Bu belge İngilizce ve İbranice olarak mevcuttur. Geçerli olan sürüm aşağıdaki İngilizce metindir.
Privacy Policy
Updated:
Shager lets creators, businesses and agencies, and private individuals too, schedule content, distribute it to the social media accounts they manage, and measure the clicks it brings. Shager is operated by Yaniv Presler, a sole proprietor registered in Israel (contact details at the end of this policy). For any privacy question, write to hello@shager.ai.
This policy covers the website shager.ai, the Shager app, and the short links that Shager creates. It is written for the people who use Shager (individuals who manage their own accounts, agency staff and their clients), for people whose details a user enters into Shager, and for the people behind AI agents that use Shager through its API.
Who is responsible for your data
| Data | Who decides what happens to it | Our role |
|---|---|---|
| Your own Shager account (name, email, sign-in, team settings) | Yaniv Presler | Controller (database owner) |
| Website visitors and contact form messages | Yaniv Presler | Controller (database owner) |
| Data an agency or business puts into its workspace about its clients and their audiences: client details, approval contacts, posts, media, connected accounts and short-link clicks | The agency or business (our customer) | Processor (holder), under our Data Processing Addendum |
| The workspace of an individual who uses Shager for their own accounts: posts, media, connected accounts and short-link clicks | Yaniv Presler, only to provide the service to that user | Controller (database owner) |
If you are a client of an agency that uses Shager, the agency is responsible for your data. You can contact the agency directly, or write to us and we will pass your request on.
Self-hosted installations. Shager can also be installed on a customer's own servers. In that case the customer who runs the installation is the controller of all data in it, and this policy applies only to the extent that customer adopts it.
What data we store
Your account
- Name and email address.
- A hashed password, or the fact that you sign in with Google (we receive your name, email and profile picture from Google).
- Your role in the workspace and your team members.
Name and email are required to open an account: without them we cannot open it or send you sign-in links. No law requires you to give us any personal data, but without the required details we cannot provide the service. Everything else is optional.
Your work
- Clients, posts, captions, media files, schedules and campaign settings.
- Approval contacts that you enter (name, email, phone), their approval decisions and comments. Removing a contact stops all new requests to them; their past decisions stay in the post's history.
Shager does not collect leads itself. It counts clicks on short links, and your own website or form collects the leads.
Connected social accounts
- The account or page ID, name, handle and profile picture.
- The permissions you granted and the access tokens the network issued. Access tokens are encrypted in our database.
- Publishing results: post IDs, links, status and metrics that the network returns.
Short-link clicks
When someone clicks a Shager short link, we record the time, the country, a coarse device type, the referring site, and a one-way visitor code that changes every day, so we can count unique visitors. IP addresses are not stored. The daily code is computed with a secret key, is not designed to be turned back into an IP address, and does not link the same visitor from one day to the next.
Contact form
Name, email, company (optional), roughly how many accounts you manage (optional), your message and the time you sent it. Name, email and message are required so we can answer you. We use it only to answer you. A copy of each message is sent to our support inbox. We keep messages for 24 months after your last message, and then delete them automatically.
Technical records
When you sign in to the app, your session records the IP address and browser type used, to protect your account. A session lasts up to 30 days. Signing out deletes it, and expired sessions are deleted automatically 30 days after they expire. Sign-in links, verification links and password-reset links are deleted once they expire. When you use the writing assistant, we count its use (which feature, how much text) to apply your plan's monthly allowance, without keeping the text. Our servers also keep short-term technical logs, such as error records, only as long as needed for security and troubleshooting. (This is separate from short-link clicks, where no IP address is stored.)
Your language and country
When you visit shager.ai we look up which country your IP address belongs to, and read the languages your browser asks for (the Accept-Language header), so we can show the site in your language: your country's language, and in a country with several, the one your browser prefers among them; English when we don't have yours. The lookup happens on our own server with a local copy of a country database; the address and your browser's languages are not stored and not sent to anyone. IP geolocation by DB-IP, licensed under CC BY 4.0.
Nothing is saved in your browser for this. Only if you pick a language with the language switch do we remember your choice, in the shager_lang cookie (see the Cookie Policy).
If you have a Shager account, we save in it the language you use the app in, so we can send you emails in that language (for example, a report on a post that was published or failed).
