Privacy Policy

ShieldLLM ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share information when you use the ShieldLLM platform at shieldllm.io.

By using ShieldLLM, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Account Information

When you create an account, we collect:

• Username and email address
• Password (stored as a secure hash — we never store plain-text passwords)
• Full name (optional)
• OAuth profile data if you sign in via Google or GitHub (name, email, profile picture)

Usage Data

When you use the platform, we automatically collect:

• IP address and user agent of requests
• Prompts submitted to the scanner and AI responses received
• Scan results, vulnerability reports, and firewall decisions
• Scheduled scan configurations and run history
• Audit logs of actions taken within your account

Payment Information

Payments are processed by Stripe. We do not store your credit card number, CVV, or billing details on our servers. We only store your Stripe Customer ID and subscription status. Please review Stripe's Privacy Policy for how they handle payment data.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the ShieldLLM platform
• Process your scans and generate security reports
• Manage your account, subscription, and billing
• Send transactional emails (account confirmation, password reset, billing receipts)
• Detect and prevent abuse, fraud, or unauthorized access
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your scan data to train AI models.

3. Data Storage and Security

Your data is stored on secure servers. We implement industry-standard security measures including:

• Encrypted passwords using bcrypt hashing
• JWT tokens with short expiry windows and refresh token rotation
• HTTPS/TLS for all data in transit
• Security headers (HSTS, CSP, X-Frame-Options) on all responses
• Rate limiting and IP-based request controls

Scan data, including prompts and AI responses, is stored in our database and associated with your account. You can request deletion of your data at any time (see Section 6).

4. Data Sharing

We share your data only in the following circumstances:

• Stripe — for payment processing
• Railway — our hosting provider, where your data is stored
• LLM Providers — when you run scans, prompts are sent to the configured AI provider (OpenAI, Anthropic, or your self-hosted Ollama instance). We do not control how these providers handle data. Please review their privacy policies.
• Legal requirements — if required by law, court order, or to protect our legal rights

5. Cookies and Tracking

We use minimal cookies:

• refresh_token — an HttpOnly, secure cookie used to maintain your login session. This is a functional cookie required for the platform to work.

We do not use advertising cookies, tracking pixels, or third-party analytics services.

6. Your Rights

Depending on your location (EU/UK/California), you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Deletion — request that we delete your account and associated data
• Portability — request your data in a machine-readable format
• Objection — object to how we process your data

To exercise any of these rights, email us at shienwoi@shieldllm.io. We will respond within 30 days.

7. Data Retention

We retain your account data for as long as your account is active. Scan logs and request history are retained for 90 days by default. When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law.

8. Children's Privacy

ShieldLLM is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. International Transfers

ShieldLLM is hosted on Railway infrastructure. Your data may be processed in the United States. If you are located in the EU or UK, by using ShieldLLM you consent to this transfer. We take appropriate safeguards to ensure your data is protected in accordance with this policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Continued use of ShieldLLM after changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: shienwoi@shieldllm.io
• Website: shieldllm.io