Privacy Policy
Updated:
Shager is a B2B tool that lets agencies and marketing teams schedule content and distribute it to the social media accounts they manage, and measure the clicks and leads it brings. Shager is operated by יניב פרסלר (Yaniv Presler). For any privacy question, write to yaniv.presler@gmail.com.
This policy covers the website shager.ai, the Shager app, and the short links that Shager creates. It is written for the people who use Shager (agency staff and their clients) and for anyone whose details an agency enters into Shager.
Who is responsible for your data
| Data | Who decides what happens to it | Our role |
|---|---|---|
| Your own Shager account (name, email, sign-in, team settings, billing contact) | יניב פרסלר (Yaniv Presler) | Controller |
| Website visitors and contact form messages | יניב פרסלר (Yaniv Presler) | Controller |
| Data an agency puts into its workspace about its clients and their audiences: client details, approval contacts, posts, media, connected accounts, short-link clicks and leads | The agency (our customer) | Processor, under our Data Processing Addendum |
If you are a client of an agency that uses Shager, the agency is responsible for your data. You can contact the agency directly, or write to us and we will pass your request on.
Self-hosted installations. Shager can also be installed on a customer's own servers. In that case the customer who runs the installation is the controller of all data in it, and this policy applies only to the extent that customer adopts it.
What data we store
Your account
- Name and email address.
- A hashed password, or the fact that you sign in with Google (we receive your name, email and profile picture from Google).
- Your role in the workspace and your team members.
Your work
- Clients, posts, captions, media files, schedules and campaign settings.
- Approval contacts that the agency enters (name, email, phone), their approval decisions and comments.
- Leads captured through Shager, as configured by the agency.
Connected social accounts
- The account or page ID, name, handle and profile picture.
- The permissions you granted and the access tokens the network issued. Access tokens are encrypted in our database.
- Publishing results: post IDs, links, status and metrics that the network returns.
Short-link clicks
When someone clicks a Shager short link, we record the time, the country, a coarse device type, the referring site, and a one-way visitor code that changes every day, so we can count unique visitors. IP addresses are not stored. The daily code cannot be turned back into an IP address and cannot link the same visitor across days.
Contact form
Name, email, company, your message and the time you sent it. We use it only to answer you, and delete it after 12 months.
Technical records
When you sign in to the app, your session records the IP address and browser type used, to protect your account; it is deleted when the session ends or expires. Our servers also keep short-term technical logs, such as error records, only as long as needed for security and troubleshooting. (This is separate from short-link clicks, where no IP address is stored.)
Your language and country
When you visit shager.ai we look up which country your IP address belongs to, so we can show the site in your language (Hebrew in Israel, English elsewhere). The lookup happens on our own server with a local copy of a country database; the address is not stored and not sent to anyone. IP geolocation by DB-IP, licensed under CC BY 4.0.
How we use it
Only to provide the service: to publish the content you scheduled to the accounts you connected, to show results and leads, to run client approvals, to keep the service secure, and to answer you.
We do not sell data. We do not use it for advertising. We do not use it to train AI models, ours or anyone else's.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service you signed up for | Performance of a contract (Art. 6(1)(b)) |
| Processing workspace data for the agency | On the agency's instructions, under the DPA |
| Security, abuse prevention, service logs | Legitimate interests (Art. 6(1)(f)) |
| Answering contact form messages | Legitimate interests, or steps before a contract |
| Keeping records the law requires | Legal obligation (Art. 6(1)(c)) |
YouTube and Google
Shager uses YouTube API Services to upload videos and post comments on channels you connect. By connecting a YouTube channel you agree to the YouTube Terms of Service. See also the Google Privacy Policy.
You can revoke Shager's access at any time in your Google security settings, or by removing the channel in Shager, which revokes access immediately.
Shager's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide the features you see in Shager.
- We do not transfer it to others except as needed to provide those features, for security, or where the law requires it.