How we use it
Only to provide the service: to publish the content you scheduled to the accounts you connected, to show results, to run client approvals, to send the emails the service needs (sign-in links, approval requests, notifications), to keep the service secure, and to answer you.
We do not send marketing emails unless you have agreed to receive them, and every such email will let you unsubscribe.
We do not sell data. We do not use it for advertising. We do not use it to train AI models, ours or anyone else's. We do not make decisions about people by automated means alone that have legal or similarly significant effects on them.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service you signed up for | Performance of a contract (Art. 6(1)(b)) |
| Processing workspace data for the agency | On the agency's instructions, under the DPA |
| Security, abuse prevention, service logs | Legitimate interests (Art. 6(1)(f)) |
| Answering contact form messages | Legitimate interests, or steps before a contract |
| Sending service emails (sign-in, approvals, notifications) | Performance of a contract |
| Keeping records the law requires | Legal obligation (Art. 6(1)(c)) |
YouTube and Google
Shager uses YouTube API Services to upload videos and post comments on channels you connect. By connecting a YouTube channel you agree to the YouTube Terms of Service. See also the Google Privacy Policy.
You can revoke Shager's access at any time in your Google security settings, or by removing the channel in Shager, which revokes access immediately.
Shager's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide the features you see in Shager.
- We do not transfer it to others except as needed to provide those features, for security, or where the law requires it.
- We do not use it for advertising, and we do not sell it.
- No person at Shager reads it unless you ask us to (for example in a support request), it is needed for security, or the law requires it.
- We do not use it to train AI models.
Facebook and Instagram
Shager publishes to Facebook Pages and Instagram professional accounts you connect, through Meta's official APIs. Facebook Pages connect with Facebook Login; Instagram accounts connect directly with Instagram Login, which gives us the account's id, username, name, profile picture and account type, and an access token to publish on its behalf.
To delete your data, remove the app in Facebook (Settings & privacy → Settings → Business integrations) or in Instagram (Settings → Website permissions → Apps and websites). We delete the access tokens immediately and show you a link where you can check the status of the deletion request. You can also email hello@shager.ai.
X (Twitter)
Shager publishes to X accounts you connect, through the official X API (X Corp.). Connecting an account gives us its id, username, name and profile picture, and an access token to post on its behalf. On X the tracked link is not added automatically; a post you write a link into counts against your plan's monthly allowance. You can revoke Shager's access at any time in X's connected apps settings, or by removing the account in Shager.
Shager publishes to LinkedIn personal profiles you connect, through LinkedIn's official API (LinkedIn Corporation, a Microsoft company). Connecting gives us your profile's id, name and picture, and an access token to post on your behalf. LinkedIn access tokens last 60 days, after which the profile must be reconnected. Company Pages will be added once LinkedIn approves our Community Management API access. You can revoke access at any time in LinkedIn's permitted services settings, or by removing the profile in Shager.
TikTok
Shager publishes to TikTok accounts you connect, through TikTok's official Content Posting API. Connecting gives us the account's id, display name and avatar, and an access token to post on its behalf. Until TikTok approves our app, posts can only be made to private accounts and are published as private ("only me"). Who can see a video, which interactions are allowed and any commercial-content disclosure are chosen per post. You can revoke access at any time in TikTok's connected apps settings, or by removing the account in Shager.
AI writing assistant
Shager has an optional writing assistant powered by Anthropic. When you choose to use it, the text you send to it (for example a draft caption or instructions) is sent to Anthropic to generate a suggestion. Nothing else is sent: not your contacts, your access tokens, or your click data. Anthropic does not use this text to train its models under its commercial terms.
AI agents, the API and MCP
Shager has an API and an MCP server, so AI agents can work in Shager on behalf of a person or an organization.
- API keys. An organization's owner can create keys for agents. We store only a one-way hash of each key, its name, its permissions and when it was last used.
- Agent log. Every call an agent makes is recorded in the organization's agent log: the operation, the workspace, the key, and whether it succeeded. The log never holds secrets or full content, and it is deleted with the organization.
- Agent sign-up. An agent can open a new, separate sandbox organization on its own. It gives us its name and may state its purpose, a contact email for its human, and the language for that email. We use the email only to send the link for claiming the sandbox (and a fresh link if the agent asks for one), never for marketing.
