Shareloom AI In development

Privacy Notice

How we handle your personal data when you visit this site or join a waitlist.

Data controller
Aegis brightsmark capital, MB
Registered details
Register of Legal Entities (Juridinių asmenų registras), company code 307576279, registered office Sembų g. 6, Buivydiškės, LT-14166 Vilnius District Municipality, Lithuania; VAT code LT100020614313
Privacy contact
privacy@shareloom.net
Notice version
1.1

1. Who we are

“Shareloom AI” is an early research project run by the data controller named above (“we”, “us”). We decide why and how your personal data is used. Nothing is live yet: there is no AI service, no compute network and no payments.

Questions about this notice go to the privacy contact above. A person reads and answers every message: the one responsible for this project, not an automated system. We have no data protection officer, because the GDPR does not require one for what we do here (Article 37).

2. What this notice covers

This site, the AI waitlist, the compute contributor waitlist and the emails we send about them. It does not cover other websites, including those of the providers we name below.

3. What we collect

When you join a waitlist

  • Your email address. You have to give it.
  • Which waitlist you joined, and the language of the page (English).
  • Your country, if you pick one. It is optional.
  • Your optional answers. On the AI waitlist: whether you are an individual or a company, how you would use AI, and a short note. On the compute contributor waitlist: your operating system, your CPU or GPU, and how you would like to take part.
  • Your choices about the optional emails. For each one we record the exact text you saw and its version, the time, the language, the form or page you used, and whether you agreed, confirmed or withdrew.

We do not record, for you or for your sign-up, how you found the site: not the site, ad or campaign that sent you, and not the campaign labels in a link. The sign-up form sends nothing from the page's web address. A sign-up on a page that one of our ads links to is recorded exactly like any other. The daily page totals described below count requests per page, not people.

We never ask for a postal address, a crypto wallet, an amount to invest, an ID number or any financial details. Please do not put confidential information, other people's personal data or code in the free-text note.

If someone else typed your email address into one of our forms, we got it from them. Until the address is confirmed, we email it only to answer a request made with it, such as a sign-up or a deletion request. Every email we send links to this notice.

When we email you

Which kind of email we sent, which template, when, and whether you unsubscribed through it. The provider that sends our emails (section 5) also records your address, the subject and whether the email was delivered (section 7 says for how long). We do not track whether you open our emails or click their links, and neither does that provider.

When you use the site

  • Your IP address is used for a moment to stop abuse of the forms. Our server keeps only a keyed fingerprint of it, in memory, to limit how many requests can come from one address. Our application does not store your IP address in its database or its logs. Our hosting and network providers (section 5) do process IP addresses and the content of requests, because they deliver the site and protect it from attacks.
  • Our application logs what it does, for example that a sign-up came in or an email went out, with a random internal number for your record. It also logs each request it answers: the type of request, our answer, how long it took and the time. For a request to one of the application's own addresses, such as a form being sent, it logs that address without anything after the “?”. For the pages and files of the site, it does not log which page or file was asked for. The logs never contain your email address or IP address. Section 7 says how long we keep them.
  • Each time our server answers a request for the home page, for a page that one of our ads links to, or for a sign-up page, it adds one to that page's total for the day, whatever link led there. When we process a sign-up or a confirmation, we add one to the day's total of sign-ups or of that kind of confirmation; those totals are not kept per page. A total holds only what was counted, the page where that applies, the day and the number. It holds no time of day, no IP address, no browser or device details, no referring page, nothing after the “?” in the web address, no cookie and no other identifier. A page's total for the day stays in our server's memory until the day ends (UTC). It is then written to our database once, together with the other pages' totals for that day, so neither our database nor our admin area ever shows how a total grew during the day. If our server restarts during the day, that day's page totals so far are lost. No script on our pages sends analytics.

When you see one of our ads

We may advertise the waitlists on online platforms. If we do, we choose only broad settings: adults aged 18 and over, countries, language and broad interest categories. We never upload lists of people, never ask a platform to find people similar to our contacts, and never put a platform's pixel, tag or lead form on our pages or in our ads. The platform that shows the ad processes data about you under its own privacy notice, and decides with its own data which of its users see the ad (section 4 explains who is responsible for what). From the platform we get only aggregate reports, such as how many times our ads were shown and clicked. We send it nothing about you.

When you write to us

Your message, your email address and our reply. We keep them so that we can answer you, and so that we can show how we handled a request about your rights. Messages to our addresses arrive in our mailbox (section 5).

