SHEN.AI Software Development Kit (SDK) PRIVACY NOTE
Local On-Device Processing Configuration
Effective date: 14.10.2026 | Version: 1.2
PRIVACY COMMITMENT
The Shen.AI SDK configuration covered by this Notice performs all scan-related processing locally on the end user’s device. Scan Data do not leave the device and are not transmitted or otherwise made available to Shen.AI. Shen.AI does not receive, access, collect, store, retain, disclose, transfer or otherwise process Scan Data.
Shen.AI OÜLõõtsa tn 8a, 11415 Tallinn, Estonia
Poland: ul. Gwiaździsta 66, 54-413 Wrocław, Poland
1. Purpose and scope
This Privacy Notice applies exclusively to the Shen.AI Software Development Kit (the “SDK”) when integrated into a third-party application in a configuration in which all scan-related processing is performed locally on the end user’s device and no Scan Data are transmitted to Shen.AI.
This Notice explains the privacy characteristics of that configuration and the role of Shen.AI. It does not govern any separate processing carried out by the provider of the application that integrates the SDK (the “Application Provider”). Any such processing must be described by the Application Provider in its own privacy notice, where applicable.]
Shen.AI has appointed the Data Protection Officer. Should you have any queries, comments, or requests concerning your rights, please contact us at data@shen.ai or our Data Protection Officer Jarosław Wojcieszek at dpo@shen.ai.
2. Definitions
“Scan Data” means information used or generated by the SDK during a measurement process, including facial images or image frames temporarily processed on the device, facial-feature information, physiological signals, vital-sign estimates, measurement results and related scan information, excluding the aggregated usage count described in Section 3.
“Local Processing” means processing performed on the end user’s device without transmitting Scan Data to Shen.AI or making them remotely accessible to Shen.AI.
3. How the SDK operates
In the configuration covered by this Notice, the SDK uses the device camera and local computing resources to perform the measurement process on the device. Any image information required for the measurement is processed transiently on the device and is not retained by Shen.AI.
- All scan-related analysis and calculations are performed locally on the end user’s device.
- No photograph, video recording, video frame, signal, measurement result or other Scan Data is transmitted to Shen.AI.
- The SDK transmits to Shen.AI only an aggregated count of measurements performed, linked to the Application Provider’s licence and used for licensing and billing purposes. This count does not include any Scan Data, measurement results, device identifiers or other information relating to an identified or identifiable individual.
- No user account with Shen.AI is required for the SDK functionality covered by this Notice.
4. Personal data processed by Shen.AI
Shen.AI does not receive, access, collect, store or otherwise process Scan Data in the configuration covered by this Notice. In particular, Shen.AI does not process:
- facial photographs, video recordings or video frames;
- biometric templates, facial embeddings or facial landmarks received from the device;
- physiological signals, health-related information or vital-sign measurements;
- scan results or derived measurement data;
- scan identifiers, user accounts or user profiles connected with scan activity;
- Scan Data for research, product development, validation, testing, algorithm improvement or AI model training.
The SDK does not store photographs of the user’s face for Shen.AI. Scan Data remain on the device unless the Application Provider independently implements additional processing. Any such independently implemented processing is outside the scope of this Notice and must be assessed and disclosed by the Application Provider.
4.1 Business Contact and Service Data
The statements above relate specifically to Scan Data. Separately, Shen.AI may process limited personal data relating to representatives, employees, contractors and other persons cooperating with the Application Provider or other business partners where this is necessary to provide, implement, support, secure and administer the SDK service and the related business relationship ("Business Contact and Service Data").
Depending on the relationship and the communication channel, Business Contact and Service Data may include:
- name and surname;
- business contact details, including business email address and telephone number;
- employer, organisation, department, position or professional role;
- content of business correspondence and records of service, implementation or support requests;
- information necessary to manage contracts, orders, licences, invoicing, service delivery and cooperation;
- technical and security information connected with authorised business use of the service, to the extent it relates to an identifiable person.
