Privacy Policy

Last updated: 11 July 2026 · Version 2.1 · Terms of Service

Your project data is yours. We process it to power AI analysis — never to train models, never to sell, never to share beyond what's needed to run the service.

1. Who we are

Senshin is operated by Alex Sakpoba, trading as Senshin (senshin.io), a UK sole trader. We build an AI-powered Project Delivery Operating System for professional project managers, programme managers, and delivery leads.

The data controller is Alex Sakpoba, trading as Senshin (senshin.io). Contact: privacy@senshin.io

2. What we collect

Account data

When you sign up: name, email address, organisation, role, and timezone. This is Tier 1 data — the minimum needed to create your organisation.

At sign-up we also derive your approximate location (country and city only) from your connection's IP address, then discard the address — it is never stored with your account. We use this solely to plan where to host data storage so your data can live closer to you.

Project delivery data

Everything you enter to manage your projects:

Projects — name, description, dates, methodology, phase, health ratings, budget, strategic alignment.
RAID — risks, assumptions, issues, decisions, dependencies — including severity, owner, status, and mitigation strategies.
Finance — budget lines, actuals, accruals, forecasts, variance, multi-currency rates.
People — stakeholder profiles, RACI assignments, communication styles, engagement levels.
Activities — tasks, milestones, dependencies (FS/FF/SS/SF), critical path, % complete.
Artefacts — uploaded documents, versioned files, and metadata.

AI interaction data

Every AI analysis run is logged: trigger source, AI depth level (Observe/Advise/Challenge), signals produced, recommendations generated, confidence scores, and your response (accepted/dismissed). This powers the immutable audit trail.

Usage data

Pages visited, features used, timestamps, device type, browser, and session duration. Collected via first-party telemetry only — no third-party analytics trackers.

3. How we use your data

Purpose	Data used	Legal basis
Operating the platform	Account, project data	Contract performance
AI analysis & reasoning	Project, RAID, finance, people data	Contract performance
Signal computation (29 dimensions)	All project data	Contract performance
Improving the product	Anonymised usage data	Legitimate interest
Anonymised benchmarking	Irreversibly anonymised project shape — budget band, methodology, phase, health, numeric ratios (no identifiers)	Legitimate interest
Service communications	Email, name	Contract performance
Billing and payments	Email, plan data	Contract performance
Security and fraud prevention	IP address, session tokens	Legitimate interest
Data-storage region planning	Approximate location (country/city, derived at sign-up; IP discarded)	Legitimate interest

Anonymised benchmarking — your right to object. We derive irreversibly anonymised benchmarks from project data so you can compare your delivery against peers, and so we can improve Senshin. Budgets are reduced to bands, every identifier is stripped, and a result is only ever shown when at least five projects share a cohort — so it can never be traced back to you or your organisation. Our lawful basis is legitimate interest, and you have an absolute right to object: turn benchmarking off in Settings → Privacy at any time, which stops it and deletes every anonymised snapshot already held.

4. AI processing — how it works

Senshin's reasoning engine operates in two stages:

Deterministic reasoning (runs on our servers) — extracts signals across schedule, budget, RAID velocity, resource, and governance dimensions. No data leaves our infrastructure for this stage.
LLM narrative generation — to turn those signals into human-readable analysis, recommendations, and challenge-mode scrutiny, your project context is sent to large language models through OpenRouter, an AI gateway. Every request carries a strict data policy (data_collection: deny) that instructs OpenRouter to route only to model providers that do not log, retain, or train on the request. A Google Vertex AI (Gemini, London region) path is retained as a fallback.

We never use your data to train AI models — and we route only to providers that don't either. No AI provider retains your project content after generating a response. This is enforced on every request, not left to a provider's default.

5. Where your data lives

All data is stored and processed in the europe-west2 (London) region on Google Cloud Platform:

Firestore — the primary store: project state, reasoning runs, AI narratives, audit logs, configuration.
Cloud Storage — uploaded artefacts and exported files.
Cloud Run — application compute (stateless containers).

All storage is encrypted at rest (AES-256) and in transit (TLS 1.3). Private IP networking between services — no data traverses the public internet within our infrastructure.

