our Terms of Service describe how we do this.
Is your data in the workspace of one of our customers, and do you want to use your rights? Then contact that company directly. If you contact us, we forward your request to them.
Who receives your data
We do not sell personal data. We share personal data only with service providers that help us run Shypr. They process the data on our instructions.
- Vercel: hosting of our website and the Shypr web app
- Heroku (Salesforce): hosting of the Shypr app, its database and its background tasks
- Cloudflare: storage of files, such as documents and attachments
- Google: sending emails, and sign-in with a Google account
- Microsoft: sign-in with a Microsoft account
- OpenAI: answers from the AI assistant
- Sentry: error monitoring
- Browserless: creating PDF documents, such as quotes and invoices
- Formspree: the contact form on our website
Some of these providers are located in the United States, or process data outside the European Economic Area (EEA). When data leaves the EEA, we make sure that the transfer is lawful. For example, the provider is certified under the EU-U.S. Data Privacy Framework, or we use the standard contractual clauses of the European Commission.
When you connect another service to your workspace, data goes to that service on your instructions. Examples are a Mollie account for payment links, or an AI agent that connects through our API or MCP server. The terms and privacy policy of that service apply.
We also share data when the law requires it.
How long we keep your data
- Contact messages: as long as we need them to answer your question and to handle any follow-up.
- Account data: as long as your account is active.
- Workspace data: as long as the workspace is active. After a workspace closes, we delete its data as described in our Terms of Service. Copies in backups are deleted when the backups expire.
- Logs and error reports: only as long as we need them for security and to find and fix errors.
We keep data longer only when the law requires it, for example for tax purposes.
How we protect your data
All data between your browser and Shypr is encrypted (HTTPS). The workspace owner decides which users can see and change which data. We back up data automatically. Only authorized people at Shypr can access our production systems.
Your rights
Under the GDPR, you have the right to:
- get access to the personal data that we have about you;
- correct data that is wrong or incomplete;
- have your data deleted;
- limit how we use your data;
- object to processing that is based on our legitimate interest;
- receive your data in a format that a computer can read (data portability);
- withdraw your consent at any time, when processing is based on consent.
To use a right, send an email to hello@shypr.app. We reply within one month. Before we act on your request, we can ask you to prove your identity.
You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the data protection authority in your country.
Changes to this policy
We can change this policy. The date at the top of this page shows when we last changed it. If a change is important, we tell account holders by email before the change takes effect.
Contact
Do you have a question about this policy? Send an email to hello@shypr.app, or write to Shypr, Schweitzerlaan 24, 1187 JD Amstelveen, The Netherlands.