Shen.AI may obtain Business Contact and Service Data directly from the individual or indirectly from the Application Provider, the organisation represented by the individual, publicly available professional sources, or another person involved in the business relationship. Where the data are not obtained directly from the individual, Shen.AI will provide the information required by Article 14 GDPR within the applicable period, unless an exemption applies. Shen.AI does not combine Business Contact and Service Data with Scan Data, because Shen.AI does not receive Scan Data in the configuration covered by this Notice.
5. Role of Shen.AI under the GDPR
For Scan Data processed exclusively on the device in the configuration described in this Notice, Shen.AI neither determines the purposes and means of any subsequent processing by the Application Provider nor receives or accesses the Scan Data. Accordingly, Shen.AI does not act as a controller, processor or recipient of such Scan Data within the meaning of Regulation (EU) 2016/679 (the “GDPR”).The Application Provider is responsible for determining its own role under applicable data protection law and for providing any information required in relation to personal data that it independently collects or otherwise processes through its application.For Business Contact and Service Data described in Section 4.1, Shen.AI OÜ acts as the controller because it determines the purposes and means of processing those data for the management, delivery, support, security and administration of the SDK service and the related business relationship.
6. Purposes and legal bases
Because Shen.AI does not receive or otherwise process Scan Data in this configuration, Shen.AI does not determine a purpose or legal basis for processing those Scan Data. Where the Application Provider independently processes personal data, including measurement results or other information available within its application, the Application Provider is responsible for identifying and communicating the applicable purposes, legal bases and, where relevant, conditions for processing special categories of personal data.
6.1 Purposes and legal bases for Business Contact and Service Data
Shen.AI processes Business Contact and Service Data for the following purposes and on the following legal bases:
- to take steps at the request of a contracting individual and to perform a contract with that individual, where Article 6(1)(b) GDPR applies;
- to manage and perform contracts with the Application Provider or another business partner, communicate with their representatives, coordinate implementation, provide support, administer licences and services, and protect or establish legal claims, on the basis of Shen.AI’s legitimate interests under Article 6(1)(f) GDPR;
- to comply with legal obligations, including accounting, tax, sanctions, record-keeping and regulatory obligations, where Article 6(1)(c) GDPR applies;
- to maintain the security, integrity and reliability of the SDK service and related business systems, on the basis of Shen.AI’s legitimate interests under Article 6(1)(f) GDPR.
The legitimate interests pursued by Shen.AI are the effective administration and performance of business relationships, delivery and support of the SDK service, protection of systems and information, and establishment, exercise or defence of legal claims.
7. Recipients and international transfers
Since Shen.AI does not receive or process Scan Data, Shen.AI does not disclose such data to recipients, share them with affiliates or service providers, or transfer them to third countries or international organisations.
7.1 Recipients and transfers of Business Contact and Service Data
Business Contact and Service Data may be disclosed, where necessary, to authorised Shen.AI personnel and to service providers supporting business communications, hosting, information technology, security, accounting, legal services, customer support or contract administration. They may also be disclosed to public authorities where required by law.
Shen.AI does not intend to transfer Business Contact and Service Data outside the European Economic Area unless this is necessary for the use of a service provider or another legitimate business purpose. If such a transfer takes place, Shen.AI will rely on a mechanism permitted by Chapter V GDPR, such as an adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses where applicable. Information about the applicable safeguard and how to obtain a copy will be made available on request.
8. Retention and deletion
Shen.AI does not retain Scan Data because Shen.AI does not receive them. No Scan Data are stored in Shen.AI systems under the configuration covered by this Notice.
Any retention of data by the Application Provider or on the end user’s device is outside the scope of this Notice and is subject to the Application Provider’s application design, instructions and privacy documentation.
8.1 Retention of Business Contact and Service Data
Shen.AI retains Business Contact and Service Data for the duration of the relevant business relationship and for as long as necessary to provide implementation, support and contract administration. After the relationship ends, the data may be retained for periods required by applicable accounting, tax, corporate or other legal obligations and for the limitation periods applicable to the establishment, exercise or defence of legal claims. Support and security records are retained according to the period necessary for operational continuity, security and accountability.
9. Data protection by design and by default
The local architecture is designed to minimise disclosure of personal data by keeping Scan Data on the end user’s device. The SDK functionality described in this Notice does not require the transmission of facial images, video recordings, physiological signals or measurement results to Shen.AI.
This architecture supports the principles of data minimisation, purpose limitation and data protection by design and by default. The Application Provider remains responsible for assessing the complete application, including any data flows, permissions, storage, analytics or integrations implemented outside the SDK’s local processing functionality.
10. Security
Keeping Scan Data on the device reduces the risks associated with transmission to and central storage by Shen.AI. Shen.AI applies appropriate technical and organisational measures to the software development and distribution processes under its control, taking into account the nature of the technology and relevant risks.
The Application Provider is responsible for the security of its application, its configuration of the SDK and any personal data processing that it independently performs.
11. Rights of individuals
Because Shen.AI does not receive or retain Scan Data, Shen.AI is not in a position to identify an individual from scan activity or to retrieve, correct, erase, restrict, export or otherwise act on Scan Data held only on the individual’s device or by the Application Provider.
Requests concerning personal data processed through the application should be directed to the Application Provider identified in that provider’s privacy notice. Individuals may also contact Shen.AI using the details below if they have questions specifically concerning the operation of the SDK or whether Shen.AI holds Scan Data.
11.1 Rights concerning Business Contact and Service Data
Where Shen.AI processes Business Contact and Service Data as controller, the individual may, subject to the conditions and limitations of the GDPR: request access to personal data; request rectification of inaccurate or incomplete data; request erasure of personal data; request restriction of processing; object at any time, on grounds relating to the individual’s particular situation, to processing based on Article 6(1)(f) GDPR; and receive personal data in a structured, commonly used and machine-readable format and transmit them to another controller where the right to data portability applies. Where processing is based on consent, the individual may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Shen.AI does not currently rely on consent for the processing purposes described in Section 6.1.
The individual has the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA Member State of the individual’s habitual residence, place of work or place of the alleged infringement. As Shen.AI OÜ is established in Estonia, a complaint may also be lodged with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email: info@aki.ee. Exercising this right does not affect any other administrative or judicial remedy available to the individual.
Providing Business Contact and Service Data may be a contractual requirement or a requirement necessary to enter into or perform a contract, manage the business relationship, provide implementation or support, maintain service security, or comply with legal obligations. The individual is not generally under a statutory obligation to provide the data, except where particular information is required by applicable law. Failure to provide data necessary for these purposes may prevent Shen.AI from entering into or performing the relevant relationship or delivering the requested service or support. Shen.AI does not use Business Contact and Service Data for automated decision-making, including profiling, that produces legal effects or similarly significantly affects the individual.
12. Automated decision-making
Shen.AI does not perform automated decision-making producing legal effects or similarly significant effects on individuals using Scan Data under the configuration covered by this Notice. Any decisions or further use of measurement results implemented by the Application Provider are outside the scope of this Notice.
13. Children
The SDK does not create an account with Shen.AI and does not transmit age information or Scan Data to Shen.AI. The Application Provider is responsible for determining the intended users of its application and for implementing any age-related notices, consent mechanisms or restrictions required by applicable law.
14. Changes to this Notice
Shen.AI may update this Notice to reflect changes in law or in the local processing configuration described here. If the SDK configuration changes so that Scan Data are transmitted to or otherwise made available to Shen.AI, this Notice will no longer accurately describe that processing and appropriate privacy information must be provided before the changed processing begins.
If Shen.AI intends to further process Business Contact and Service Data for a purpose other than that for which the data were collected, Shen.AI will provide the individual, before that further processing, with information about the new purpose and any other relevant information required by the GDPR.15.
Contact details
Questions concerning this Notice, the local operation of the SDK, or the processing of Business Contact and Service Data, as well as requests to exercise data protection rights, may be directed to:
Shen.AI OÜ
Lõõtsa tn 8a, 11415 Tallinn, Estonia
Poland: ul. Gwiaździsta 66, 54-413 Wrocław, Poland
Email: data@shen.aiData Protection Officer
Email: dpo@shen.ai