Privacy Policy
Last updated: October 7, 2026
This policy explains what data the SHio website collects — through the updates sign-up, the SHio Basic form, at purchase, in your account and through cookies — why, and who it is passed to.
1. Who controls the data
The controller of the data collected on this website is Individual Entrepreneur (FOP) Iryna Burman ("SHio"), address: 77 Prokhorovska St., apt. 18, Odesa, Ukraine. For any privacy matter, write to support@shio.co.il.
2. Information we collect
Updates sign-up: your email address. Template or Shopify theme purchase: the email you enter in the cart, a domain if you gave us one, and the payment details the bank sends us — amount, status, payment number and a masked card number (only the first and last digits). SHio Alive questionnaire: name, e-mail, WhatsApp number, line of business, your site's address and what the agent should know (details in «Ordering SHio Alive»). SHio Basic form: the business details you give and your email; after payment — the same payment details from the bank. Your account: as set out in «Your account». We do not collect or store payment card details: you enter the card number, expiry date and CVV on the bank's secure page, and they never reach us. You're under no legal obligation to provide any of this, but without it we can't get back to you or deliver what you ordered.
3. Chatting with Sofia, the AI sales agent
In the corner of the site you can write to Sofia — an AI sales agent (our own product, SHio Alive), not a person. The conversation starts only when you send a first message. If you tap the microphone, your browser turns your speech into text with its own speech-recognition service (for example from Google or Apple), under its own terms; the recording itself never reaches us or the conversation provider — only the text, and only after you press «Send». What is passed on: the messages you write, the address and title of the page you are on, and the conversation language. They are processed by the conversation provider ElevenLabs and the language model it runs (Google Gemini) to answer you, and are kept by ElevenLabs under its own privacy policy. The conversation is also kept in your browser's temporary storage (sessionStorage) until you close the tab, so the chat carries on when you move between pages. So that Sofia talks about what interests you, the chat remembers in your browser (localStorage) which pages and products you looked at and for how long — this stays on your device and reaches Sofia only inside a conversation you started. Clearing the site's data in your browser deletes it. Conversation transcripts are kept in the SHio Alive database for up to 90 days, to check the quality of the answers and that prices are right, and are then deleted. If you ask Sofia for an email reminder or for the answer to a discount request by email, your email address is kept only for that, and a reminder is sent once only. If you leave a name and phone number: they are stored in the SHio Alive service's database (with Neon) together with a short note on what you asked and the page address, and emailed to support@shio.co.il (via Resend, ImprovMX and Google), only so we can get back to you. To prevent flooding, a one-way hash of your IP address is kept, not the address itself. Don't write card details, ID numbers or passwords in the chat — Sofia will never ask for them. Using the chat is optional.
4. Ordering SHio Alive
The questionnaire on the SHio Alive page asks for your name, e-mail, WhatsApp number, line of business, your site's address and what the agent should know. The answers are stored as an enquiry in the database of our internal back-office system (with the database provider Neon), and a copy is emailed to support@shio.co.il — via the email service Resend and the forwarding service ImprovMX, into a Google Gmail mailbox. Your site's address, e-mail and answers are also stored in the SHio Alive service's database (with Neon), so that after payment we can build the agent from your site's public pages and e-mail you her settings. We don't store your IP address — only a one-way hash of it, to protect the form from spam. If you don't pay, the order is not used for anything else, and you can ask us to delete it at support@shio.co.il.
5. Your account
Opening an account is optional and is not a condition for buying. You're under no legal obligation to give us the data, but an account can't be opened without an email address. What we keep: your email address; your name, if you gave it or it came from Google; the site language; whether and when you asked for news; when the account was opened and when you last signed in; and when you accepted the Terms of Use and this policy and which edition of them you accepted — so that, if needed, we can show what you agreed to. If you sign in with Google we also keep a permanent identifier of your Google account. Signing in: the one-time code is valid for 10 minutes and is sent via Resend. We don't store the code itself, only a one-way hash of it, together with the number of attempts and of codes sent — to block guessing. With Google we ask Google only for your email address (and only if Google has verified it), your name and the identifier — no password and no access to anything else in the account; Google sign-in is also subject to Google's own terms and privacy policy. After you sign in, a signed sign-in cookie (shio_account) is kept in your browser for up to 60 days; scripts on the page can't read it. What it shows: the orders and sites bought with the same email address, and up-to-date download links for files you paid for. That is why you should keep access to your mailbox safe: anyone who can get into it can get into the account. Why: to show you your orders, sites and downloads, send the sign-in code, remember your language and preferences, and protect the service against abuse. We don't use account data for advertising and don't pass it to advertisers; marketing email is sent only if you ticked that separately (see «Mailing list»). Where: in our back-office database, with Neon. How long, and deletion: the data is kept for as long as the account is open. You can delete it yourself at any time, from inside the account, or ask at support@shio.co.il. Deleting it erases your email, name, preferences and sign-in data, and removes the address from the mailing list. Orders and receipts are not part of the account and are kept after deletion for as long as the law requires (for example for tax purposes); copies in the database provider's backups disappear over time, on its backup cycle. You can open a new account with the same email at any time. The account is for people aged 18 and over.
