oship Privacy Policy
Last updated: October 10, 2026
This Privacy Policy explains how IsomorphX ("we", "us") collects, uses and protects personal data when you use oship, including the websites at oship.ai and oship.app and the oship web, mobile and desktop applications (the "Service").
In short:
- We collect what we need to run the Service, and nothing more.
- We never use your content to train AI models, and we never sell your data.
- Nobody at oship accesses your content, unless you explicitly ask us to or the law requires it.
- When you use an AI model or tool, the data needed for that task is sent to the provider you chose. The list of providers is on our Subprocessors page.
1. Who is responsible
The data controller is IsomorphX, SASU with a share capital of €1,000, RCS Paris 131 121 170, 42 rue du Faubourg du Temple, 75011 Paris, France.
For any question or request about your personal data, contact us at privacy@oship.ai.
Content about other people. When a business uses oship to process personal data about other people (for example clients or colleagues in its Library), that business is the controller of that data, and we act as its processor. A data processing agreement is available on request at privacy@oship.ai.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored as a hash only), identifiers from Sign in with Google or Apple | You, or Google or Apple when you sign in with them |
| Billing data | Plan, invoices, billing country, VAT number, payment status | You and our payment provider. We never receive your full card number. |
| Your content | Instructions, messages, files in your Library, Projects, deliverables, Teammate configurations, outputs | You and your Teammates |
| Website logins and App connections | Credentials, session data and access tokens for the services you connect | You |
| Usage and metering data | Projects run, models and tools used, compute consumed, usage per Teammate | Generated when you use the Service |
| Technical data | IP address, device and browser type, app version, logs, error reports | Generated when you use the Service |
| Analytics data | How you navigate and use the app's features | Collected with your consent (Section 7) |
| Communications | Messages you send to support, email preferences | You |
| Public profile | Username, and any social account you choose to link, when you share on Explore | You |
3. Why we use it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, and provide the Service, including running your Teammates and Projects | Performance of our contract with you |
| Bill you, collect payments and keep accounting records | Performance of the contract, and legal obligation |
| Secure the Service, prevent fraud and abuse, and fix errors | Our legitimate interest in a secure and reliable Service |
| Send you service emails (verification codes, password resets, Project notifications, billing) | Performance of the contract |
| Understand how the app is used in order to improve it (analytics) | Your consent |
| Send you news and product updates | Your consent, which you can withdraw at any time |
| Publish what you share on Explore | Performance of the contract, at your request |
| Respond to legal requests and enforce our Terms | Legal obligation, and our legitimate interest |
4. Your content and AI models
4.1 We never use your content to train AI models.
4.2 Your Teammates use the models and tools you choose. To complete a task, we send the provider of that model or tool the data the task needs (for example your instructions and the relevant files). These providers act as our subprocessors. Under their API terms, they do not train their models on the data we send them. Some may keep it for a limited time to prevent abuse. Each provider and its location are listed on our Subprocessors page.
4.3 Since you choose your models, you choose where this processing happens. Some providers process data outside the European Union, including in the United States and in Asia (Singapore and Malaysia).
5. Website logins and connected services
5.1 To let your Teammates sign in to websites and services for you, we store your credentials and session data in a dedicated vault:
- Encrypted at rest with a key specific to your account, itself protected by a managed key service.
- Not end-to-end encrypted. Our systems must be able to decrypt your credentials at the moment a Teammate uses them on your behalf, including when you are not online.
- Never sent to an AI model. Credentials are substituted directly into the website you authorized, and only on that website's domain.
- Recordings disabled. The remote browser we use runs with session recording and logging turned off.
- Visible to you. Every use of your credentials is recorded and shown in your account, with the Teammate and Project that used it.
5.2 You can disconnect a website or App, or revoke a Teammate's access, at any time from your settings.
6. Who can access your data
6.1 At oship. Nobody at oship accesses your content, unless you explicitly ask us to (for example in a support request) or the law requires it.
6.2 Our subprocessors. These are service providers who process data on our behalf, under contract, to deliver the Service:
- hosting and infrastructure;
- code sandboxes and the remote browser;
- AI models and tools;
- payments;
- transactional email;
- error monitoring and analytics.
The full, up-to-date list is on our Subprocessors page.
6.3 Other cases:
- Third-party services you connect. Teammates send them data when they use those services on your behalf.
- Authorities. When required by law.
- A successor. If our business is reorganized or sold, your data may be transferred to a successor that continues the Service, with notice to you.
6.4 We do not sell or rent your personal data, and we do not share it for advertising.
7. Cookies and analytics
7.1 We use a session cookie that is strictly necessary to keep you signed in. It doesn't require your consent.
7.2 We use product analytics (PostHog) only with your consent, which you can give or withdraw at any time in your settings. We use error monitoring (Sentry) to detect and fix bugs, based on our legitimate interest.
7.3 We do not use advertising cookies.
8. Where your data is stored, and international transfers
8.1 Your account data and content are stored in the European Union, in Belgium (Google Cloud, europe-west1 region).
8.2 Some of our subprocessors are located, or process data, outside the European Economic Area: in the United States, and for some AI models in Asia. When that is the case, we rely on one of the following:
- an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified providers);
- the European Commission's standard contractual clauses, together with additional measures where needed.
You can request a copy of the relevant safeguards at privacy@oship.ai.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data and content | As long as your account is open |
| Previous file versions and deleted files | 7, 30 or 90 days depending on your plan, then permanently deleted |
| Closed accounts | Content and account data deleted 30 days after closure |
| Inactive accounts (no sign-in for 12 months, no active subscription and no remaining top-up credit) | Deleted, after an email notice sent 30 days in advance |
| Technical logs | Up to 12 months |
| Identification and connection data we must keep as a hosting provider | As required by French law: up to 1 year for connection data, and up to 5 years after account closure for identity data |
| Invoices and accounting records | 10 years, as required by French law |
| Backups | Deleted data may remain in backups for a short period (up to 7 days) before being overwritten |
Usage and accounting data may be kept in anonymized form.
10. Security
We protect your data with appropriate technical and organizational measures, including:
- encryption in transit and at rest;
- strict separation of each user's credentials;
- access controls;
- monitoring.
If a data breach is likely to put your rights at risk, we will notify the competent authority and, where required, inform you.
11. Your rights
11.1 Under the GDPR, you have the right to:
- access your data;
- correct it;
- delete it;
- port it;
- restrict its processing;
- object to its processing.
You can also withdraw your consent at any time, and give instructions about what happens to your data after your death.
11.2 Many of these actions are available directly in the app: export your files, edit your profile, close your account, or manage your consents. For anything else, write to privacy@oship.ai. We respond within one month.
11.3 You can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority in your country of residence.
11.4 US residents. We do not sell or share your personal information for cross-context behavioral advertising. You can ask to know, correct or delete the personal information we hold about you by writing to privacy@oship.ai, and we will not discriminate against you for exercising these rights.
12. Children
The Service is not intended for anyone under 18, and we do not knowingly collect data about children.
13. Changes to this policy
We may update this policy. If the changes are significant, we will notify you by email or in the app before they take effect. The date at the top shows the latest version.
14. Contact
IsomorphX, 42 rue du Faubourg du Temple, 75011 Paris, France · privacy@oship.ai