Privacy Policy

When we act as a controller, this policy covers visitors to the Site, prospects who book a walkthrough, and account users.

When we act as a processor, this policy covers personal data contained in client data that the Service connects to and analyses on the client's behalf.

The controller for Site and account data, and processor for client data, is Appunite S.A. operating the Shugyo product, a joint-stock company organized under the laws of Poland.

• Registered office: Droga Debinska 3A/3, 61-555 Poznan, Poland
• Court register (KRS): 0000964739
• VAT ID (NIP): PL 7831812112
• Contact for privacy matters: privacy@empowered.house

We have appointed a Data Protection Officer, Karol Wojtaszek, whom you can reach at privacy@empowered.house.

From the Site and walkthrough booking, we collect identity and contact data such as name, work email, company, and role; information you share about your organization and data sources; and technical and usage data such as IP address, device and browser data, and interactions collected through cookies and similar technologies.

From account and pilot users, we collect account data such as name, work email, role, and authentication data, plus product usage data such as queries run, features used, and logs needed to operate and secure the Service.

Legal bases include pre-contract steps and performance of contract, legitimate interests in running, securing, and improving the Site and Service, consent for non-essential cookies and any marketing, and legal obligations such as accounting.

When a client connects Shugyo to its data, for example a Google BigQuery dataset, the Service builds a semantic model or digital twin over that data and runs analytical queries against it. That data may contain personal data relating to the client's employees, customers, or contacts.

• The client is the controller and decides what data is connected and why.
• Shugyo acts as a processor and processes the data only on the client's documented instructions, as set out in the Data Processing Agreement between us.
• We do not use client data to train models, and we do not use it for any purpose other than providing the Service on the client's instructions.

The Service uses AI models to interpret the ontology and answer queries about connected data. Queries are sent to Anthropic, which provides Claude models and acts as a sub-processor under contractual terms.

Anthropic is based in the United States. Under those terms, client data sent in prompts is not used to train Anthropic's models.

The Service is built so that client data can stay in the client's chosen region. Client data analysed through BigQuery is kept in an EU region by default; other regional or dedicated hosting arrangements are available for regulated clients on request.

Answering a query may still involve sending relevant data to the AI sub-processor described above, which processes it in the United States under appropriate safeguards.

The Site uses strictly necessary cookies to function. Only where you consent, we use PostHog for product and usage analytics; you can grant, decline, or withdraw consent through the cookie banner and your browser.

We also use Snitcher, a business-visitor identification service that uses your IP address to identify the company or organization behind a visit. It identifies the business, not you as an individual, and sets one cookie, SNID, to distinguish visitors. Snitcher processes data within the EU (AWS, Frankfurt).

We share personal data with:

• Sub-processors that help us run the Site and Service, namely Anthropic for AI models, PostHog for analytics, and Snitcher for business-visitor identification, together with our hosting and cloud-infrastructure, email, and scheduling providers.
• Professional advisers where necessary.
• Authorities where required by law.

We do not sell personal data.

Some sub-processors, including Anthropic in the United States and, depending on the region configured, PostHog, may process data outside the European Economic Area. Snitcher processes data within the EU (AWS, Frankfurt). Where a sub-processor processes data outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as the Standard Contractual Clauses. Details are available on request and in the DPA.

• Site and walkthrough enquiry data: kept for up to 24 months after last contact, unless you ask us to delete it sooner.
• Account data: kept for the life of the account and a limited period afterwards.
• Client data processed as a processor: retained and deleted as set out in the DPA, including return or deletion on termination.
• Logs and security data: kept for up to 14 months.

We maintain technical and organizational measures appropriate to the risk. Access to client data is controlled at the data-source level, for example BigQuery roles, with access controls, encryption in transit, and logging.

We are working toward recognized certifications, including SOC 2 and ISO/IEC 27001; we do not yet hold either certification. Current status and any available reports can be requested at privacy@empowered.house.

If we are the controller of your data, you have the rights to access, rectification, erasure, restriction, objection, and portability, and to withdraw consent where processing is based on it. To exercise a right, contact privacy@empowered.house.

If your personal data is part of a client's connected data, the client is the controller; please direct your request to that client, and we will assist them as required by the DPA.

You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, or with the authority in your country of residence.

The Service is a business product and is not directed at children. We do not knowingly collect data from children under 16.

We may update this policy. The current version and its effective date are posted on this page; material changes will be made clear.

Privacy questions: privacy@empowered.house. Shugyo is built by EmpoweredHouse, an Appunite venture.