- We do not use it for advertising, and we do not sell it.
- No person at Shager reads it unless you ask us to (for example in a support request), it is needed for security, or the law requires it.
- We do not use it to train AI models.
Facebook and Instagram
Shager publishes to Facebook Pages and Instagram professional accounts you connect, through Meta's official APIs. Facebook Pages connect with Facebook Login; Instagram accounts connect directly with Instagram Login, which gives us the account's id, username, name, profile picture and account type, and an access token to publish on its behalf.
To delete your data, remove the app in Facebook (Settings & privacy → Settings → Business integrations) or in Instagram (Settings → Website permissions → Apps and websites). We delete the access tokens immediately and show you a link where you can check the status of the deletion request. You can also email yaniv.presler@gmail.com.
TikTok and LinkedIn (coming soon)
TikTok and LinkedIn are not available in Shager yet. When they are, the same principles will apply: we will access only the accounts you connect, request only the permissions needed to publish and report, store tokens encrypted, follow each network's developer terms and data storage rules, and let you disconnect at any time. We will update this policy before they go live.
AI writing assistant
Shager has an optional writing assistant powered by Anthropic. When you choose to use it, the text you send to it (for example a draft caption or instructions) is sent to Anthropic to generate a suggestion. Nothing else is sent: not your contacts, your tokens, or your leads. Anthropic does not use this text to train its models under its commercial terms.
Who we share it with
- The social networks: the content you choose to publish, sent to the accounts you choose. The networks are destinations you pick, not our subprocessors, and their own policies apply.
- Service providers (subprocessors): server hosting (Hetzner Online GmbH — Helsinki, Finland (EU)) and the other providers listed on our subprocessors page.
- Anthropic: only text you send to the writing assistant, when you choose to use it.
- Authorities: only where the law requires it.
- A buyer of the business: if the business is sold or merged, under the same commitments, and we will tell you first.
Where the data is kept
Our servers are in the European Union: Hetzner Online GmbH — Helsinki, Finland (EU). Text you send to the AI writing assistant is processed by Anthropic in the United States, under the safeguards described in our DPA. Israel and the EU recognise each other as providing adequate protection for personal data.
How long we keep it
- While your account is active. On a deletion request (yaniv.presler@gmail.com), data is deleted within 7 days and from backups within 30 days.
- When you remove a channel, its access tokens are deleted immediately (for YouTube, also revoked at Google).
- Data retrieved from network APIs is refreshed or deleted within 30 days.
- Short-link click records are kept as part of the workspace's reports and deleted with the workspace.
- Contact form messages are deleted after 12 months.
Security
Traffic is encrypted (HTTPS), access tokens are encrypted at rest, and access to the servers is limited to the operator. More on our security page.
Your rights
Under the Israeli Privacy Protection Law, including Amendment 13 (in force since August 2025), you may ask to see the data we hold about you and to correct or delete it.
If the GDPR applies to you, you may also ask us to restrict or object to processing, to give you your data in a portable format, and to withdraw consent where we rely on it.
To make a request, write to yaniv.presler@gmail.com. We will answer within 30 days. If your data is in an agency's workspace, we will forward your request to that agency, which decides on it, and help it respond.
You may also complain to the Israeli Privacy Protection Authority, or to the data protection authority in your EU country.
EU representative: we have not yet appointed a representative in the EU under Article 27 GDPR. Until we do, contact us directly at yaniv.presler@gmail.com.
Cookies
We use only strictly necessary first-party cookies, for sign-in and for connecting accounts. No analytics, advertising or third-party cookies. Details on our cookies page.
Children
Shager is a business service. It is not meant for children, and we do not knowingly collect data about children under 16.
Changes
If we change this policy, we will update the date at the top. If a change matters, we will tell account holders by email or in the app before it takes effect.
Contact
יניב פרסלר (Yaniv Presler)
הכרמים 20/2, ישראל (HaKramim St. 20/2, Israel)