Privacy Policy

1. Introduction

Shamely ("we," "our," or "the Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our accountability platform ("the Service").

Given the sensitive nature of accountability and personal development data, we apply heightened security standards inspired by healthcare data protection principles.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, payment information
• Profile Information: Username, profile photo, timezone
• Commitment Data: Goals you set, vices you're addressing, stake amounts
• Consent Records: Video attestations, signed agreements, consent timestamps
• Guardian Information: Contact information for accountability partners you designate

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type
• Usage Data: Check-in records, app interactions, feature usage
• Location Data: Approximate location (for jurisdiction compliance)
• Log Data: IP address, access times, pages viewed

2.3 Sensitive Information

We may process sensitive information related to your personal development journey, including information about habits or behaviors you wish to change. This data is processed only with your explicit consent and is subject to enhanced protection.

3. How We Use Your Information

We use your information to:

• Provide the Service: Execute your accountability commitments as you designed them
• Process Transactions: Handle financial stakes and settlements
• Facilitate Guardian Relationships: Connect you with your designated accountability partners
• Improve the Service: Analyze usage patterns to enhance features
• Communicate: Send notifications about your commitments and account
• Ensure Safety: Detect fraud and protect users
• Legal Compliance: Meet regulatory obligations

4. Legal Basis for Processing (GDPR)

For users in the EEA/UK, we process your data based on:

• Contract Performance: To deliver the accountability services you requested
• Consent: For optional features like community participation
• Legitimate Interests: For service improvement and security
• Legal Obligation: To comply with applicable laws

5. Data Sharing and Disclosure

5.1 Guardians (With Your Consent)

We share relevant accountability information with Guardians you have designated, but only after they have opted-in to receive such communications.

5.2 Service Providers

We use third-party providers for payment processing, cloud hosting, and analytics. These providers are contractually bound to protect your data.

5.3 Community Features (Opt-In Only)

If you choose to participate in community features like the Wall of Shamely, certain information you share will be visible to other users. This is entirely optional.

5.4 Legal Requirements

We may disclose information if required by law, court order, or to protect the safety of our users or the public.

5.5 We Never Sell Your Data

6. Data Security

We implement robust security measures including:

• Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.3)
• Access Controls: Role-based access with multi-factor authentication
• Audit Logging: Comprehensive logs of data access
• Regular Audits: Periodic security assessments and penetration testing
• Secure Infrastructure: Hosted on SOC 2 compliant cloud providers

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specific retention periods:

• Account Data: Duration of account plus 3 years
• Transaction Records: 7 years (legal requirement)
• Consent Records: 7 years (legal protection)
• Usage Logs: 90 days

Upon account deletion, personal data is anonymized or deleted within 30 days, except where retention is required by law.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data (subject to legal obligations)
• Portability: Receive your data in a structured format
• Restrict Processing: Limit how we use your data
• Object: Object to certain processing activities
• Withdraw Consent: Revoke consent for optional processing

8.1 Important Note on Withdrawal

If you withdraw consent or request deletion during an active commitment with financial stakes, this may constitute a breach of your commitment agreement and result in forfeiture of your stake as specified in our Terms of Service. The financial consequence is a contractual matter, not a data processing matter.

9. International Data Transfers

Your data may be transferred to and processed in the United States. For EEA/UK users, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection.

10. Children's Privacy

Shamely is not intended for users under 18. We do not knowingly collect data from minors. If we learn that a minor has provided information, we will delete it promptly.

11. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites.

12. Cookies and Tracking

We use cookies and similar technologies for authentication, preferences, and analytics. You can manage cookie preferences through your browser settings.

13. California Privacy Rights (CCPA/CPRA)

California residents have additional rights including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification. Continued use after changes constitutes acceptance.

15. Contact Us

For privacy inquiries or to exercise your rights, contact our Data Protection Officer:

• Email: privacy@shamely.com

For EEA/UK users: You also have the right to lodge a complaint with your local Data Protection Authority.