Privacy Policy | Shako Statistics

This Privacy Policy describes how Shako Statistics LLC ("Shako Stats," "we," "us," or "our") collects, uses, discloses, and protects information in connection with our website at https://shakostats.com and our marketing measurement and analytics service (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Who We Are and What This Policy Covers

Shako Stats provides a software-as-a-service platform for marketing measurement, including geo-incrementality testing, media mix modeling, forecasting, and related analytics. This Policy covers personal information we process when you visit our website, sign up for an account, use the Service, communicate with us, or otherwise interact with us.

This Policy does not cover information practices of third parties whose websites or services may link to or from the Service.

2. Information We Collect

We collect the following categories of information.

2.1 Account and Profile Information

When you create an account, we collect:

Name, email address, and (if you set one) a password (stored only as a one-way hash).
If you sign in with Google: your Google account ID, name, email, and profile picture URL.
Optional profile fields: company name, country, LinkedIn URL.
Email verification status and account approval status.

2.2 Early-Access Application Information

If you apply for early access, we collect your responses to application questions, including: your reason for interest, the marketing metrics you track, the marketing tools you use, where you heard about us, whether you are willing to provide feedback, and any feature requests you provide.

2.3 Billing Information

If you subscribe to a paid plan, we collect billing-related information through our payment processor, Stripe. Full payment card details are entered directly into Stripe and are not stored on our servers. We retain a Stripe customer identifier, subscription status, plan, and high-level billing records (invoices, payment dates).

2.4 Customer Data You Upload

The Service allows you to upload datasets (CSV, XLSX, or parquet files) containing marketing performance data — typically location identifiers (such as DMA, ZIP, or state), dates, conversion or sales counts, advertising spend, and optional covariates. We refer to this as "Customer Data."

You should not upload personal information (such as names, email addresses, customer-level identifiers, or other directly identifying information) unless you have a lawful basis to do so under applicable law and have hashed or otherwise pseudonymized the data prior to upload. You are responsible for the legality of Customer Data you upload.

2.5 Usage and Technical Information

When you use the Service, we automatically collect:

IP address (used at signup for one-time country detection via ipapi.co, and for security audit logs).
Browser type, operating system, device type, language, and time zone.
Pages visited, features used, and timestamps.
Authentication and session information (see Section 5 on cookies).
Audit logs of security-relevant events: account creation, login, legal-acceptance events (recorded with version, IP address, and timestamp), administrative actions.

2.6 Communications

If you email us, fill out a contact form, or communicate with our support team, we collect the contents of those communications and any information you choose to provide.

2.7 Google User Data (Sign in with Google)

If you sign in using Google OAuth, we receive your Google account ID, name, email address, and profile picture URL from Google. We use this information solely to create and authenticate your account.

We do not access, collect, or store your Google Ads, Google Analytics, Google Search Console, Gmail, Drive, or any other Google service data through this authentication. If we offer optional integrations with such Google services in the future, we will request additional consent at that time, disclose what data we will access, and only use that data for the specific purpose you authorize.

We do not transfer Google user data to third parties except as necessary to provide the authentication and account features (for example, to our Google Cloud hosting environment), to comply with applicable law, or as part of a merger, acquisition, or sale of assets.

3. How We Use Information

We use the information described above to:

Provide, operate, and maintain the Service, including authenticating your identity, generating Output from Customer Data, processing payments, and providing customer support;
Communicate with you about the Service, including transactional emails (account verification, security notices, billing receipts), product updates, and (if you have opted in) marketing emails;
Improve the Service, including diagnosing problems, monitoring performance, and developing new features;
Generate Aggregated Data — de-identified information combined across customers — for product improvement, statistical model training, benchmarks, and research (see Section 9);
Protect security and prevent fraud, abuse, and unauthorized access;
Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.

4. Subprocessors

We use the following third-party service providers ("subprocessors") to operate the Service. Each subprocessor receives only the information necessary to perform its function and is contractually bound to protect that information.

Subprocessor	Purpose	Location	Data Processed
Google Cloud Platform	Application hosting, file storage (Google Cloud Storage), background job queue (Cloud Tasks), text-to-speech	United States	All Service data including Customer Data
Stripe	Payment processing (PCI DSS Level 1)	United States	Billing details (entered directly into Stripe)
Resend	Transactional and product email delivery	United States	Recipient email, name, message content
Google (OAuth)	Sign-in with Google	United States	OAuth identifier, email, name, profile picture
Google Analytics 4 / Google Tag Manager	Website usage analytics and tag management	United States	Page views, IP address (truncated), device and browser type, referrer, anonymous identifiers via cookies
ipapi.co	One-time country detection at signup	United States / EU	Visitor IP address

Our public, current Subprocessor List is also available at /subprocessors. We will provide at least 15 days' advance notice of any new subprocessor that will process Customer Data, by email or in-product notice.

5. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service and to measure how the marketing site is used. Detailed information is in our Cookie Policy. Summary:

Strictly necessary cookies (shako_session_v1, shako_csrf_v1) — keep you signed in and protect against cross-site request forgery. The Service cannot function without these.
Analytics cookies — we use Google Analytics 4 (via Google Tag Manager) on our marketing website to measure aggregate page views, traffic sources, and feature interest. These cookies are set by Google. We do not use them for advertising targeting.

