Privacy Policy

As a controller, we process personal data about Site visitors, prospects who book a walkthrough, and account users.

As a processor, we process personal data contained in client data that the Service connects to and analyses for the client.

Appunite S.A. operates the Shugyo product. It is the controller of Site and account data and the processor of client data. Appunite S.A. is a joint-stock company organized under the laws of Poland.

• Registered office: Droga Debinska 3A/3, 61-555 Poznan, Poland
• Court register (KRS): 0000964739
• VAT ID (NIP): PL 7831812112
• Contact for privacy matters: privacy@empowered.house

We have appointed Karol Wojtaszek as our Data Protection Officer. You can contact him at privacy@empowered.house.

We collect identity and contact data through the Site and walkthrough booking, including your name, work email, company, and role. We also collect information you provide about your organization and data sources, plus technical and usage data such as your IP address, device and browser data, and interactions recorded through cookies and similar technologies.

For account and pilot users, we collect account data such as name, work email, role, and authentication data. We also collect product usage data, including queries run, features used, and logs needed to operate and secure the Service.

Our legal bases are pre-contract steps and contract performance; legitimate interests in running, securing, and improving the Site and Service; consent for non-essential cookies and any marketing; and legal obligations such as accounting.

When a client connects Shugyo to its data, such as a Google BigQuery dataset, the Service builds a semantic model or digital twin over the data and runs analytical queries against it. The connected data may contain personal data about the client's employees, customers, or contacts.

• The client is the controller and decides what data is connected and why.
• Shugyo acts as a processor and processes the data only on the client's documented instructions, as set out in the Data Processing Agreement between us.
• We do not use client data to train models or for any purpose other than providing the Service on the client's instructions.

The Service uses AI models to interpret the ontology and answer queries about connected data. Queries are sent to Anthropic, which provides Claude models and acts as a sub-processor under contractual terms.

Anthropic is based in the United States. Under those terms, client data sent in prompts is not used to train Anthropic's models.

The Service is built so that client data can stay in the client's chosen region. Client data analysed through BigQuery is kept in an EU region by default; other regional or dedicated hosting arrangements are available for regulated clients on request.

Answering a query may still involve sending relevant data to the AI sub-processor described above, which processes it in the United States under appropriate safeguards.

The Site uses strictly necessary cookies to function. Only where you consent, we use PostHog for product and usage analytics; you can grant, decline, or withdraw consent through the cookie banner and your browser.

We also use Snitcher, a business-visitor identification service that uses your IP address to identify the company or organization behind a visit. It identifies the business, not you as an individual, and sets one cookie, SNID, to distinguish visitors. Snitcher processes data within the EU (AWS, Frankfurt).

We share personal data with the following recipients:

• Service providers and sub-processors that help us run the Site and Service. These include Anthropic for AI models, PostHog for analytics, Snitcher for business-visitor identification, and our hosting, cloud-infrastructure, email, and scheduling providers.
• Professional advisers when necessary.
• Public authorities when required by law.

We do not sell personal data.

Some sub-processors may process data outside the European Economic Area. These include Anthropic in the United States and, depending on the configured region, PostHog. Snitcher processes data within the EU (AWS, Frankfurt). For processing outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as the Standard Contractual Clauses. Details are available on request and in the DPA.

• Site and walkthrough enquiry data: kept for up to 24 months after last contact, unless you ask us to delete it sooner.
• Account data: kept for the life of the account and a limited period afterwards.
• Client data processed as a processor: retained and deleted as set out in the DPA, including return or deletion on termination.
• Logs and security data: kept for up to 14 months.

We maintain technical and organizational measures appropriate to the risk. Access to client data is controlled at the data-source level, for example BigQuery roles, with access controls, encryption in transit, and logging.

We are working toward recognized certifications, including SOC 2 and ISO/IEC 27001; we do not yet hold either certification. Current status and any available reports can be requested at privacy@empowered.house.

If we are the controller of your data, you have rights to access, rectification, erasure, restriction, objection, and portability. You may also withdraw consent where processing is based on it. To exercise a right, contact privacy@empowered.house.

If your personal data is part of a client's connected data, the client is the controller; please direct your request to that client, and we will assist them as required by the DPA.

You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, or with the authority in your country of residence.

The Service is a business product and is not directed at children. We do not knowingly collect data from children under 16.

We may update this policy. The current version and its effective date are posted on this page; material changes will be made clear.

Send privacy questions to privacy@empowered.house. Shugyo is built by EmpoweredHouse, an Appunite venture.