1.1This Privacy Policy explains how Shape01 collects, uses, stores, processes, shares, protects, and otherwise handles personal information in connection with the Shape01 platform, including its website, mobile applications, artificial intelligence features, health and lifestyle tools, communications, integrations, and related services.
1.2Shape01 is an AI-powered health and lifestyle operating system designed to assist users with fitness, nutrition, habits, planning, tracking, motivation, wellness, and personalized lifestyle guidance.
1.3This Privacy Policy applies when you access or use Shape01, create an account, communicate with Shape01, interact with artificial intelligence features, connect third-party services, subscribe to paid features, or otherwise provide information through the Service.
1.4This Privacy Policy should be read together with the Shape01 Terms of Use and any additional privacy notices presented in connection with specific features.
1.5Certain features may involve additional disclosures, permissions, or consent mechanisms where required by applicable law.
1.6This Privacy Policy does not govern independent third-party services that may be accessible through or integrated with Shape01 and that process information under their own privacy policies.
2Privacy Principles
2.1Shape01 seeks to process personal information in a transparent, proportionate, secure, and purpose-specific manner.
2.2Shape01 seeks to collect information that is reasonably necessary for providing, personalizing, securing, maintaining, and improving the Service.
2.3Where appropriate, Shape01 seeks to distinguish between information required for core functionality and information used for optional features.
2.4Shape01 may apply data minimization, access controls, retention controls, technical safeguards, and other privacy-protective measures appropriate to the nature of the information and processing activity.
2.5Privacy protections may evolve as Shape01 introduces new functionality, technologies, integrations, jurisdictions, and business operations.
3Categories of Information We May Collect
3.1The categories of information collected depend on how you use Shape01 and which features you choose to enable.
3.2Shape01 may collect account and identity information, including your name, email address, account identifier, authentication information, profile information, language, country or region, and other information associated with your account.
3.3Shape01 may collect information you voluntarily provide regarding your health, fitness, nutrition, wellness, habits, lifestyle, goals, preferences, routines, schedules, and progress.
3.4Such information may include, where relevant to features you choose to use, age or age range, sex or gender-related information, height, weight, body measurements, fitness level, training experience, goals, dietary preferences, food-related information, allergies, intolerances, injuries, limitations, health considerations, sleep-related information, hydration, activity information, and similar information.
3.5Depending on the functionality available and your choices, some information processed by Shape01 may constitute health-related, sensitive, special-category, or otherwise protected personal information under applicable law.
3.6Shape01 may collect conversational information, including messages, questions, instructions, responses, feedback, and other content exchanged with AI or conversational features.
3.7Shape01 may collect workout and physical-activity information, including exercises, sets, repetitions, duration, intensity, completion history, training preferences, and progress.
3.8Shape01 may collect nutrition-related information, including meals, foods, ingredients, nutritional estimates, dietary goals, meal history, food preferences, and related entries.
3.9Shape01 may collect habit and lifestyle information, including routines, goals, completion records, reminders, preferences, and behavioral patterns generated through use of the Service.
3.10Shape01 may collect technical information, including device type, operating system, application version, browser information, language settings, IP address, approximate location derived from IP where permitted, device identifiers, crash information, diagnostics, and network information.
3.11Shape01 may collect usage information, including features accessed, screens viewed, interactions, session information, timestamps, performance information, navigation patterns, and other events generated through use of the Service.
3.12Shape01 may receive transaction-related information when you purchase a subscription or paid feature. Payment card information may be processed directly by payment processors or application stores rather than stored by Shape01.
3.13Shape01 may collect communications sent to support, security, privacy, legal, feedback, or other official channels.
4Information You Provide Directly
4.1You may provide personal information when creating or updating an account, completing onboarding, defining goals, using health and lifestyle features, communicating with AI features, entering measurements, recording meals or workouts, configuring preferences, contacting support, or using other interactive functionality.
4.2You are not required to provide information that is unrelated to the functionality you wish to use unless required for legal, security, billing, or operational purposes.
4.3Certain features may not function properly, or may provide less personalized results, if relevant information is not provided.
4.4You should avoid providing information that is unnecessary for the feature or request you are using.
4.5You are responsible for ensuring that information concerning another person is provided only where you have an appropriate legal basis or authorization to do so.
5Information Generated Through Use of Shape01
5.1Shape01 may generate information based on your interactions with the Service.
