Legal
Privacy Policy
Effective September 17, 2026
This Privacy Policy explains how Shadway, Inc. (“Shadway,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information in connection with our websites, software, APIs, SDKs, hosted agent infrastructure, and related products and services (collectively, the “Services”).
This Policy applies to personal information for which Shadway determines the purposes and means of processing.
When Shadway processes information on behalf of a business customer through the Services, that customer may be the controller or business responsible for the information, and Shadway may act as its processor or service provider. In those circumstances, you should also review that customer’s privacy notices.
1. Information We Collect
The information we collect depends on how you use Shadway and what capabilities you enable.
A. Account and Organization Information
We may collect:
- name;
- email address;
- account identifiers;
- organization name;
- organization membership;
- role and permission information;
- authentication information;
- profile information; and
- related account metadata.
We may receive some of this information from authentication providers we use to operate account access.
B. Customer Content
We process information that you, your users, your applications, or your agents provide to or generate through the Services.
This can include:
- prompts;
- instructions;
- Task or Task descriptions;
- files;
- forms;
- messages;
- correspondence;
- structured data;
- agent-generated content;
- user approvals and decisions;
- information retrieved from connected services;
- information received from third parties as part of a Task; and
- other content necessary to execute your instructions.
Customer Content may contain personal information about you or other individuals.
C. Task, Agent, and Execution Information
Because Shadway is designed to operate long-running, recoverable agent workflows, we may maintain information about the execution of Tasks.
This may include:
- Task goals;
- permissions and limits;
- enabled capabilities;
- agent configuration;
- execution status;
- actions proposed by an AI system;
- actions permitted or denied by policy;
- human approvals;
- external events;
- action results;
- evidence;
- errors;
- retries;
- checkpoints;
- timestamps;
- usage measurements;
- cost information;
- audit or ledger records; and
- related operational metadata.
D. Connected Accounts and Integrations
If you connect Shadway to another service, we may process information necessary to establish and use that connection.
Depending on the integration, this may include:
- provider account identifiers;
- OAuth connection information;
- authorization grants;
- scopes and permissions;
- opaque credential references;
- connection status;
- messages;
- files;
- events;
- account content; and
- other data made available by the connected service.
Where technically supported, Shadway is designed to avoid unnecessarily exposing underlying credentials to AI models.
For certain integrations, an integration provider may maintain the underlying OAuth connection while Shadway maintains the authorization and task-specific information necessary to use that connection.
You may disconnect integrations through the available product controls or the applicable third-party provider.
E. Email Information
If you enable email capabilities, we may process:
- email addresses;
- recipient information;
- sender information;
- subject lines;
- message bodies;
- message identifiers;
- thread identifiers;
- attachments;
- replies;
- timestamps;
- delivery information; and
- other information needed to send, receive, locate, or correlate messages.
The precise information processed depends on the provider and permissions you configure.
F. Telephone and Messaging Information
If you enable telephone or messaging capabilities, we may process:
- telephone numbers;
- message contents;
- call metadata;
- message metadata;
- delivery information;
- call status;
- timestamps;
- transcripts;
- recordings, where enabled;
- AI-generated speech or responses; and
- information provided during communications.
Not every call or communication is necessarily recorded. Whether recordings or transcripts are created depends on the applicable capability and configuration.
You are responsible for providing any notices or obtaining any consent required to record or monitor communications.
G. Browser and Website Interaction Information
If you enable browser capabilities, we may process information encountered while performing requested web actions, such as:
- URLs;
- page contents;
- form fields;
- accessibility or DOM information;
- screenshots or visual information;
- session information;
- action history;
- website responses;
- downloaded information; and
- information you authorize the agent to enter into a website.
Browser activity may contain personal or sensitive information depending on the Task.
H. Credentials, Secrets, and Protected Information
Certain Tasks may require API keys, access credentials, personal identifiers, account information, or other sensitive information.
Depending on the feature, Shadway may use mechanisms such as encryption, scoped credential references, aliases, access controls, approval requirements, and controlled disclosure to reduce unnecessary exposure of sensitive information.
We may process encrypted or otherwise protected versions of this information as necessary to provide the Services.
I. AI Model Information
When the Services call an AI model, we may transmit information necessary for the model to perform the requested function.
This may include portions of:
- your instructions;
- Task context;
- conversation or workflow state;
- retrieved information;
- tool results;
- external observations; and
- other relevant Customer Content.
The information transmitted depends on the Task and the model configuration.
If you configure your own model provider credentials, data may be transmitted to that provider under your account and subject to your agreement with that provider.
If you use a model managed by Shadway, Shadway may transmit information to the applicable model provider on your behalf.
Shadway does not use Customer Content to train a Shadway general-purpose foundation model.
Third-party AI providers process information according to the arrangements applicable to the relevant integration. If you use your own provider account, that provider’s terms and privacy practices may independently apply.