6. Who we share data with

We do not sell your data. We do not share it for advertising. Data is shared only with these processors:

Processor	Purpose	Location
Google Cloud Platform	Infrastructure, storage, fallback AI processing	London (europe-west2)
OpenRouter	AI model routing — no-logging, no-training, no-retention policy enforced on every request	US gateway → no-retention providers
Firebase Authentication	Identity and sign-in	EU
Stripe	Payment processing	EU/US
SendGrid (Twilio) / Brevo	Transactional email (primary and fallback)	EU/US

Each processor operates under a Data Processing Agreement compliant with UK GDPR. See our DPA for details.

7. Data retention

Active account: data retained for the lifetime of your account.
Closed projects: retained for 12 months after closure, then auto-archived.
Deleted account: when you delete your account, your projects and identity are permanently erased within 30 days by an automated erasure process — this is a genuine deletion, not a hidden flag. Export your data before deletion.
Anonymised benchmark snapshots: retained while benchmarking is on; deleted immediately if you opt out. As they carry no identifiers, they are not linked to your account.
Audit logs: retained for 24 months after account closure for compliance.
AI reasoning history: retained with project data. Deleted when the project is deleted.
Anonymised analytics: retained indefinitely (cannot be linked back to you).

8. Your rights under UK GDPR

You have the right to:

Access — request a copy of all data we hold about you.
Rectification — correct inaccurate data via your profile or by contacting us.
Erasure — delete your account and all associated data (Settings → Account → Delete).
Portability — export your data in JSON, PowerPoint, Word, or Excel format.
Restriction — request that we stop processing specific data while a dispute is resolved.
Object — object to processing based on legitimate interest, including anonymised benchmarking (Settings → Privacy).

To exercise any right, email privacy@senshin.io. We respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Cookies

We use minimal cookies — only what's needed to run the service:

Cookie	Purpose	Duration
ss_token	Session authentication	Session
ss_user_id	User identification	Session
ss_consent_v1	Cookie consent preference	1 year
ss_settings	Display preferences (theme, density)	1 year

No advertising cookies. No third-party trackers. Analytics cookies are optional and only set with your explicit consent. See our Cookie Policy for the full table.

10. Mobile app

If you use the Senshin iOS or Android app, the following additional data processing applies:

Category	What	Where stored
On-device data	A local copy of your project data for offline access, stored in an encrypted SQLite database	Your device only — never backed up to iCloud or Google
Push notification token	A device token issued by Apple (APNs) or Google (FCM) so we can send you alerts	Our server, linked to your account
Biometric data	We use your device's Face ID, Touch ID, or fingerprint sensor via the platform's Passkey/WebAuthn API. We never receive, store, or transmit biometric data — authentication happens entirely on your device	Your device only (secure enclave)
OTA updates	The app checks Capgo for web-layer updates. Your app version and platform are sent; no personal data is transmitted	Capgo (EU)

You can revoke push notifications at any time in your device settings. Deleting the app removes all on-device data. Your server-side account and data are unaffected by app deletion — use Settings → Delete my account to remove those.

11. Security

Firebase Authentication with session cookies (httpOnly, secure, SameSite).
Biometric lock screen (Face ID / Touch ID / Windows Hello) for unattended sessions.
IAM-based access controls — no passwords stored in our systems.
RBAC with 7 role templates and 28 granular permissions.
CSRF protection via double-submit cookie pattern.
Input sanitisation on all API endpoints.
Immutable audit trail — every data change, AI run, and login is logged and cannot be altered.
TLS 1.3 for all connections. Private VPC networking between services.

Report security vulnerabilities to security@senshin.io.

12. Children

Senshin is a professional tool for project delivery. It is not intended for users under 18. We do not knowingly collect data from minors.

13. International transfers

Your data is primarily processed in the UK (London). Where sub-processors operate outside the UK (Stripe, SendGrid), transfers are protected by Standard Contractual Clauses (SCCs) or UK adequacy decisions.

14. Changes to this policy

We may update this policy. Material changes will be communicated via in-app notification and email with at least 14 days notice. The "Last updated" date at the top always reflects the current version.

15. Contact

Alex Sakpoba, trading as Senshin (senshin.io)
United Kingdom
Privacy: privacy@senshin.io
Security: security@senshin.io
General: {{SUPPORT_EMAIL}}