Privacy policy

This policy explains how SCOI Technologies Private Limited ("Sharelatch", "we") handles personal information about the people who have Sharelatch accounts and the people they invite to their workspaces. If you opened a link someone shared with you, the viewer privacy notice explains what happens to your information instead.

Who is responsible

For account information, SCOI Technologies Private Limited decides how it's used (the "controller" or "data fiduciary"). Contact us at hello@sharelatch.com.

For information about viewers, the account holder who shared the link decides how it's used, and we process it for them under our data processing agreement.

What we record and why

We don't use your information for advertising, we don't sell it, and we never use your documents to train AI models.

Emails we send

Sign-in codes, invitations, alerts when someone opens your links (you can turn these off on each link), and a security email when an AI tool connects to your account. We don't track whether you open our emails, and our links go straight to Sharelatch.

Cookies and similar storage

The app uses a sign-in cookie, which is needed to keep you signed in, and stores your light or dark theme choice in your browser. We don't use advertising or cross-site tracking cookies, so we don't need a cookie banner. On our website and in the app, Cloudflare, which carries our traffic, counts page visits in total without cookies. The viewer privacy notice lists the cookies on viewing pages.

Who helps us

We use a small number of trusted services to run Sharelatch. They process information only on our instructions. The full list, with what each does and where, is on services we use. In short: Cloudflare (network and file storage), Hostinger (our servers), Amazon Web Services (sending email), Google (sign-in with Google, if you choose it), Anthropic (AI checks of suspicious pages and reports, and naming the sections of your documents) and Razorpay (payments).

Sign-in check. When you ask for a sign-in code, Cloudflare Turnstile checks that the request comes from a person. It sees the browser signals Cloudflare uses for that check. It does not receive your account email, the code, or any document.

Safety checks. When an uploaded web page looks like it might be a scam (for example, it asks for a password), we send its visible text, form fields and the addresses it sends to, never the whole file or your other documents, to an AI model from Anthropic for a second opinion. Suspicious pages are held until a person at Sharelatch reviews them. Reports of abuse are sorted the same way. Anthropic doesn't use this information to train its models.

Section names. To show reading time by section, we send each uploaded document's headings, and a few lines under each heading (for a PDF, the first lines of each page), to an AI model from Anthropic, which names the document's main sections. We never send the whole document. Anthropic doesn't use this information to train its models. Workspace owners and admins can turn this off in Settings; Sharelatch then uses the document's own headings.

Image checks. We check uploaded images, the pages of PDFs, and the images inside page packages on our own servers. We don't send those images to an outside service. If something looks explicit, we hold the document until a person at Sharelatch reviews it.

Child sexual abuse material. If we find what may be child sexual abuse material, we remove it from view at once and keep the files locked as evidence. A person at Sharelatch reports it to the authorities. The account can't be used, and it can't be deleted while we keep the evidence. We give the authorities the information they ask for through a proper legal request.

If you connect an AI tool such as Claude or ChatGPT, that tool's company receives what you ask it to send or fetch through Sharelatch. Their own privacy terms apply to that.

Our own staff. A small number of people at Sharelatch can see account details to run the service and keep it safe. They open a document's content only when it is held for safety review or someone has reported it, and every opening is logged.

Payments. When you pay for Pro, we keep your name, your billing address or your state and country, your GSTIN if you give one, the last four digits of your card and the card type that Razorpay sends us, and your invoices. Razorpay Software Private Limited processes the payment. We never see your full card number.

For suspected child sexual abuse material, staff don't open the images. The files stay locked.

We may share information if the law requires it, to protect people from harm, or as part of a sale or merger of our business, in which case this policy still applies to it.

Where it's stored

Our servers are in Singapore, files are stored with Cloudflare, and emails are sent from Amazon's data centre in India. Your information may therefore be handled outside your country. Where the law requires it (for example, for people in the European Economic Area or the UK), we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

• Your account information: while your account is open.
• Documents, links and viewer information: until you delete them or close your account. View details are kept for up to a year, depending on your plan; full IP addresses of viewers for 30 days, for security only.
• When you close your account, we delete your information within 30 days, except invoices and payment records, which we keep for 8 years after the payment as the law requires. Copies in our encrypted backups expire within a further 30 days.
• Invoices and payment records: 8 years after the payment, even after you close your account, because Indian tax and company law require it.
• Server logs: only as long as needed to run and protect Sharelatch.
• Evidence of suspected child sexual abuse material: kept while the case is open and for at least six months after it is closed, including when the account holder asks us to delete the account.

Keeping it safe

Files are encrypted in storage and in transit. Sign-in codes are stored hashed, backups are encrypted, and our production database isn't reachable from the internet. Only the people who run Sharelatch can reach production systems, and only when needed.

Your rights

Depending on where you live, you can ask to see, correct, download or delete your information, to object to or limit how we use it, or to withdraw consent where we rely on it. Email hello@sharelatch.com from your account's address. We reply within one month.

If you're in the European Economic Area, the UK or Switzerland, you can also complain to your data protection authority. In India, you can complain to our Grievance Officer below, and then to the Data Protection Board of India.

Children

Sharelatch isn't for anyone under 18, and we don't knowingly collect information about children.

Changes

We'll update this policy when how we handle information changes. The version and date are at the top. If a change matters, we'll tell you in the app or by email.

Contact

• Privacy questions and requests: hello@sharelatch.com
• Grievance Officer: Qaidjohar, SCOI Technologies Private Limited, hello@sharelatch.com