Privacy Policy

1. Who We Are

SCM SENSEI AI LTD. (“sensei.”, “we”, “us”, or “our”) operates the website scmsensei.aiand the sensei. platform (collectively, the “Service”). We are the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, contact us at support@scmsensei.ai.

2. Information We Collect

We collect information you provide directly and data generated as you use the Service:

• Account data: Name, email address, company name, and password (stored as a secure hash) when you register.
• Usage data: Pages visited, features used, queries submitted, and interactions with AI outputs, including timestamps and session identifiers.
• Content you upload: Files, spreadsheets, or documents you submit for analysis (e.g., inventory CSVs, spend data, logistics reports).
• Payment data: Billing name and address processed by our payment provider (Stripe). We do not store raw card numbers or payment card details — all payment data is tokenised and handled by Stripe, which is PCI DSS Level 1 certified.
• Communications: Emails or messages you send us via contact forms or support channels.
• Technical data: IP address, browser type, device identifiers, and cookies placed by our analytics provider.

3. How We Use Your Information

We use your data to:

• Provide, maintain, and improve the Service
• Process payments through our third-party payment processor (Stripe) and manage your subscription — we do not store your payment card details
• Respond to your support requests and communications
• Send transactional emails (e.g., account confirmations, password resets)
• Send product updates and marketing communications (you may opt out at any time)
• Monitor usage patterns to detect abuse, errors, and security threats
• Comply with legal obligations

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract: Processing necessary to provide the Service you signed up for.
• Legitimate interests: Analytics, security monitoring, and product improvement, balanced against your privacy rights.
• Consent: Marketing emails and non-essential cookies — you can withdraw consent at any time.
• Legal obligation: Compliance with applicable law, tax, or regulatory requirements.

5. Cookies

We use cookies and similar tracking technologies to operate the Service and understand how it is used. These include:

• Essential cookies — required for authentication and session management.
• Analytics cookies — provided by Google Analytics (GA4) to measure traffic and usage. You may opt out via Google’s opt-out tool.

You can control cookies through your browser settings. Disabling essential cookies may impair Service functionality.

6. Sharing Your Information

We do not sell your personal data. We may share it with trusted third parties only where necessary:

• Infrastructure & AI providers: Cloud hosting (Google Cloud Platform) and AI model providers used to power analysis features.
• Payment processors: Stripe, for secure payment handling.
• Analytics: Google Analytics, for aggregated usage statistics.
• Legal or regulatory bodies: Where required by law, court order, or to protect our rights.

All third parties are contractually bound to handle your data in accordance with applicable data protection law.

7. AI Data Processing

When you upload files or submit queries, your data is processed by AI models within our secure, controlled cloud infrastructure. We are committed to the following principles:

• AI processing happens in isolated compute environments — your data is never mixed with other users’ data
• We do not use your data to train AI models
• We do not sell your data to third parties
• We do not share your data with other customers
• We do not access your data without your explicit permission

Data residency is the United States by default. Enterprise customers may request alternative data residency configurations — contact us at support@scmsensei.ai.

8. Data Retention

We retain different types of data for different periods:

• Uploaded files — automatically deleted within 24 hours of upload
• Analysis results and conversations — retained while your account is active
• Account data — retained while your account is active

If you close your account, we will delete or anonymise your remaining data within 90 days, except where retention is required by law (e.g., financial records for tax purposes, typically 7 years).

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at support@scmsensei.ai. We will respond within 30 days.

10. International Transfers

Your data is processed primarily in the United States. It may also be processed in other countries outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place — such as the EU Standard Contractual Clauses — to protect your data in line with GDPR requirements. Enterprise customers may request alternative data residency configurations.

11. Security

We implement industry-standard technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS 1.3), encryption at rest, strict access controls, data isolation per user, and regular security reviews.

In the event of a data breach affecting your personal data, we will notify affected users within 72 hours in accordance with GDPR requirements.

No method of transmission over the internet is 100% secure. If you discover a potential vulnerability, please disclose it responsibly to security@scmsensei.ai.

12. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us immediately and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related questions or requests: