Privacy policy

Last updated: [DATE]

This Privacy Policy explains how [SHERA LEGAL ENTITY NAME] ("Shera", "we", "us") handles personal information in connection with our website and our virtual data room and secure document sharing service (the "Service").

1. Two roles: whose data is it?

Shera is a business tool. Who decides what happens to your information depends on how you interact with us.

• Content in data rooms and share links. When an organization (our "Customer") uploads documents to Shera, invites people to a data room, or sends a share link, the Customer controls that information and the activity data about who viewed it. For that data we act as a service provider / processor for the Customer, under our contract and Data Processing Agreement with them. If you were invited by a Customer, their privacy notice applies, and requests about that data should go to them. We will help them respond.
• Our own business data. For account and billing details, website visitors, marketing contacts and security logs about our own systems, Shera is the business / controller, and this policy describes our practices.

2. Information we collect

Account information (Customer users): name, email address, organization, role, password (stored hashed) or sign-in through Google or Microsoft, profile photo if provided, and notification preferences.

Billing information: billing contact, address, plan and payment history. Card details are collected and stored by our payment processor, Stripe; we do not see full card numbers.

Recipient information (people who view shared content, processed for Customers): email address, name if provided, verification codes, NDA acceptance (time, IP address, text accepted), and access permissions.

Document activity (processed for Customers): which documents and pages were viewed, for how long, downloads and prints, questions asked in data room Q&A, IP address, browser and device type. This is shown to the Customer and is the core purpose of the Service. Watermarks on pages show the viewer's email address and the date of viewing.

Content Customers upload: documents and files may contain personal information about anyone. We process it only to provide the Service to the Customer.

Usage and technical data: log data (IP address, browser, timestamps, pages and features used, errors), and security events such as sign-ins and failed login attempts.

Communications: messages you send to support or sales.

Cookies and similar technologies: see Section 7.

3. How we use information

We use information to:

• provide, secure and maintain the Service, including authentication, access controls, watermarking and audit logs;
• show Customers the activity data they are entitled to see;
• send service emails (sign-in links, verification codes, invitations, notifications and receipts);
• process payments and manage subscriptions;
• provide support and respond to requests;
• monitor performance, fix errors and improve the Service;
• detect and prevent fraud, abuse and security incidents;
• send product news to Customer users, which they can opt out of at any time; and
• comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Customer content to train AI models.

Legal bases (for people in the EEA, UK and Switzerland): performance of a contract (providing the Service), legitimate interests (securing and improving the Service, B2B marketing, preventing abuse), consent (where required, for example non-essential cookies), and legal obligation.

4. How we share information

• With the Customer that invited you: your activity on their content, as described above.
• With service providers ("subprocessors") that help us run the Service, under contracts that limit their use of the data. Current list:

We will keep an up-to-date list at [URL] and notify Customers before adding new subprocessors that process Customer data.

• For legal reasons: if required by law or valid legal process, or to protect the rights, safety or security of Shera, our users or others. Where lawful, we will notify the affected Customer first.
• If Shera changes hands: if Shera is involved in a merger, acquisition or sale of assets, subject to this policy's protections.
• With your direction or consent.

5. Where data is stored

Shera stores Customer data in North America: account data in the United States, and files in Cloudflare data centers in eastern North America (the United States or Canada). Cloudflare's global network may process data in transit near the person accessing it (for example, for encryption and security filtering). If you access the Service from outside the US, your information is transferred to North America. For transfers from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), [and/or the EU-US Data Privacy Framework where our providers are certified].

6. How long we keep information

• Customer content and activity data: for as long as the Customer keeps it in the Service, and deleted within [30] days after the Customer deletes it or their account ends, with backups expiring within a further [7/30] days.
• Account data: while the account is active, then deleted or anonymized within [90] days unless we need it for legal, tax or dispute purposes.
• Billing records: as long as required by tax and accounting law (typically [7] years).
• Security logs: up to [12] months.

7. Cookies

We use:

• Strictly necessary storage in your browser to keep you signed in, remember verified access to a share link, and remember your Light or Dark choice. It cannot be turned off.

We do not use advertising cookies, and there is no third-party analytics in the Shera app or the viewer. [Update this section if website visitor counts are added.]

8. Security

We use encryption in transit and at rest, per-customer data isolation in the database, short-lived file links, access logging, and restricted staff access. No system is perfectly secure; please tell us through our contact page if you suspect a problem.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights. California residents have rights under the CCPA/CPRA, and residents of other US states with privacy laws have similar rights. People in the EEA, UK and Switzerland have rights under the GDPR and may complain to their local data protection authority.

• If your data is in a Customer's data room or share link (for example, you were invited to view documents), please contact that Customer. We will forward requests we receive to them and support their response.
• For data Shera controls, email [PRIVACY EMAIL]. We will verify your request and respond within the time required by law. You may use an authorized agent where the law allows.

10. Children

The Service is for businesses and is not directed to anyone under 16. We do not knowingly collect their information.

11. Changes

We will post updates here and change the "Last updated" date. For material changes we will notify Customer account owners by email in advance.

12. Contact

[SHERA LEGAL ENTITY NAME] [POSTAL ADDRESS] Privacy questions: [PRIVACY EMAIL] [EU/UK representative, if required once there are EU/UK customers: NAME / ADDRESS]