5.2Generated information may include recommendations, plans, summaries, classifications, progress indicators, behavioral insights, estimated metrics, personalization signals, contextual information, and other derived information.
5.3Derived information may be generated using artificial intelligence, deterministic rules, calculations, statistical methods, historical information, or combinations of these technologies.
5.4Generated information may be associated with your account where necessary to provide continuity, personalization, progress tracking, or other requested functionality.
5.5Generated information should not necessarily be interpreted as verified medical, clinical, or factual information.
6Artificial Intelligence Processing
6.1Shape01 uses artificial intelligence and related technologies to provide certain features of the Service.
6.2Information submitted to AI-enabled features may be processed to understand your request, maintain relevant context, generate responses, personalize recommendations, classify information, produce plans, identify relevant patterns, and perform other functions necessary to provide the requested feature.
6.3Shape01 may use different AI models, providers, orchestration systems, deterministic components, safety mechanisms, and internal processing layers depending on the feature and operational requirements.
6.4Where third-party AI infrastructure is used, information may be transmitted to such providers to the extent necessary to generate or process the requested functionality.
6.5Shape01 seeks to limit information transmitted to third-party AI providers to information reasonably necessary for the relevant processing purpose.
6.6The treatment of information by third-party AI providers may also be subject to contractual, technical, security, and data-protection arrangements between Shape01 and those providers.
6.7Shape01 may implement preprocessing, contextual selection, data minimization, structured prompts, output validation, safety controls, or other mechanisms before or after information is processed by an AI system.
6.8AI processing does not mean that every piece of information associated with your account is transmitted to an AI model for every interaction.
7AI Training and Service Improvement
7.1Shape01 may analyze interactions, feedback, performance information, errors, and usage patterns to maintain, evaluate, secure, and improve the Service.
7.2Where personal information is used for product improvement, analytics, quality assurance, or AI-related evaluation, Shape01 will process such information in accordance with applicable law and the purposes described in this Privacy Policy.
7.3Shape01 may use aggregated, anonymized, de-identified, or otherwise non-identifiable information for analytics, research, product development, model evaluation, operational improvement, and statistical purposes.
7.4Where required by applicable law, Shape01 will obtain appropriate consent before using identifiable personal information for purposes that require consent.
7.5Shape01 may implement contractual or technical restrictions concerning the use of information by external AI providers, including restrictions relating to independent model training, where appropriate to the relevant service arrangement.
7.6Users should not assume that every interaction is used to train an AI model. Processing for providing an AI response, maintaining security, evaluating quality, and training a model are distinct activities.
8Contextual Memory and Personalization
8.1Shape01 may maintain contextual memory or structured user context to provide continuity and personalization across interactions.
8.2Contextual memory may include goals, preferences, routines, historical interactions, progress information, relevant health and lifestyle information, and other information considered useful for features you choose to use.
8.3Shape01 may summarize, structure, prioritize, update, merge, or remove contextual information to improve relevance and reduce unnecessary processing.
8.4Contextual memory may be stored separately from complete conversational histories or source information.
8.5Shape01 may use contextual memory to avoid requiring users to repeatedly provide the same information and to improve consistency across sessions.
8.6Contextual memory is not guaranteed to be complete, permanent, or error-free.
8.7Where controls are available, users may be able to review, update, correct, remove, or reset certain stored contextual information.
8.8Certain information may continue to be retained where required for security, legal compliance, fraud prevention, dispute resolution, backup integrity, or other legitimate purposes.
9Health and Sensitive Information
9.1Certain information processed by Shape01 may relate to health, physical condition, nutrition, exercise, lifestyle, or other matters that may receive enhanced legal protection in some jurisdictions.
9.2Shape01 processes such information only for purposes consistent with providing the relevant features, operating the Service, complying with legal obligations, and other purposes permitted under applicable law.
9.3Where applicable law requires explicit consent for processing particular categories of sensitive information, Shape01 will seek such consent before performing the relevant processing.
9.4Users may choose not to provide optional health or sensitive information, although doing so may limit the functionality or personalization of certain features.
9.5Shape01 does not intend users to submit medical records or highly sensitive clinical information unless a feature expressly requests such information and provides appropriate notice.
9.6Shape01 is not intended to function as an electronic medical record system unless expressly stated otherwise.
10Purposes of Processing
10.1Shape01 may process personal information to provide and operate the Service.
10.2Shape01 may process personal information to create, authenticate, administer, and secure user accounts.