4. Why we use it, and on what legal basis

Running the waitlist you joined

We use your data to send the email that asks you to confirm a sign-up, an invitation to test when there is something to test, and essential messages about the list. Your country and optional answers help us see who is interested and plan whom to invite to a test. We use them for nothing else. Basis: our legitimate interest in running the waitlist you asked to join, and in making sure that only the owner of an address can put it on a list (Article 6(1)(f) GDPR). Joining a waitlist is not consent to marketing, and it does not create a contract.

Product and research updates

Only if you ticked “I'd like to receive occasional product updates, research progress and launch news by email.” and confirmed it by email. Basis: your consent (Article 6(1)(a) GDPR). It is also the consent that Lithuanian law on electronic communications requires for marketing email. You can withdraw it at any time.

Future funding updates

Only if you ticked “If we consider a future fundraising round, I'd like to receive updates about where to learn more. This is not an offer to invest and does not guarantee investment access.” and confirmed it by email. Basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. These emails are never an offer to invest, and sending them is switched off during the research stage.

Proving consent and respecting your choices

We keep the consent records described above. We also keep a suppression list of addresses that left every waitlist with no optional email on, bounced, reported our email as spam, or were deleted. These addresses get no waitlist emails and no optional emails. We email such an address only to answer a request made with it:

  • If someone asks us to delete its data, we email it to confirm the request, unless the address bounced or was already deleted at its request. Once the deletion is done, we email it one last time to say so.
  • If someone uses our sign-up form with an address that left every waitlist, we send it one email asking to confirm, at most once every 30 days. The address comes back only if that email's Confirm link is pressed, or Join on the Manage preferences page opened from one of our emails. An address that bounced, was reported or was deleted never gets that email.

Basis: our legal obligation to be able to show consent (Article 6(1)(c) GDPR, read with Article 7(1)) and our legitimate interest in respecting your choices (Article 6(1)(f)).

Protecting the forms

Limiting how many requests can come in, as section 3 describes. Basis: our legitimate interest in keeping the forms working and free of abuse (Article 6(1)(f)).

Measuring interest

These are the daily totals described in section 3. Page totals use only which page was asked for and whether our server answered with it. Sign-up and confirmation totals are added when we process a sign-up or a confirmation, and hold only what happened and the day. No total records an identifier or a time of day. Where the totals, or making them, involve personal data at all, the basis is our legitimate interest in knowing how often the site is visited, how well our ads and the pages they link to work, and how many people join the waitlists (Article 6(1)(f)). Nothing is stored in your browser for them.

A page total cannot be connected to your visit, because our request log holds no IP address and does not record which page was asked for. On a day with only a few sign-ups or confirmations, a total of sign-ups or confirmations shows no more than your own record already does: that a sign-up or a confirmation happened that day. On a day with very few requests for a page and very few sign-ups, the totals could still allow a guess that a sign-up came through that page, and so through a particular ad. A page's total for a day is written, and shown to our staff, only after that day has ended, so such a guess can never point to anything narrower than that whole day. We do not try to make such guesses, and we use the totals only next to other aggregate figures, never together with anyone's record. That is why a total does not change when someone's data is erased. Browser signals such as Global Privacy Control or Do Not Track do not change the totals either: a total holds no identifier and we never link it to anyone, so there is no processing about you for such a signal to switch off.

Showing our ads

When we advertise on a platform, we and the platform are jointly responsible (“joint controllers”, Article 26 GDPR) for choosing who sees the ad. This is how the work is split:

  • We decide to advertise, write the ad and pick the broad settings described in section 3. Basis: our legitimate interest in telling people about the waitlists (Article 6(1)(f)).
  • The platform decides, with the data it holds about its users, which of them match those settings and see the ad. That part is the platform's responsibility, under its own terms and privacy notice: telling its users about it, having a legal basis for it, and asking for any consent it needs.
  • We get only aggregate reports from the platform. We cannot see who saw or clicked an ad.

You can use your rights about this with the platform or with us. If you write to us about the platform's part, we will tell you where to send your request, or pass it on to the platform if you ask us to.

Delivering and securing the site

Delivering the pages, spotting and blocking attacks, keeping the application logs described above so that we can run the service and find faults, and keeping the daily backup copies described in section 7 so that the waitlist is not lost if something breaks. Basis: our legitimate interest in a working, secure site (Article 6(1)(f)).

Enforcing our terms of use

Removing an address from a waitlist when our terms of use are broken and, if the address is confirmed, telling you why by email. Basis: our legitimate interest in keeping the waitlists genuine and the site secure (Article 6(1)(f)).

Answering your messages and requests, and protecting our rights

Answering your messages, handling requests about your rights, and keeping the records we need to establish or defend legal claims. Basis: for requests about your rights, our legal obligations under the GDPR (Article 6(1)(c)); otherwise, our legitimate interest in answering people who write to us and in defending our rights (Article 6(1)(f)).

