Who is responsible for this website?
shim Technologies, Istanbul, Turkey, runs getshim.tech and is responsible for the server logs and demo emails described below. Write to privacy@getshim.tech with any question about this page or the data you sent us.
What does this website collect?
Nothing through the page itself. There are no cookies, no analytics, no advertising or tracking scripts and no embedded content from other companies. Fonts, images and scripts are served from getshim.tech.
The review stage on the home page runs shim’s detector in your browser. What you type there stays on the page.
What does the host record?
The company that hosts this website keeps standard server logs for each request: your IP address, the time, the page requested, and the browser and referring page your browser reports. These logs are used only to keep the site running and secure.
What happens when I book a demo?
Book a demo sends nothing from this website. It opens your own email app with a message to support@getshim.tech that contains what you typed in the form. Nothing reaches us until you send that email, and no form service sees it. Once sent, it is stored by our email provider.
We use what you send only to reply and arrange the call.
How long do you keep it?
- Server logs: To confirm: the host’s log retention period.
- Demo emails: as long as we need them to reply and arrange the call. Ask, and we delete yours.
On what basis?
We keep server logs because we have a legitimate interest in running a working, secure website. We use a demo email because you asked us to arrange a call, as a step before any agreement.
What are my rights?
You can ask to see the data we hold about you, to correct or delete it, and to object to how we use it. Write to privacy@getshim.tech. You can also complain to the data protection authority where you live or work.
What happens when I sign in?
Sign in opens your organization’s shim console. Your organization deploys and runs it, sets the cookies it needs and decides what happens to the data in it. This website is not involved.
How does shim handle prompts?
The product is separate from this website. When an organization deploys shim, the extension checks ChatGPT, Claude and Gemini prompts and attached files in managed Chrome and Edge and reports only to the console the organization runs. None of it reaches shim or this website.
- Detection runs in the browser. The extension does not upload a prompt or file to decide on it.
- A prompt is captured only when a rule matches, including monitor-only matches and prompts the employee cancels. When the employee edits or masks it, the applied version is captured under the same request. Clean prompts are never captured.
- For a flagged file, the console keeps its name and what was flagged in it, with the words around each match and where it was found, never the rest of the file.
- Only the organization’s administrators can open captured prompt text and file findings. Request lists and overviews never contain either.
- The console deletes each captured version 90 days after its own capture event. Request metadata, the employee’s choice, the Send once explanation, and account and conversation context currently have no deletion period.
- An employee who chooses Send once can add an explanation of up to 500 characters, written in their own words. Only the organization’s administrators can read it, beside the request.
- When the organization’s policy turns on AI app discovery, the extension records which AI apps from shim’s list each browser has open on each day, as the app and the day only: never the web address, the page or what was typed, and nothing from incognito windows. The console shows these as organization totals, shows each browser’s apps only to administrators, and deletes each record 90 days after its day.
The security page explains each of these in detail.
Will this page change?
When the website or the product changes how it handles data, we update this page and the date at the top.