10.3Shape01 may process personal information to personalize workouts, nutrition-related functionality, habits, recommendations, plans, conversations, reminders, and other user experiences.
10.4Shape01 may process personal information to maintain contextual continuity across sessions.
10.5Shape01 may process personal information to respond to user requests and generate AI-assisted outputs.
10.6Shape01 may process personal information to calculate, display, organize, and track progress, trends, estimates, and other metrics.
10.7Shape01 may process personal information to provide customer support and respond to communications.
10.8Shape01 may process personal information to process subscriptions, transactions, entitlements, refunds, and billing-related matters.
10.9Shape01 may process personal information to detect, investigate, prevent, and respond to fraud, abuse, security incidents, unauthorized access, technical problems, and violations of applicable terms.
10.10Shape01 may process personal information to maintain, test, troubleshoot, analyze, develop, and improve the Service.
10.11Shape01 may process personal information to comply with legal obligations, enforce agreements, establish or defend legal claims, and respond to lawful requests.
10.12Shape01 may process personal information for additional purposes disclosed at the time of collection where permitted by law.
11Legal Bases for Processing
11.1Where applicable data-protection law requires a legal basis for processing, Shape01 relies on one or more appropriate legal bases depending on the information, purpose, jurisdiction, and relationship with the user.
11.2Processing may be necessary to perform a contract with you or to take steps at your request before entering into a contract.
11.3Processing may be based on your consent where consent is required or appropriate.
11.4Processing may be necessary for compliance with a legal obligation.
11.5Processing may be necessary for legitimate interests pursued by Shape01 or another party, provided those interests are not overridden by applicable rights and freedoms.
11.6Legitimate interests may include operating and improving the Service, maintaining security, preventing fraud, understanding product performance, protecting legal rights, and providing appropriate customer support.
11.7Where special-category or sensitive information is subject to additional legal requirements, Shape01 will rely upon an applicable condition authorizing such processing.
11.8Where processing is based on consent, you may withdraw that consent as permitted by applicable law without affecting the lawfulness of processing performed before withdrawal.
12Automated Processing and Personalization
12.1Shape01 uses automated systems to provide personalization and other functionality.
12.2Automated processing may influence recommendations, plans, content ordering, reminders, suggested actions, or other elements of the user experience.
12.3Unless expressly stated otherwise, Shape01 does not intend to use automated decision-making to make decisions producing legal effects or similarly significant effects concerning users without appropriate safeguards required by applicable law.
12.4Users should exercise independent judgment regarding AI-generated or automated recommendations, particularly where health, safety, or other significant interests are involved.
13Device Permissions
13.1Certain features may request access to device capabilities or information.
13.2Such permissions may include notifications, camera, photographs or media, microphone, local storage, health or fitness data, or other capabilities depending on available features.
13.3Shape01 will request permissions through the mechanisms provided by the relevant operating system or platform where required.
13.4You may generally manage device permissions through your device settings.
13.5Disabling a permission may prevent the corresponding feature from functioning.
13.6Shape01 should not be understood to have access to a device permission merely because the application technically supports requesting that permission.
14Camera, Images, and Media
14.1Where Shape01 offers image-based functionality, users may choose to provide photographs or other media.
14.2Images may be processed for purposes such as identifying food, analyzing user-provided content, extracting relevant information, supporting progress tracking, or providing other requested functionality.
14.3Image processing may involve AI models or third-party infrastructure where necessary to provide the relevant feature.
14.4Shape01 will process images in accordance with the purposes disclosed for the relevant feature and this Privacy Policy.
14.5Users should avoid including unrelated individuals or sensitive information in images submitted to Shape01 unless necessary and lawfully permitted.
15Notifications and Reminders
15.1Shape01 may send notifications relating to workouts, nutrition, habits, reminders, goals, account activity, security, subscriptions, or other Service functionality.
15.2Push notifications may require permission from your device operating system.
15.3You may manage notification permissions through device or application settings where available.
15.4Essential account, legal, transactional, or security communications may be delivered separately from optional promotional communications.
16Information from Connected Services
16.1Shape01 may allow users to connect third-party services, platforms, devices, or accounts.
16.2Where you authorize an integration, Shape01 may receive information made available through that integration in accordance with your authorization and the relevant third party’s policies.
16.3Shape01 will use information received through connected services for purposes associated with the functionality you requested and other compatible purposes permitted by law.
