Shapi (“Shapi”, “we”, “us”) operates the job-matching platform at shapi.io. This policy explains what personal data we collect, why, how we use it, and the rights you have. By creating an account you agree to this policy.
1. Who we are
Shapi is operated by Ana O. Barber. For any privacy question or request, contact us at
hello@shapi.io. We are the data controller for the personal data described below.
2. Data we collect
- Account data — email address and password (stored hashed).
- Profile data — your CV, work history, skills, summary, headline, location, languages, profile photo, online-presence links, and right-to-work declarations.
- Conversation data — messages you exchange with Shapi (web and WhatsApp) and any voice notes you record, which we transcribe.
- Reference data — the names and contact details of referees you nominate, and the responses those referees provide about you.
- Payment data — handled by our payment processor (Stripe). We do not store your card number.
- Usage data — basic technical logs needed to run and secure the service.
- Marketing preferences — whether you have opted in to product and job-market emails, and how you heard about us.
3. How we use your data
- To build and display your verified profile.
- To contact the referees you nominate and compile an independent verification report.
- To match candidates with companies and surface relevant roles.
- To process payments and provide the features you have purchased.
- To send service emails (account, verification status). Marketing emails are sent only if you opt in, and you can unsubscribe at any time.
- To improve and secure the platform.
4. References — important
When you ask Shapi to verify you, we contact the referees you nominate (and the colleagues they in turn nominate). We tell each referee who we are, why we are contacting them, and that their input is confidential. Referees can decline. Their responses are used to produce your verification report; you are not shown who said what. If you are a referee and want your data removed, email
hello@shapi.io.
5. AI processing
We use AI services to build your CV, transcribe voice notes, translate reference responses, and cross-check claims across your references. These services process the relevant text/audio to provide the feature and do not use your data to train their public models under our agreements.
6. Service providers (processors)
We share data only with providers that help us run Shapi, under contract:
- Supabase — database, authentication, file storage.
- Vercel — application hosting.
- Stripe — payment processing.
- Resend — transactional and (opt-in) marketing email.
- Twilio — WhatsApp messaging.
- OpenAI / Deepgram — voice transcription.
- Anthropic — AI conversation, drafting, and cross-checking.
We do not sell your personal data.
7. Who can see your profile
Your profile becomes visible to companies on Shapi once it is verified and live. Your public profile link (shapi.io/p/…) can be opened by anyone you share it with. References are summarised on your profile (counts and an aggregated report) — individual referee identities and verbatim responses are not published.
8. Data retention
We keep your data for as long as your account is active. You can ask us to delete your account and associated data at any time by emailing
hello@shapi.io. Some records may be retained where required by law (e.g. payment records).
9. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your data, to object to or restrict processing, and to withdraw consent. To exercise any of these, email
hello@shapi.io. You can also unsubscribe from marketing email using the link in any such email.
10. Data location & security
Your data may be processed in the UAE, EU, UK, and US by us and our providers. We use access controls, encryption in transit, and row-level security to protect it. No system is perfectly secure, but we take reasonable steps to safeguard your information.
11. Children
Shapi is not intended for anyone under 18. We do not knowingly collect data from children.
12. Changes
We may update this policy. We will post the new version here and update the date above. Significant changes will be notified by email where appropriate.