6. An unfinished order
When you press «Proceed to payment» in the cart, we keep the email address you entered, the products, the amount and the site language. If the payment was not completed, we may send that address one message: to ask whether something went wrong and to give you a link back to your cart. This is not advertising and not a mailing list, and there will be no repeated reminders. If you want these details deleted, write to support@shio.co.il. An unpaid order is deleted on our side automatically after 90 days.
7. Customer reviews
About a week after a purchase (for SHio Basic, about a week after you accepted the site) we send one email to the order's address asking for a review. It is not marketing and no reminders follow. Writing a review is optional. What is stored: the rating, the text, the name and city you entered, the product, the order the link belongs to, your email address and when you sent it. What is published: after a short check by us, the review appears on the product page with the rating, text, name and city you entered, the date and a «Verified purchase» mark, and also in the page data that search engines such as Google read. Your email address is never published. We do not edit the text; we reject only abusive content, spam or personal details, and never hide a review because it is negative. We may reply under a review. Deletion: you can ask at any time at support@shio.co.il to remove or change your review, and we will do so within a reasonable time. The data is kept with Neon, in our management system's database.
8. Mailing list (e-mail updates)
If you signed up for updates — with the form at the bottom of the site or in your account — we keep your e-mail address and the site language you signed up in, with the e-mail service Resend. We will send you marketing e-mails (advertising) about new templates and products, in that language, and every such e-mail is clearly marked as advertising. Every e-mail has a one-click unsubscribe link; you can also switch it off in your account or write to support@shio.co.il. After you unsubscribe we send you no more marketing e-mails. Resend also records whether an e-mail was delivered and opened and whether a link in it was clicked, so we know the e-mails arrive; we do not sell your address or pass it to anyone else.
9. How we use it
To get back to you, send your order confirmation, build the site you ordered and transfer it to your accounts, check that the site doesn't involve content prohibited by our terms (the check is automatic, including by AI, and sometimes also by a person), and meet our legal obligations. We don't sell the data, and we won't use it for marketing without your separate consent.
10. Who it is passed to
Only the providers needed to deliver the service, and only for that purpose: the bank that accepts the payment — JSC Universal Bank (monobank, the plata by mono service): you pay on its secure page, and it processes the card and payment data under its own rules and the laws of Ukraine (including financial monitoring); the cloud infrastructure providers our site, databases and back-office system run on (Vercel for hosting, Neon for databases); the email service Resend, the mail-forwarding service ImprovMX and Google (the mailbox our email arrives in). SHio Basic form details also go to the AI provider Anthropic, to write the site's copy and check that it doesn't involve prohibited content, and to Netlify, when we create the site in your own Netlify account. Your support requests (from the site's admin panel or by email to support@shio.co.il) also go to Anthropic, to prepare an answer. Some providers operate outside Ukraine (mainly in the United States and the European Union), and the data may be stored there. When you sign in with Google, Google too, as described in «Your account»; and if you accepted measurement and advertising cookies, Google and Meta, as described in «Cookies and browser storage». Data is disclosed to an authority only where the law requires it. Data you give yourself to companies you have your own agreement with (for example Netlify, your domain registrar, ElevenLabs or your payment company) is handled under their own privacy policies, and SHio is not responsible for it.
11. Cookies and browser storage
Some cookies are needed for the site to work, and they are set without asking: the language you chose (locale, for a year), your sign-in to your account (shio_account, up to 60 days, only if you signed in), and your cookie choice itself (shio_consent, for 180 days). The cart, the accessibility menu settings and, after a payment, the order number (so a purchase is not counted twice) are kept in your browser’s local storage and are not sent to us. Measurement and advertising cookies load only after you press «Accept» in the cookie notice: Google Analytics and Google Ads (by Google) and the Meta Pixel (by Meta, the company behind Facebook and Instagram). They help us see which pages are viewed and which ads bring buyers, and show our ads to people who have already visited the site. Through them Google and Meta receive an identifier of your browser, the pages you visited and actions such as adding to the cart and purchasing (amount and products, no name and no payment details), and also use them under their own privacy policies. If you press «Decline», they don’t load at all. You can change your choice at any time via «Cookie settings» at the bottom of the site; withdrawing consent deletes these cookies from your browser. Separately, without cookies and without storing anything in your browser, our server counts visits anonymously: which page was opened, which site you came from, your approximate country and city, and the type of device. Your IP address is not stored; to count distinct visitors a one-way code is made from it that changes every day and cannot identify you. This data stays with us and is not passed to anyone.
12. Security
Data travels over an encrypted connection (https) and is kept with providers that apply standard security measures. Access to our back-office system is restricted and password-protected. No system is completely immune; if a serious security incident affects your data, we will notify you and the authorities as the law requires.
13. Retention and deletion
If you connected your Netlify account to the SHio app, its access key is kept encrypted only to deliver the site and, if you consented, for the 14-day support period, and is then deleted automatically (details in the Terms of Use). We keep the data for as long as it's needed to handle your enquiry or order, and as the law requires (for example, payment records). Under Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to know what data about you we process, to access it, to ask for it to be corrected or deleted, and to withdraw your consent to mailings. Write to support@shio.co.il and we will reply within 30 days; we'll delete whatever we're not legally required to keep. If you think we did not handle your request properly, you can contact the Ukrainian Parliament Commissioner for Human Rights or a court.
14. Contact
Questions about this policy: write to support@shio.co.il or reach us via the contact page.