16.4You may be able to revoke an integration through Shape01, the third-party service, or your device settings.
16.5Revoking future access does not necessarily require deletion of information previously received where continued retention is permitted or required by law.
17Analytics and Product Performance
17.1Shape01 may use analytics and diagnostic technologies to understand how the Service performs and how users interact with it.
17.2Analytics information may include application events, feature usage, session information, device information, crash reports, performance metrics, navigation patterns, and technical diagnostics.
17.3Shape01 may use this information to identify errors, improve usability, evaluate features, allocate infrastructure, detect abuse, and make product decisions.
17.4Where required, consent or other legally required controls will be provided for analytics technologies.
17.5Shape01 may seek to minimize the amount of directly identifying information included in analytics systems where reasonably practicable.
18Cookies and Similar Technologies
18.1Shape01 websites and web-based services may use cookies, local storage, software development kits, pixels, or similar technologies.
18.2These technologies may be used for authentication, security, preferences, functionality, analytics, performance, and other legitimate operational purposes.
18.3Where legally required, non-essential technologies will be used subject to appropriate consent choices.
18.4Users may be able to manage certain technologies through browser settings, consent controls, or other available mechanisms.
18.5Disabling essential technologies may impair the functionality of the Service.
18.6The Service may use localStorage and sessionStorage to store information locally within your browser, including user-interface settings, technical flags, session state, and cached preferences.
18.7Our mobile applications may incorporate software development kits (SDKs) to facilitate service functionality, analytics, and security, subject to your device settings.
18.8As our technology and service providers evolve, the specific cookies and tracking technologies used may change. We may maintain a dynamic inventory of these technologies to provide accurate and up-to-date information.
19Advertising
19.1Shape01 may offer free, subscription-based, or other service models and may introduce advertising-supported functionality where appropriate.
19.2If advertising is introduced, Shape01 will provide disclosures and controls required by applicable law.
19.3Shape01 will not represent advertising as independent AI advice or intentionally obscure the commercial nature of sponsored content.
19.4Where an advertisement is personalized using personal information, such processing will be conducted subject to applicable privacy requirements and any legally required choices or consent mechanisms.
19.5Shape01 does not sell personal information merely because a third-party infrastructure provider processes information on Shape01’s behalf.
19.6If applicable law defines terms such as “sale,” “sharing,” or “targeted advertising” more broadly, Shape01 will provide disclosures and rights required by the applicable legal definition.
20Service Providers
20.1Shape01 may use service providers to support the operation of the Service.
20.2Service providers may include cloud hosting providers, database providers, artificial intelligence providers, authentication providers, analytics providers, communication providers, payment processors, customer-support systems, security providers, monitoring providers, and other technology vendors.
20.3Service providers may process personal information only to the extent reasonably necessary for the services they provide and subject to applicable contractual and legal obligations.
20.4The specific providers used by Shape01 may change over time as infrastructure and operational requirements evolve.
20.5Where required by law, Shape01 will implement appropriate contractual safeguards with processors or service providers.
21Disclosure of Personal Information
21.1Shape01 may disclose personal information to service providers and processors as necessary to operate the Service.
21.2Shape01 may disclose information when you direct or authorize the disclosure, including through third-party integrations.
21.3Shape01 may disclose information where reasonably necessary to comply with applicable law, regulation, legal process, court order, or lawful governmental request.
21.4Shape01 may disclose information where reasonably necessary to investigate fraud, abuse, security incidents, violations of applicable terms, or threats to users, Shape01, or others.
21.5Shape01 may disclose information in connection with establishing, exercising, or defending legal claims.
21.6Shape01 may disclose information in connection with a merger, financing, acquisition, restructuring, bankruptcy, sale of assets, corporate reorganization, or similar transaction, subject to applicable law and appropriate protections.
21.7Shape01 may disclose aggregated, anonymized, or de-identified information that does not reasonably identify an individual.
22Sale of Personal Information
22.1Shape01 does not treat ordinary use of service providers acting on its behalf as a sale of personal information.
22.2Shape01 does not intend to sell identifiable health information as a standalone commercial product.
22.3If Shape01 engages in processing that constitutes a “sale” or “sharing” of personal information under an applicable law, Shape01 will provide the notices, rights, and opt-out mechanisms required by that law.
23International Data Transfers
23.1Shape01 may operate using infrastructure, service providers, and technology located in different countries.
