We take the protection of your personal data seriously. This notice explains what data we process when you visit shama.ai or contact us, on which legal basis under the EU General Data Protection Regulation (GDPR), and which rights you have.
1. Controller
Shama AI®
Hackenberggasse 37/1/14, 1190 Vienna, Austria
Email: inquiry@shama.ai
2. Hosting and server logs
When you visit this website, our servers automatically process connection data that your browser transmits (IP address, date and time of the request, requested page, browser type and version, operating system). This data is technically necessary to deliver the website and to ensure its stability and security (Art. 6(1)(f) GDPR — legitimate interest). Server logs are deleted automatically after a short retention period and are not merged with other data sources.
3. Cookies and consent
We use a consent banner that lets you decide which non-essential cookies may be set. Strictly necessary storage (your cookie choice itself, your light/dark theme preference) is used on the basis of Art. 6(1)(f) GDPR and § 165(3) TKG 2021 and requires no consent. All other categories are used only with your consent (Art. 6(1)(a) GDPR), which you can revoke at any time with effect for the future via — also available in the page footer. Your consent decision (a random identifier, the timestamp, and the granted categories — never your name) is logged server-side as proof of consent (Art. 7(1) GDPR) and retained for as long as required for accountability.
4. Google Analytics 4
With your consent (Art. 6(1)(a) GDPR) we use Google Analytics 4, a web-analytics service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse how visitors use the site. We have configured Google Consent Mode v2 with a default of “denied”: no Analytics cookies are set and no measurement data is transmitted before you consent. IP addresses are processed in truncated form by GA4. Data may be transferred to Google LLC in the USA; such transfers are based on your explicit consent (Art. 49(1)(a) GDPR) and Google's certification under the EU-U.S. Data Privacy Framework. Consent is not a condition for using this website. You can withdraw your consent at any time via .
5. Contact form and email
If you contact us via the contact form or by email, we process the data you provide (name, email address, company, subject, message) to handle your enquiry (Art. 6(1)(b) GDPR — pre-contractual steps, or Art. 6(1)(f) GDPR — legitimate interest in answering enquiries). Submissions are stored in our content-management system and forwarded to our mailbox. We retain enquiries only as long as needed to process them and for any follow-up questions, unless statutory retention duties require longer storage.
6. Google reCAPTCHA
To protect the contact form against abuse and automated spam we may use Google reCAPTCHA (Google Ireland Ltd.). reCAPTCHA analyses signals such as IP address, browser information and interaction behaviour to distinguish humans from bots. This processing serves our legitimate interest in protecting the site against abuse (Art. 6(1)(f) GDPR). Where reCAPTCHA is active, Google's Privacy Policy and Terms of Service apply.
7. Job applications
If you apply for a position, we process your application data (contact details, CV, message) exclusively for the recruitment process (Art. 6(1)(b) GDPR). Application documents are deleted no later than six months after the process ends, unless you consent to a longer retention for future openings.
8. Recipients and transfers
Within our organisation, only persons who need your data to fulfil the purposes above have access to it. Processors we use (hosting, email delivery, analytics as described) are bound by data-processing agreements pursuant to Art. 28 GDPR. Transfers to third countries take place only as described in this notice or where required by law.
9. Your rights
- Access (Art. 15 GDPR) to the data we hold about you;
- Rectification (Art. 16 GDPR) of inaccurate data;
- Erasure (Art. 17 GDPR);
- Restriction of processing (Art. 18 GDPR);
- Data portability (Art. 20 GDPR);
- Objection (Art. 21 GDPR) to processing based on legitimate interest;
- Withdrawal of consent (Art. 7(3) GDPR) at any time, with effect for the future, without affecting the lawfulness of processing before withdrawal.
To exercise these rights, contact us at inquiry@shama.ai. You also have the right to lodge a complaint with a supervisory authority — in Austria the Datenschutzbehörde (dsb.gv.at), Barichgasse 40-42, 1030 Vienna.
10. Changes to this policy
We may update this privacy policy when the website or the legal situation changes. The version published on this page applies.