Data processing

Scope

This page covers data processed through www.shaiban.co and sets out, at a high level, how Sheba processes personal data across its products and services. Data processed inside a client deployment of ChatSheba or a custom solution is governed by that engagement's own agreement — not by this page.

Sheba is the commercial brand of Shaiban Technology Ltd. Sheba is what you see in public; Shaiban Technology Ltd. is the legal entity you contract with.

Controller and processor roles

A data controller determines the purposes and means of processing personal data. A data processor processes personal data on behalf of, and under the instructions of, a controller. Sheba acts in both roles depending on the data.

Sheba is the controller for the data collected through this website (the form submissions described below), for data about its own employees and contractors, and for the authorized-user account data of its products.

Sheba is a processor for the data handled on a client's behalf: ChatSheba end-user conversation data (where the enterprise client is the controller), Social Sheba brand and content materials, the documents and business data fed into a Custom AI solution, and the internal business data shared during a consulting engagement. In each of these, the client is the controller and Sheba processes only on documented instructions.

What this website processes

This website has no account system, no login, and no database of its own. The only personal data it processes is what you submit through a form: your name, the contact channel you chose (a WhatsApp number or a work email), and the optional company, company size, industry, and message fields. It collects nothing you do not type in.

The website's forms are the /start project request, the contact form, and the Social Sheba waitlist signup. Each is processed for one purpose: to read your request, reply to it, and follow up about your project.

Lawful basis

For the data submitted through this website, Sheba processes personal data on the basis of your request to be contacted: it is processed lawfully, for the stated purpose of replying to and following up on your enquiry, and kept only as long as needed.

Across products and engagements, the lawful basis is the contract with the client and the client's documented instructions, supplemented where relevant by Sheba's legitimate interest in communicating with prospective clients. Sheba processes personal data in line with applicable data protection law: lawfully, for a stated purpose, with data minimization, and for no longer than necessary.

Where website data goes

When you submit a form, the details are transmitted server-to-server over an encrypted, cryptographically signed connection to Sheba's own operations system, which is the record of your request. The signature is HMAC-based and time-bound to guard against replay. A copy is also sent to the team by email and message so your request is never missed. Your data is never exposed in the browser, and this website stores none of it locally.

Website sub-processors

A small set of providers process this website's data on Sheba's behalf, each for one job. Plausible provides cookieless, privacy-first page-view analytics, with no cookies and no personal data. Resend sends the team an email notification of your submission. Telegram sends the team a message notification of your submission. Vercel hosts and serves this website. Each provider processes only what is needed to run the site and reach you.

Product sub-processors and AI providers

Inside ChatSheba and Custom AI solutions, processing involves a limited set of sub-processors determined by the deployment. Messages reach customers across the four ChatSheba channels — WhatsApp Business, Telegram, the website chat widget, and mobile-app integration via API — so the relevant messaging infrastructure for the channels in use receives the message content and associated metadata needed to deliver the service.

During inference, queries and conversation snippets may be passed to leading third-party AI model providers. Sheba is model-agnostic and selects providers based on the deployment's requirements and performance, using API configurations that prohibit providers from using submitted data to train their models. ChatSheba understands Arabic and its dialects, English, and most languages.

Cloud hosting and any other sub-processors are bound by written agreements, and region-specific deployment is available to clients with data residency requirements. Sheba does not sell personal data.

Per-deployment data boundaries

In ChatSheba and Custom AI deployments, each client's data is isolated within that deployment. On-premise and regulated-residency paths are available where data residency is a requirement; for on-premise deployments, data remains within the client's own infrastructure and Sheba retains no copies after the engagement ends. ChatSheba runs to a 99% uptime SLA.

Data Processing Agreement

Where Sheba acts as a processor, it enters into a written Data Processing Agreement (DPA) with the client. The DPA covers the scope, nature, and purpose of processing; the categories of data and data subjects; security obligations and technical safeguards; sub-processor notification and approval; data-subject rights procedures; breach-notification timelines; and the return or deletion of data on termination.

The client remains responsible for having a valid legal basis to share personal data with Sheba, for providing the required privacy disclosures to its end-users, and for complying with the data protection law applicable to it. To request a DPA, email legal@shaiban.space.

Retention and data requests

Website submissions are kept only as long as needed to answer you and keep a record of the engagement, then removed on request. Data processed inside a product or client engagement is retained for the period set out in that engagement's agreement, and is deleted or returned to the client on termination.

To access, correct, or delete the data Sheba holds about you, email legal@shaiban.space and we will respond within a reasonable period. For data processed through a product where Sheba acts as a processor, direct your request to the client, who is the controller; we will support them in responding.

Complaints

If you have a concern about how your data is handled, contact Sheba first at legal@shaiban.space so we can address it directly. If your concern is not resolved to your satisfaction, you may escalate it to the competent data protection authority in the applicable jurisdiction.

Disputes about this page are first addressed through good-faith negotiation for at least 30 days; failing resolution, they are subject to the competent courts of Yemen, or to arbitration where the parties have agreed to it. This page is governed by the laws of Yemen.