23.2As a result, personal information may be processed outside the country in which you reside.
23.3Where applicable law restricts international transfers of personal information, Shape01 will use an appropriate transfer mechanism or other legally recognized safeguard.
23.4Such safeguards may include adequacy decisions, standard contractual clauses, contractual commitments, or other mechanisms recognized by applicable law.
23.5The privacy and data-protection laws of countries in which information is processed may differ from those of your jurisdiction.
24Data Storage
24.1Personal information may be stored in databases, cloud infrastructure, authentication systems, logging systems, analytics systems, backup systems, or other infrastructure used to provide the Service.
24.2Different categories of information may be stored in different systems depending on their purpose, sensitivity, technical requirements, and retention requirements.
24.3Shape01 may use logical separation, access controls, encryption, authentication, logging, monitoring, or other safeguards appropriate to the relevant systems.
24.4The location and architecture of storage systems may change as Shape01 develops its infrastructure.
25Data Retention
25.1Shape01 retains personal information for as long as reasonably necessary for the purposes for which it was collected or subsequently lawfully processed.
25.2Retention periods may vary depending on the type of information, account status, feature, legal requirements, security considerations, dispute-resolution needs, financial obligations, and technical architecture.
25.3Account information may generally be retained while an account remains active and for an appropriate period thereafter where necessary.
25.4Certain logs, security records, transaction records, consent records, legal records, and backup information may be retained for longer periods where reasonably necessary or legally required.
25.5Shape01 may delete, anonymize, aggregate, or de-identify information when continued identification is no longer reasonably necessary.
25.6Backup copies may remain temporarily after information has been removed from active systems until backups are overwritten or expire in accordance with applicable retention practices.
26Account Deletion
26.1Users may request deletion of their Shape01 account through available account controls or official contact channels.
26.2Account deletion may result in deletion or de-identification of personal information associated with the account, subject to applicable legal, security, financial, fraud-prevention, dispute-resolution, and technical retention requirements.
26.3Some information may not be deleted immediately from backup or disaster-recovery systems.
26.4Shape01 may retain information necessary to document the deletion request and demonstrate compliance with legal obligations.
26.5Deleting the Shape01 application from a device does not, by itself, necessarily delete the associated Shape01 account or server-side information.
27Security
27.1Shape01 uses reasonable administrative, technical, and organizational measures intended to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.
27.2Measures may include authentication controls, authorization controls, encryption, secure communications, infrastructure security, access restrictions, monitoring, logging, backups, vulnerability management, and other safeguards appropriate to the circumstances.
27.3Access to personal information may be restricted according to operational need and authorization.
27.4Shape01 may review and update security measures as technology, risks, and the Service evolve.
27.5No system, database, network, transmission method, or security measure can guarantee absolute security.
27.6Users are responsible for protecting their account credentials, devices, connected accounts, and authentication methods.
28Security Incidents
28.1Shape01 maintains processes intended to identify, investigate, contain, and respond to security incidents.
28.2If a personal-data breach occurs, Shape01 will assess the incident and provide notifications to affected individuals or regulatory authorities where required by applicable law.
28.3The timing and content of any notification may depend on applicable legal requirements, available information, investigative considerations, and measures necessary to contain the incident.
29User Privacy Rights
29.1Depending on your jurisdiction, you may have rights regarding your personal information.
29.2Such rights may include the right to request access to personal information held about you.
29.3You may have the right to request correction of inaccurate or incomplete personal information.
29.4You may have the right to request deletion of personal information, subject to applicable exceptions.
29.5You may have the right to request restriction of certain processing.
29.6You may have the right to object to certain processing based on legitimate interests.
29.7You may have the right to receive certain personal information in a portable format.
29.8You may have the right to withdraw consent where processing is based on consent.
29.9You may have rights relating to automated decision-making or profiling where applicable.
29.10You may have the right to opt out of certain forms of sale, sharing, targeted advertising, or similar processing where applicable law provides such rights.
29.11You may have the right to lodge a complaint with an appropriate data-protection or privacy authority.
29.12Shape01 will not unlawfully discriminate against users for exercising applicable privacy rights.
30Exercising Privacy Rights
30.1Privacy requests may be submitted through account functionality or official Shape01 privacy contact channels.
30.2Shape01 may request information reasonably necessary to verify your identity before fulfilling certain requests.