You can ask us how we weighed our legitimate interests against your rights.

5. Who receives it

  • Authorized project staff, through a password-protected admin area. Most staff see only totals. Only administrators can export a list of contacts, and every export is logged.
  • Our providers. They act as our processors, only on our documented instructions and under data processing terms that meet Article 28 GDPR, unless we say otherwise next to their name. Hosting and network: DigitalOcean, LLC (servers in Amsterdam, the Netherlands); Cloudflare, Inc. (all traffic to the site, forms included, passes through it to encrypt the connection and block attacks). Email: Scaleway SAS, France (sends our emails); Cloudflare, Inc. (receives the emails sent to us and forwards them); Google Ireland Limited (Gmail, our mailbox, with no processor terms with us).
  • Public authorities, courts or our professional advisers, but only when the law requires it or when it is needed to establish or defend a legal claim. Advisers are bound by confidentiality.

We do not sell your data, share it with advertisers or use advertising pixels. Ad platforms get nothing about you from us (section 4). Waitlist data is never used in our research experiments or sent to the computers that run them.

6. Transfers outside the European Economic Area (EEA)

Scaleway stores and processes the emails it sends for us, and its records of them, in France. DigitalOcean and Cloudflare belong to US-based groups, so your data may be accessed from or processed in the US and other countries outside the EEA. US transfers rely on the EU-US Data Privacy Framework (Decision (EU) 2023/1795), under which each provider's US company is certified. Other transfers, and any the Framework does not cover, use the Standard Contractual Clauses (Decision (EU) 2021/914). You can ask us for a copy of the safeguards at the privacy contact above. If we start using a new processor outside the EEA, this notice will name it, and the safeguard used, before any of your data is transferred to it.

Messages you send to our addresses are kept in our mailbox, which Google Ireland Limited provides (section 5). Google decides itself where it processes them, which can be outside the EEA, as its privacy policy explains. We have no agreement with Google that sets safeguards for this.

7. How long we keep it

During the research stage an administrator reviews the waitlist data by hand at least once a month, and erases what these rules say is due. We chose these periods ourselves; no law sets them. Erasing a contact removes its email address, country, answers and choices. If a Confirm or deletion link we emailed to a contact still works (these links expire after 48 hours), we keep the contact until the link has expired, but never more than 30 days past the date these rules set, and erase it at the first review after that.

  • Unconfirmed sign-ups: the confirmation link expires after 48 hours. An address that was never confirmed is erased at the first review once 30 days have passed since it signed up. Unless our email to it bounced or was reported as spam, we keep it on no list, so you can sign up again later. An address that left every waitlist before it was confirmed is erased on the same schedule, but its suppression fingerprint described below stays.
  • Contacts who left every waitlist with no optional email on: erased at the first review once 12 months have passed since they signed up. Only the suppression fingerprint and the consent records described below remain, without your email address or other contact details. If someone uses our sign-up form with the address of such a contact before it is erased, and we email the address to confirm, we keep the contact for at least 30 days after that email, so that the Manage preferences link in it keeps working. If our sign-up form or the Delete my data page is used with such an address after it was erased, we keep that request, with the address, and erase it at the first review once 30 days have passed, unless it is confirmed. The same goes for a Delete my data request for an erased address that reported our email as spam.
  • Contacts on a waitlist, or with an optional email on: reviewed 12 months after they signed up, and kept while the waitlist is open or the optional email is on. You can leave or delete your data at any time.
  • Consent records: kept for as long as we need to show what you agreed to. After an erasure they keep no email address or other contact details.
  • Suppression list: a one-way keyed fingerprint of the address, used to apply the rules in section 4. For an address that left every waitlist, it stays after the rest of the contact is erased, together with the time of the last email asking it to confirm a request to join again, so that the limit of one such email every 30 days still holds. It is removed when the address joins a waitlist again or switches an optional email back on, from the Manage preferences link in one of our emails or with the Confirm link we send. For an address that bounced, was reported or was deleted, it is kept indefinitely.
  • Email delivery records: kept with your contact record. When your data is erased, they are unlinked from you and kept only as anonymous counts (email type, template and dates).
  • Bounce and automatic-reply messages that come back to our sending address: they can contain a copy of our email. We read them only to put the address on the suppression list, and delete them within 30 days.
  • Application logs: deleted after at most 30 days.
  • Backups: once a day we copy our database, so that the waitlist is not lost if something breaks. The copies are stored with our hosting provider (section 5), and each copy is deleted once it is 7 days old. So if you delete your data, it is gone from every copy about a week later. If we ever have to restore a copy, we first use our logs and our records of requests to find everyone who deleted their data after that copy was made, and erase it again.
  • Providers' request and security logs: our hosting and network providers, and the provider that forwards email to us, keep them only as long as needed for security and operations, under their data processing terms.
  • Records of the provider that sends our emails: for each email, your address, the subject, what happened to it (for example that it was delivered or bounced, with the answers of your mail server) and the internet address of our server that sent it. The provider deletes the content of an email once it has been delivered or delivery has failed for good, and any copy in its encrypted backups within 7 days. It keeps its records for as long as we use its service with our domain. When we erase your data because you asked us to, we also ask the provider, within a month, to delete its records of the emails we sent you. If an email to you cannot be delivered because your mailbox does not exist or is full, the provider stops sending our emails to your address: for a week the first time, for a month the second time, and after that until we lift the block. If our emails stop reaching you, write to the privacy contact above.
  • Our mailbox: messages to our addresses are kept there for the periods in this section. When we delete one, the provider of our mailbox (section 5) removes its copies from its systems on its own schedule, which its privacy policy describes.
  • Daily totals of page views, per page, and of sign-ups and confirmations (section 3): a total records no identifier and no time of day, a page's total for a day is written only once that day has ended, and for the reasons given in section 4 a total does not change when a contact is erased. We keep them for as long as the project runs.
  • Other messages you send us, such as a question or a reply to one of our emails: kept while we answer them and for 12 months after our last reply, then deleted, unless they become part of a request about your rights.
  • Correspondence about your rights: kept for 3 years after the request is closed, which is the limitation period for claims for damages under the Lithuanian Civil Code (Article 1.125(8)), then deleted.