We do not respond to "Do Not Track" browser signals at this time.

6. How We Share Information

We do not sell or rent personal information. We share personal information only as follows:

Subprocessors. With the service providers listed in Section 4, under contracts that limit their use of the information.
Legal compliance and safety. When we have a good-faith belief that disclosure is necessary to comply with law, respond to legal process, enforce our Terms, prevent fraud, protect security, or protect the rights, property, or safety of any person.
Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets — in which case the acquirer assumes obligations under this Policy or notifies you of any material changes.
With your direction. When you direct us to share information (e.g., when you invite a teammate to your organization).

We do not share Customer Data with advertisers, data brokers, or AI/model training providers.

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer period is required by law. Specific retention windows include:

Category	Retention
Account profile and credentials	For the life of your account; deleted within 90 days after account closure (except as needed for legal, tax, or fraud-prevention purposes)
Customer Data uploaded files (CSV, XLSX, parquet)	2 years from upload, then automatically deleted
Test configurations, results, and Output	For the life of your account (and for the 30-day post-termination export window described in the Terms of Service)
Audit logs (login, legal acceptance, administrative actions)	7 years
Billing records	7 years (tax and legal recordkeeping)
Support communications	3 years from the last interaction
Aggregated Data	Indefinitely (cannot be re-identified)

You may request deletion of your account and personal information at any time by emailing info@shakostats.com. Some information may be retained as required by law or to resolve disputes.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information, including:

TLS encryption for data in transit;
Encryption at rest for stored Customer Data;
Scoped access controls and logged administrative actions;
One-way hashing of passwords;
Short-lived, scoped session tokens.

No security measures are perfect. We cannot guarantee that personal information, Customer Data, or Output will not be accessed, disclosed, altered, lost, or destroyed by unauthorized parties or as a result of hardware, software, or third-party subprocessor failure. You are responsible for maintaining the security of your account credentials and for keeping your own copies of any Customer Data important to you. If you believe your account has been compromised, contact us at info@shakostats.com. Any liability of Shako Stats arising from a security incident, data loss, data corruption, or unauthorized access — to the extent any liability exists and is not otherwise excluded by law — is subject to the disclaimers and limitations in Sections 12 and 13 of the Terms of Service, and to the data-loss provision in Section 5.5 of the Terms of Service. Nothing in this Section 8 expands or modifies those limitations.

9. AI, Machine Learning, and Aggregated Data

We may use Aggregated Data — Customer Data that has been de-identified and combined with data from multiple customers such that no individual or organization can be identified or re-identified — to improve our statistical models, generate industry benchmarks, conduct research, and develop new features.

We do not sell Customer Data. We do not use identifiable Customer Data to train artificial intelligence or machine learning models. We do not share identifiable Customer Data with any third-party AI or model provider.

10. Your Rights

10.1 All Users

Regardless of where you live, you can:

Access, update, or correct your account information through your account settings.
Request a copy of personal information we hold about you.
Request deletion of your account and personal information.
Opt out of marketing emails by clicking unsubscribe in any marketing email or emailing info@shakostats.com. (Note that we may still send transactional or administrative messages necessary for the Service.)

To exercise these rights, email info@shakostats.com. We will respond within a reasonable time, generally within 30 days. We may need to verify your identity before fulfilling a request.

10.2 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended:

Right to know what personal information we have collected, used, disclosed, and (if applicable) sold or shared.
Right to correct inaccurate personal information.
Right to delete personal information we hold about you, subject to certain exceptions.
Right to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
Right to non-discrimination for exercising your rights.

You may submit a request by emailing info@shakostats.com. You may also designate an authorized agent to make a request on your behalf, subject to verification.

10.3 Other U.S. State Residents

Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comparable privacy laws have rights similar to those described in Section 10.2. We honor requests from residents of those states on the same basis. Contact info@shakostats.com.

10.4 EEA, UK, and Other Non-U.S. Residents

The Service is operated from the United States and is currently directed at U.S.-based customers. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with comprehensive privacy law, certain rights (such as access, rectification, erasure, restriction, portability, and objection) may apply under your local law. We will honor reasonable requests on a case-by-case basis. Contact info@shakostats.com. We do not currently offer Standard Contractual Clauses, a Data Processing Addendum, or appoint an EU/UK representative; if your organization requires those instruments, please contact us before signing up.

11. International Transfers

The Service is operated from the United States, and personal information you provide will be transferred to, stored, and processed in the United States and other countries where our subprocessors operate. By using the Service, you consent to this transfer. If your local law prohibits or restricts the transfer of personal information to the United States, do not use the Service.

12. Children's Privacy

The Service is intended for business users and is not directed at children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please email info@shakostats.com and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes (such as new categories of information collected, new uses, or new subprocessors processing Customer Data) will be communicated by email and by an in-product notice at least 15 days before they take effect. Non-material changes take effect on posting, with the "Effective Date" updated above.

We encourage you to review this Policy periodically.

14. Contact

For privacy questions or to exercise your rights:

Email: info@shakostats.com
Mailing address: Shako Statistics LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA

For security-related concerns: info@shakostats.com.