30.3Verification requirements will depend on the nature of the request, sensitivity of the information, and risk of unauthorized disclosure or deletion.
30.4Authorized agents may submit requests where permitted by applicable law and where appropriate authorization can be verified.
30.5Shape01 will respond within the period required by applicable law.
30.6Where Shape01 cannot fully satisfy a request, it may explain the applicable legal or operational basis for the limitation where required.
31Correction and Accuracy
31.1Users may be able to update certain profile, preference, health, fitness, nutrition, or lifestyle information directly through the Service.
31.2Users are encouraged to maintain accurate information where such information affects personalized functionality.
31.3Shape01 may retain records of previous information where necessary for historical tracking, security, legal compliance, or other legitimate purposes.
31.4Correcting information does not necessarily require retroactive regeneration of historical AI outputs, recommendations, or derived information.
32Children and Minors
32.1Shape01 is not intended for children below the minimum age permitted for independent use under applicable law unless a specific feature or service is expressly designed for such users with appropriate safeguards.
32.2Shape01 does not knowingly seek to collect personal information from children in violation of applicable law.
32.3Where parental or guardian consent is legally required, Shape01 may require appropriate authorization before allowing the relevant processing.
32.4If Shape01 becomes aware that personal information from a child has been collected unlawfully, reasonable steps will be taken to delete or otherwise appropriately handle that information.
32.5A parent or legal guardian who believes that a child has provided personal information improperly may contact Shape01 through the official privacy channels.
33Marketing Communications
33.1Shape01 may send information about products, features, offers, or updates where permitted by law.
33.2Where consent is required for marketing communications, Shape01 will seek such consent.
33.3Users may unsubscribe from optional marketing communications using the mechanism included in the communication or other available preference controls.
33.4Opting out of marketing does not prevent Shape01 from sending necessary account, billing, security, legal, or service-related communications.
34Third-Party Links and Services
34.1Shape01 may contain links to or integrations with third-party websites, applications, platforms, products, or services.
34.2Shape01 is not responsible for the independent privacy practices of third parties.
34.3Users should review the privacy policies and permissions of third-party services before providing information to them or connecting them to Shape01.
34.4This Privacy Policy applies only to processing performed by or on behalf of Shape01 within its scope.
35Changes in Corporate Structure
35.1Personal information may be transferred or disclosed as part of a merger, acquisition, financing, investment, restructuring, sale of assets, reorganization, insolvency proceeding, or similar corporate transaction.
35.2Any recipient of personal information in such a transaction will be subject to applicable data-protection requirements.
35.3Where required by law, users will receive appropriate notice regarding material changes affecting the processing of their personal information.
36De-Identified and Aggregated Information
36.1Shape01 may transform personal information into aggregated, anonymized, or de-identified information where reasonably appropriate.
36.2Such information may be used for analytics, research, statistics, service improvement, product development, capacity planning, security, AI evaluation, and other legitimate purposes.
36.3Shape01 will not intentionally attempt to re-identify information that has been effectively de-identified where prohibited by law, except where necessary to test or validate de-identification protections and legally permitted.
37Data Governance
37.1Shape01 may maintain internal policies, procedures, technical controls, and operational processes governing access to and handling of personal information.
37.2Access may be limited based on role, operational necessity, system permissions, or other appropriate authorization mechanisms.
37.3Shape01 may maintain records concerning security events, administrative actions, consent, account changes, or other activities where appropriate for accountability and compliance.
37.4Privacy and security controls may be reviewed and modified as the Service evolves.
38Data Protection by Design
38.1Shape01 seeks to consider privacy and data protection when designing and developing new features.
38.2Depending on the feature and associated risk, Shape01 may use measures such as data minimization, permission controls, contextual isolation, limited retention, pseudonymization, encryption, or restricted access.
38.3New processing activities involving sensitive information may be subject to additional review or safeguards where appropriate or legally required.
39AI Safety and Privacy Controls
39.1Shape01 may implement controls intended to reduce unnecessary disclosure of personal information to AI systems.
39.2Such controls may include selective context retrieval, structured context, minimization of prompts, filtering, separation of operational data, output validation, or other technical methods.
39.3The precise architecture of AI processing may evolve as models, providers, safety technologies, and Shape01 infrastructure change.
39.4Changes in technical architecture do not eliminate Shape01’s obligation to process personal information consistently with this Privacy Policy and applicable law.