8. Your rights

Under the GDPR you can see the data we hold about you (Article 15) and have it corrected (Article 16). When the conditions set by the GDPR are met, you can also have it erased (Article 17), limit how we use it (Article 18) and, for data you gave us that we use with your consent, get it in a structured, machine-readable format (Article 20). You can withdraw any consent at any time. That does not affect what we did before you withdrew it (Article 7(3)).

You have the right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. You can also object at any time, without giving a reason, to direct marketing (Article 21).

  • Change or stop optional emails, or leave the waitlist (this takes you off every waitlist you joined), with the Manage preferences link in any email from us.
  • Once you have left every waitlist with no optional email on, we stop emailing you. The only exception is an email asking you to confirm, if someone uses your address to sign up again (at most once every 30 days) or to ask us to delete its data. To stop all email from us for good, use Delete my data.
  • Erase your data on the Delete my data page.
  • For anything else, write to the privacy contact above.

We answer within one month. For complex or numerous requests we may take up to two more months, and we will tell you why within the first month. Using your rights is free. If we cannot tell that a request comes from you, we may ask you to confirm it from the email address concerned.

9. Complaints

You can complain to a data protection authority. Our lead supervisory authority is the one in Lithuania, where we are established: the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt. You can also complain in the EU or EEA country where you live or work, or where you think the problem happened. We would appreciate the chance to sort out your concern first.

10. Do you have to give us your data?

No law or contract requires you to. We need your email address to put you on a waitlist and to check that the address is yours, so you cannot join without it. Everything else is up to you, including both optional emails, and saying no changes nothing about your place on the waitlist.

11. Automated decisions

We make no decisions about you by automated means, including profiling, that have legal or similarly significant effects on you.

12. Cookies and browser storage

Our public pages, including the pages our ads link to, set no cookies, store nothing in your browser and run no analytics script, advertising pixel or tag. The page counts in section 3 are made by our server from the requests it answers. Our network provider (section 5) protects the site from attacks, and sometimes has to check that a visitor is not automated traffic. If you pass that check, it may set strictly necessary security cookies on this site to remember that you passed. We do not use them for anything else. The admin area, used only by staff, sets one strictly necessary session cookie and keeps a security token for the open tab.

13. Security

Data travels to and from this site over encrypted connections. Only authorized staff can reach contact data, with role-based permissions and logged exports. The personal links in our emails never contain your email address. A link to confirm a sign-up or a deletion holds a random value that works only once, and our database keeps only a one-way fingerprint of it. A preferences or unsubscribe link holds a signed value that our server checks and does not store. No system is perfectly secure. If a breach is likely to put you at high risk, we will tell you without undue delay.

14. Age

The waitlists are for adults. Please do not join if you are under 18.

15. Changes to this notice

When this notice changes, the version at the top changes too. The version in force is always the one on this page. Consent records always keep the version of the text you saw. If we want to use data you already gave us for a purpose this notice does not describe, we will first tell you about the new purpose, with anything else this notice would have to say about it, and we will do so only with a legal basis.