Privacy Policy — Sheno

This page is the English translation of the Sheno privacy policy. Versiunea în limba română

Last updated: 27 October 2026
Controller: Algoriqa LLC (1603 Capitol Ave Suite 413G088, Cheyenne, WY 82001, USA) and, in the European Union, Overalic SRL ("Sheno", "we"). The full tax identification details (registered office, CUI) are available on request, at the contact address below.
Contact: contact@sheno.ai

1. About this document

Sheno offers businesses a configurable conversational AI agent that answers their customers through chat on the website and, when the channel is active, on WhatsApp, Facebook Messenger and Instagram, including comments on their posts. This document explains what data we collect, from whom, why, to whom we pass it on and what rights you have regarding it.

There are two categories of people whose data we touch:

• Merchants — the businesses that have a Sheno account and configure an agent.
• End customers — the people who talk to a merchant's agent.

2. What data we collect

From merchants

• Account data: business name, email, password (stored as a hash, never in plain text).
• Credentials for connecting to the online store (API tokens) — encrypted, used exclusively to allow the agent to search for products and check orders on the merchant's behalf.
• Agent configuration: instructions, catalog language, widget style.

From end customers (of the merchants)

• The content of the messages sent to the agent or to a human operator. Each message is stored encrypted.
• On WhatsApp: the phone number, used to send the replies. The number is stored encrypted. In the database, the conversation is identified by a code derived from the number, not by the number in plain text.
• For Facebook Messenger and Instagram: the identifier Meta assigns to the person for the business's Page or account, stored encrypted and referenced in the database by a derived code. We do not request the person's name, photo or other profile data from Meta.
• For comments on the business's posts, if the business has turned on comment replies: the text of the comment, stored encrypted.
• If you ask to be contacted by a colleague (see section 3): name, phone number and your message, stored encrypted.
• For bookings: name, phone number, email and the answers to the preparation questions, stored encrypted.
• If you ask about an existing order, you can provide the email or phone number used for the order, so that the verification matches. This data appears only in the conversation, under the retention rules in section 5.

We do not ask for and do not need payment data — any payment is made directly on the merchant's platform, never through Sheno.

3. Why we process this data

• To deliver the core functionality: product search, information about availability and price, generating a checkout link, checking the status of an existing order, scheduling a booking.
• To maintain the context of a conversation.
• Recontacting: when a customer explicitly asks to be contacted by a colleague and the conversation cannot be taken over immediately by an operator, we keep their name, phone number and message, so that a colleague of the merchant can contact them again. This data reaches the merchant's email address.
• To improve search quality, by analysing in aggregate which phrasings do not find existing products, without linking this to a specific person beyond a short period of time.
• Replying to messages and comments received on Facebook and Instagram. For a comment, we send a single private message and, if the business has chosen so, a public reply with a fixed text.

We do not sell your data. We do not use it for advertising or for marketing to third parties. We do not make automated decisions with a legal or significant effect on you — the agent offers information and recommendations, not final decisions.

4. Who else we pass data to

To deliver the functionality above, part of the data reaches third-party providers, chosen for their specific technical role:

• The artificial intelligence model provider — receives the content of the messages in the conversation, to generate the agent's replies, and the conversation identifier. On WhatsApp, the identifier is a derived code, not the phone number.
• The merchant's e-commerce platform (e.g. Shopify) — the actual source of the product and order data; any order verification is done directly there.
• Twilio (for WhatsApp) — WhatsApp messages pass through Twilio's infrastructure, which forwards them to Meta. Twilio receives the customer's phone number, to deliver the message.
• Meta / WhatsApp, Facebook Messenger and Instagram — the platform through which WhatsApp, Facebook Messenger and Instagram messages and comments on posts travel, subject to its own privacy policies.
• Resend — delivery of transactional emails: password resets, employee invitations and internal technical alerts. Booking confirmations and the emails to the merchant's operators asking for a customer to be recontacted are sent through Resend or, if the merchant has configured its own SMTP server, through that server. Alerts do not contain the content of messages; for WhatsApp errors, they contain the sender's number and the message identifier.
• Sheno staff — have technical access to the platform's infrastructure, for operation and troubleshooting. The application does not include a screen through which staff can read the conversations of end customers.
• The hosting provider of the Sheno infrastructure.

No provider receives more data than it needs for its specific role.

5. How long we keep data

• Conversations and messages are kept for 12 months from the last message, after which they are deleted automatically. Conversations in the process of being taken over by a colleague are not deleted until the takeover ends.
• Bookings are kept for 12 months from the end of the appointment, after which they are deleted automatically. The event in the merchant's calendar (Google Calendar) is not deleted by Sheno and remains in the merchant's calendar.
• The technical identifiers of WhatsApp messages, used only to avoid duplicate processing, contain no text and are deleted after 30 days.
• Merchants' account data is kept for as long as the account is active.
• Messages and comments received from Meta: in the processing queue, encrypted, for at most 30 days. Once processed, their content is deleted from the queue immediately.
• Access tokens received from Meta: for as long as the Page or account stays connected. We delete them when the business disconnects it or removes our access in Facebook.

The data used for identity verification in questions about orders (email or phone number) is not stored separately; the verification is done against the data in the merchant's platform, and the data you provide remains only in the conversation, under the rule above.

6. Security

All traffic is encrypted (HTTPS). Each merchant's data is isolated from that of the others. The following data is encrypted at rest (AES-256-GCM):

• The content of each message in conversations.
• The contact details captured in the conversation: name, phone number and the message of the recontact request.
• The contact and preparation details from bookings: name, phone number, email and the intake answers.
• The WhatsApp customer's phone number, the identifiers assigned by Meta and the access tokens received from Meta.
• The technical credentials for the merchant's WhatsApp connection (the Twilio subaccount token), used for signing incoming messages and sending replies.
• The access tokens for the merchant's store and the merchant's own SMTP passwords.

For WhatsApp, the conversation identifier in the database is a code derived from the number with a secret server key, not the number in plain text.

7. Your rights

You have the right to request access to the data we hold about you, its correction, or its deletion. For end customers of a merchant, the quickest route is to contact the merchant directly (the shop you talked to); Sheno actively assists with any such request received from the merchant.

You can contact Sheno directly at contact@sheno.ai for any question related to this document.

The steps to have your data deleted are on the Data deletion page.

8. Changes

We may update this policy as the platform evolves. Any significant change will be communicated to merchants.