40Regional Privacy Disclosures
40.1Privacy rights and requirements differ between jurisdictions.
40.2Shape01 may provide supplemental regional privacy notices where required by applicable law.
40.3Such supplemental notices may address specific rights, legal bases, categories of information, disclosures, international transfers, regulatory contacts, or other jurisdiction-specific requirements.
40.4Where a supplemental regional notice conflicts with this Privacy Policy regarding a mandatory legal requirement, the supplemental notice will govern for users subject to that requirement.
41European Economic Area, United Kingdom, and Similar Jurisdictions
41.1Where the General Data Protection Regulation, United Kingdom GDPR, or comparable legislation applies, Shape01 will process personal data in accordance with applicable principles including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.
41.2Users may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a competent supervisory authority, subject to applicable conditions and exceptions.
41.3Where Shape01 relies on legitimate interests, users may request information concerning those interests and may have a right to object to processing in circumstances provided by law.
41.4Where international transfers require safeguards, Shape01 will use an appropriate lawful transfer mechanism.
42United States Privacy Disclosures
42.1Residents of certain United States jurisdictions may have additional privacy rights under applicable state law.
42.2Such rights may include access, correction, deletion, portability, and rights concerning certain forms of sale, sharing, targeted advertising, or profiling.
42.3The exact rights available depend on the applicable state law and may be subject to statutory exceptions.
42.4Where legally required, Shape01 will provide appropriate methods for exercising such rights and appealing certain decisions concerning privacy requests.
42.5Shape01 will provide additional disclosures concerning categories of personal information, processing purposes, recipients, and legally defined sales or sharing where required.
43Israeli Privacy Requirements
43.1Where Israeli privacy and data-protection law applies, Shape01 will process personal information in accordance with applicable requirements, including requirements concerning lawful collection, use, security, database administration, notices, and data-subject rights where applicable.
43.2Information provided to Shape01 will be used for the purposes described in this Privacy Policy and other purposes permitted by applicable law.
43.3Where provision of particular information is not legally mandatory, Shape01 may indicate that providing such information is voluntary while explaining the consequences of choosing not to provide it where relevant.
43.4Users may exercise applicable rights concerning information held about them through the official Shape01 privacy contact channels.
44Business Transfers
44.1If all or part of Shape01 or its assets is acquired, transferred, reorganized, or combined with another entity, personal information may form part of the transferred assets.
44.2Shape01 will seek to ensure that personal information remains subject to appropriate privacy protections following such a transaction.
44.3Where applicable law requires notice, consent, or other measures in connection with such a transfer, Shape01 will comply with those requirements.
45Legal Requests and Protection of Rights
45.1Shape01 may preserve, access, or disclose information where reasonably necessary to comply with applicable law or valid legal process.
45.2Shape01 may review legal requests to determine whether they are valid, appropriately scoped, and legally binding.
45.3Where legally permitted and appropriate, Shape01 may seek to narrow or challenge requests considered excessive or improper.
45.4Shape01 may preserve information where reasonably necessary in anticipation of litigation, investigation, security incidents, or other legal obligations.
46Privacy Policy Changes
46.1Shape01 may update this Privacy Policy from time to time to reflect changes in technology, functionality, legal requirements, business operations, privacy practices, service providers, or other relevant circumstances.
46.2The current version will be made available through the Shape01 website, application, or other official channel.
46.3The effective date or last-updated date will be displayed with the published policy.
46.4Where required by applicable law, Shape01 will provide appropriate notice before material changes become effective.
46.5Where a change requires consent under applicable law, Shape01 will request such consent before applying the relevant processing.
47Contact and Privacy Requests
47.1Questions, requests, complaints, or concerns regarding this Privacy Policy or Shape01’s handling of personal information may be submitted through the official Shape01 privacy contact channels.
47.2Shape01 may request information reasonably necessary to authenticate the requester and protect personal information from unauthorized access, disclosure, modification, or deletion.
47.3Current privacy contact information, including any dedicated privacy email address or contact form, will be published through the official Shape01 website or application.
47.4Where applicable law requires the identification of a data controller, representative, data protection officer, database owner, or other responsible entity, the relevant details will be provided in the applicable legal notice.
48Effective Date
48.1This Privacy Policy becomes effective on the date identified in the official published version.
48.2The date of the most recent material update should be displayed with the Privacy Policy.
48.3Previous versions may be retained where reasonably necessary for legal, compliance, or historical purposes.