J. Payment and Billing Information
If you purchase paid Services, we or our payment and billing providers may process:
- billing name;
- billing address;
- payment method information;
- transaction information;
- invoices;
- subscription information;
- usage;
- credits;
- refunds;
- disputes;
- tax information; and
- related billing records.
Payment card information may be collected directly by our payment processor rather than stored by Shadway.
K. Website, Device, and Log Information
When you use our websites or Services, we may automatically collect:
- IP address;
- browser type;
- device information;
- operating system;
- request metadata;
- authentication events;
- pages or features accessed;
- referring information;
- timestamps;
- cookies or similar technologies;
- diagnostic information;
- performance information; and
- security logs.
L. Communications With Us
If you contact us, we may collect your name, contact information, message contents, support requests, bug reports, feedback, and related communications.
2. How We Use Information
We may use personal information to:
Provide and Operate the Services
Including to:
- authenticate users;
- create and manage accounts;
- execute Tasks;
- operate agents;
- perform requested actions;
- access authorized integrations;
- send communications;
- run browser sessions;
- process external events;
- provide APIs and SDKs;
- preserve long-running workflow state;
- process approvals;
- recover interrupted Tasks; and
- display execution history.
Enforce Permissions and Safety Controls
We may process information to:
- evaluate requested actions;
- apply limits;
- determine whether approval is required;
- restrict access to credentials;
- prevent unauthorized disclosure;
- detect abuse;
- verify execution;
- investigate unusual behavior; and
- protect users and third parties.
Maintain Reliability
We may use information to:
- debug failures;
- monitor performance;
- retry failed operations;
- reconcile ambiguous external outcomes;
- maintain execution history;
- restore Tasks following interruptions; and
- improve system reliability.
Improve Shadway
We may analyze usage, errors, performance, feedback, and aggregated or de-identified information to improve our products, infrastructure, user experience, safety systems, and documentation.
We do not use Customer Content to train a Shadway general-purpose foundation model.
Billing
We may use information to:
- measure usage;
- administer plans;
- calculate charges;
- process payments;
- administer credits;
- prevent billing fraud;
- resolve disputes; and
- maintain financial records.
Communicate With You
We may send:
- transactional messages;
- authentication messages;
- service notices;
- security notifications;
- approval requests;
- support responses;
- billing notices;
- product announcements; and
- marketing communications where permitted.
You may unsubscribe from marketing email using the instructions contained in those messages. Transactional or security communications may still be sent where necessary to operate your account.
Protect Shadway and Others
We may process information to:
- enforce our agreements;
- prevent fraud;
- investigate abuse;
- protect security;
- respond to incidents;
- protect legal rights; and
- comply with applicable law.
3. How We Disclose Information
We may disclose personal information in the following circumstances.
Service Providers
We use companies that help us operate the Services.
Depending on the functionality you use, these may include providers for:
- cloud infrastructure;
- databases;
- authentication;
- AI models;
- browser infrastructure;
- email integrations;
- telecommunications;
- SMS;
- telephone calling;
- connected-account infrastructure;
- billing and payments;
- analytics;
- observability;
- security;
- customer support; and
- other technical infrastructure.
These providers may process information on our behalf or, depending on your configuration, directly on your behalf.
Connected Services
When you instruct Shadway to interact with another service, person, or organization, we disclose information necessary to perform the requested action.
For example, sending an email necessarily transmits information to the recipient and email providers, and filling a website form transmits information to the operator of that website.
AI Model Providers
Information relevant to a Task may be transmitted to AI model providers as described above.
Your Organization
If you use Shadway through an organization, information concerning your account and activity may be available to authorized administrators of that organization.
Legal and Safety Reasons
We may disclose information if we reasonably believe disclosure is necessary to:
- comply with law, regulation, legal process, or governmental request;
- protect Shadway’s rights or property;
- enforce our agreements;
- investigate fraud or security incidents;
- protect the safety of users or others; or
- prevent unlawful activity.
Corporate Transactions
If Shadway is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction subject to applicable law.
With Your Direction
We may disclose information when you direct or authorize us to do so.
4. Sale and Sharing of Personal Information
Shadway does not sell personal information for monetary consideration.
As of the Effective Date, Shadway does not share personal information for cross-context behavioral advertising as those terms are defined under California privacy law.
If these practices change, we will update this Policy and provide any legally required opt-out mechanisms.
6. Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Policy.
Retention periods vary depending on the type of information and may consider:
- how long you maintain an account;
- the duration of an active Task;
- whether information is required for Task recovery;
- applicable service settings;
- contractual commitments;
- security and fraud-prevention requirements;
- billing and accounting requirements;
- dispute resolution;
- backup cycles;
- legal obligations; and
- applicable limitation periods.