- Unclaimed sandboxes are deleted 7 days after they were opened, together with their posts, media files and the contact email. Once a person claims a sandbox, it becomes a normal account under this policy.
- An agent sees and changes only what its key allows. Who may use an agent, and what it does, is decided by the organization that created the key.
Who we share it with
- The social networks: the content you choose to publish, sent to the accounts you choose. The networks are destinations you pick, not our subprocessors, and their own policies apply.
- Service providers (subprocessors): server hosting (Hetzner Online GmbH — Helsinki, Finland (EU)), email delivery (Resend), our support inbox (Google Workspace) and the other providers listed on our subprocessors page.
- Anthropic: only text you send to the writing assistant, when you choose to use it.
- A payment provider: not yet. Shager does not take payments today. Before paid plans start, the provider will be named here and on the subprocessors page.
- Authorities: only where the law requires it.
- A buyer of the business: if the business is sold or merged, under the same commitments, and we will tell you first.
Where the data is kept
Our servers are in the European Union: Hetzner Online GmbH — Helsinki, Finland (EU). Text you send to the AI writing assistant is processed by Anthropic in the United States, emails we send pass through Resend in the United States, and messages to our support inbox are kept by Google (Google Workspace), which may store them in the United States and other countries where it operates.
Israel and the EU recognise each other as providing adequate protection for personal data. Transfers from Israel to other countries rely on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, including written undertakings from each provider to protect the data. Transfers of EU personal data to the United States rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. More in our DPA.
How long we keep it
- While your account is active. To delete your account and its data, write to hello@shager.ai from the account's email address. We complete deletion within 30 days of the request. If you are the only owner of an organization, its workspaces are deleted with it; we will tell you first.
- Backups rotate within 30 days, so deleted data also leaves our backups within 30 days.
- When you remove a channel, its access tokens are deleted immediately (for YouTube, also revoked at Google).
- Data retrieved from network APIs is kept until it is updated or deleted manually.
- Short-link click records are kept as part of the workspace's reports and deleted with the workspace. They contain no IP address.
- Contact form messages and support emails are kept for 24 months after the last message, then deleted.
- Sign-in sessions are deleted 30 days after they expire; sign-in and reset links as soon as they expire.
- Team invitations are deleted 30 days after they expire.
- Records the law requires us to keep (for example invoices, once paid plans exist) are kept for as long as the law requires, and used only for that.
- Media files stay in storage after publishing. To delete them, write to hello@shager.ai.
- Sandboxes an agent opened that nobody claimed are deleted 7 days after they were opened, with their posts, media files and contact email. The cleanup runs every hour and retries any deletion that fails.
Security
Traffic is encrypted (HTTPS), access tokens are encrypted at rest, and access to the servers is limited to the operator. More on our security page.
Your rights
Under the Israeli Privacy Protection Law, including Amendment 13 (in force since August 2025), you may ask to see the data we hold about you, and ask us to correct or delete data that is wrong, incomplete, unclear or out of date. You may also ask us to remove you from any mailing list used for direct marketing.
If the GDPR applies to you, you may also ask us to restrict or object to processing, to give you your data in a portable format, and to withdraw consent where we rely on it.
To make a request, write to hello@shager.ai. We may ask you to confirm your identity first, so we do not give your data to someone else. We will answer within one month. If we refuse a request, we will explain why and how you can challenge the decision. If your data is in an agency's workspace, we will forward your request to that agency, which decides on it, and help it respond.
You may also complain to the Israeli Privacy Protection Authority, or to the data protection authority in your EU country.
EU representative: we have not yet appointed a representative in the EU under Article 27 GDPR. Until we do, contact us directly at hello@shager.ai.
Cookies
We use only strictly necessary first-party cookies, for sign-in and for connecting accounts, plus a language cookie if you choose a language. No analytics, advertising or third-party cookies. Details on our cookies page.
Minimum age
You must be 18 or older to open a Shager account. Shager is not meant for children, and we do not knowingly collect data about anyone under 18. If we learn that we have, we will delete it.
Changes
If we change this policy, we will update the date at the top. If a change matters, we will tell account holders by email or in the app before it takes effect.
Contact
The controller (database owner) is:
Yaniv Presler
20/2 HaKramim St., Ness Ziona 7400451, Israel
Business no.: 031204175