Some Shadway plans or environments may have specific retention periods.
Deletion of an account or Task may not immediately remove information from backups or records that we are legally or operationally required to retain.
We seek to avoid retaining personal information longer than reasonably necessary for the applicable purpose.
7. Security
We use technical and organizational safeguards designed to protect information processed by Shadway.
Depending on the applicable system, these may include:
- encryption;
- authentication;
- access controls;
- organization-scoped credentials;
- permission checks;
- controlled access to secrets;
- credential isolation;
- durable authorization records;
- audit logging;
- disclosure controls;
- security monitoring; and
- other measures appropriate to the nature of the information.
No method of transmission or storage can be guaranteed completely secure.
You are also responsible for maintaining the security of your Shadway account, credentials, integrations, and organization permissions.
8. International Data Transfers
Shadway is based in the United States.
We and our service providers may process information in the United States and other countries.
Those countries may have privacy laws different from those in your jurisdiction.
Where applicable law requires a particular mechanism for international transfers of personal information, we will use an appropriate transfer mechanism.
Enterprise customers may contact us regarding applicable data processing and international-transfer terms.
9. Your Privacy Rights
Depending on where you live, you may have rights concerning your personal information.
These may include the right to:
- request access to personal information;
- request information about how personal information is processed;
- request correction;
- request deletion;
- obtain a portable copy of certain information;
- object to or restrict certain processing;
- withdraw consent where processing is based on consent;
- opt out of certain sales, sharing, targeted advertising, or profiling;
- limit certain uses of sensitive personal information; and
- appeal certain decisions concerning a privacy request.
These rights may be subject to exceptions under applicable law.
To submit a privacy request, contact legal@shadway.com.
We may need to verify your identity or authority before fulfilling a request.
If we process your information solely on behalf of one of our customers, we may direct your request to that customer.
You may use an authorized agent where permitted by applicable law.
We will not discriminate against you for exercising applicable privacy rights.
10. California Privacy Disclosures
If you are a California resident and the California Consumer Privacy Act (“CCPA”) applies to our processing, you may have additional rights.
Depending on how you interact with Shadway, during the preceding 12 months we may have collected categories of personal information including:
- identifiers;
- customer records information;
- commercial information;
- internet or other electronic network activity;
- geolocation information at the general level derived from network information;
- audio, electronic, or similar information where applicable to enabled communications features;
- professional or employment-related information you provide;
- inferences derived from your use of the Services; and
- sensitive personal information where you choose to provide it or where required for a Task.
The sources and business purposes for these categories are described elsewhere in this Policy.
We may disclose these categories to service providers, contractors, connected services, AI providers, or other recipients described in Section 3.
We do not sell personal information for monetary consideration.
As of the Effective Date, we do not share personal information for cross-context behavioral advertising.
Where applicable, California residents may request access, correction, deletion, or information concerning our collection and disclosure practices by contacting legal@shadway.com.
If Shadway begins using sensitive personal information for purposes that trigger a right to limit under applicable law, we will provide the required mechanism.
11. European Economic Area, United Kingdom, and Similar Jurisdictions
Where applicable data-protection law requires us to identify a legal basis for processing, the basis may include:
- performance of a contract, where processing is necessary to provide Services you request;
- legitimate interests, such as securing, operating, maintaining, and improving the Services;
- legal obligations, where processing is necessary to comply with law; and
- consent, where we ask for and rely on your consent.
Where we rely on legitimate interests, we consider the nature of the information, the context of processing, and its effect on individuals.
Where applicable, you may lodge a complaint with the data-protection authority in your jurisdiction.
12. Customer-Controlled Data
Businesses may use Shadway to process information concerning their customers, employees, vendors, or other individuals.
For Customer Content processed on behalf of those customers, the Shadway customer generally determines:
- why the information is processed;
- what information is provided;
- which capabilities are enabled;
- what external systems are accessed;
- how long a Task operates;
- who receives information; and
- what permissions an agent has.
If you have a question about information a Shadway customer processed concerning you, contacting that customer may be the most direct way to exercise your rights.
13. Children
The Services are not directed to children under 18, and we do not knowingly offer individual accounts to children under 18.
If you believe a child has provided personal information to Shadway contrary to this Policy, contact us at legal@shadway.com.
14. Third-Party Websites and Services
The Services may interact with or link to third-party websites and services.
Their privacy practices are governed by their own policies, not this Privacy Policy.
When an agent interacts with another service at your direction, information transmitted to that service may become subject to that service’s privacy practices.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to:
- our Services;
- our data practices;
- our providers;
- applicable law; or
- our business.
When we make material changes, we will provide notice where required by law.
The “Effective Date” above indicates when this version took effect.
16. Contact Us
For questions or requests concerning privacy, contact:
Shadway, Inc.
Email: legal@shadway.com
For legal notices unrelated to privacy: