Privacy, without the fog.

Who controls the data

Shozai is independently operated by Mike, who is the data controller. You can contact him directly at mnavton@gmail.com. If you previously submitted pilot details, you may also use the privacy request form to exercise a right or make a complaint. Shozai has not appointed a data protection officer or EU/UK representative.

What is collected and why

The website checker reads the public website you submit and sends relevant public text and buying questions to AI providers through Cloudflare AI Gateway. Reports contain AI answers, cited public pages, inferred rankings, and suggested improvements. Public previews reveal summary rankings, tested questions, and a few sources; verified free accounts unlock one complete answer, more sources, and one improvement; Pro accounts unlock the complete analysis. Reports are shared snapshots of public-web findings, not private workspace data. Anyone with the report address can see the preview and, after signing in, the fields included in their plan.

When you request a confirmation email, Shozai stores your email address and verified session in Cloudflare D1, and Cloudflare Email Service delivers your sign-in code or link. Cloudflare Turnstile helps prevent automated sign-in abuse. Entering the one-time code or clicking the link verifies your email. We use the address for authentication and report access, not automatic marketing enrollment. This processing is necessary to provide the account and report you request. Stripe processes payment details if you choose to subscribe; Shozai does not store card numbers.

Website-check reports and their generation records expire after 30 days and are deleted by the following daily cleanup. Rate limits prevent repeated checks from creating unlimited AI requests. Your free account remains until you request deletion using the contact details below.

The former pilot form collected work email, SaaS website, recommendation problem, and pricing intent. For previously delivered pilot reports, Shozai may retain the first report view and any accuracy, actionability, willingness-to-pay rating, or optional note submitted. These existing records remain subject to the retention, consent, and deletion controls below. Shozai no longer accepts new pilot applications.

The lawful basis for pilot contact and feedback is your consent. Submission is optional, creates no contract, and does not provide automatic product access. No solely automated decision with legal or similarly significant effect is made about you.

To protect public forms and scan endpoints from abuse, Shozai derives a shortened SHA-256 identifier from your IP address and, where applicable, workspace identifier. The application database stores that derived identifier as part of a fixed rate-limit bucket, together with the endpoint category, window, request count, and timestamps; it does not store the raw IP address in the bucket. This limited processing is based on Shozai’s legitimate interest in service security and availability.

Public and authenticated product pages may link to Shozai’s public Featurebase portal for feature requests, voting, comments, and roadmap updates. Featurebase is not embedded in Shozai, and Shozai does not automatically send your Shozai identity, current page, report data, or other Shozai account data to Featurebase. If you follow the link, Featurebase may process the request, vote, comment, or contact details you choose to submit, together with technical data needed to operate its service. This optional processing helps Shozai prioritize and respond to product feedback.

Recipients, hosting, and transfers

Founder-pilot data is available only to the Shozai owner and service providers needed to operate it: Cloudflare for application hosting, security, database and object storage, durable jobs, and transactional email. Shozai manages account authentication and access control using Better Auth. Cloudflare AI Gateway and its selected AI providers process the public-web material needed for a check; Stripe processes optional Pro subscriptions. Featurebase processes the product-feedback data described above only after you choose to visit the separate portal; you can review Featurebase’s privacy notice. These providers may process data in the United States and other countries where they or their subprocessors operate, using contractual transfer safeguards where required. Shozai does not sell pilot details or use them for bulk marketing.

Shozai records selected product actions in its own database and uses Cloudflare operational logs to diagnose service failures. The site does not load third-party client analytics. Automatic request logs and traces are disabled to avoid recording private bearer-link paths.

Shozai loads no Featurebase scripts, frames, or widgets. A browser connects to Featurebase only after a user deliberately follows the external feedback link. Private bearer-link report pages do not contain that link.

Retention and security

Founder-pilot intake and feedback records are normally deleted by the first daily cleanup after 90 days. A still-pending access, correction, restriction, objection, portability, complaint, or other rights request may extend the fulfillment period by up to 30 days. Once the original pilot submission reaches 120 days, the first daily cleanup removes the pilot record and request queue, normally before day 121. Delete and consent-withdrawal requests do not extend retention and remain eligible for the 90-day cleanup or earlier owner deletion. Deleting a pilot record also revokes its private report link. The underlying company analysis may remain as Shozai’s product data, but it is no longer linked to the deleted pilot intake or feedback record.

Rate-limit buckets use one-hour or 24-hour windows. After a bucket expires, Shozai keeps it for a one-hour safety buffer and then removes it through a daily cleanup, normally within 25 hours after expiry.

Shozai limits public submissions, keeps reports private by default, uses unguessable revocable links, excludes private-link pages and their bearer-capability API reads from account authentication and client telemetry, and restricts pilot operations to the owner account. No internet service can promise absolute security.

Your choices and rights

You may withdraw consent or ask for access, correction, restriction, objection, portability, or deletion where applicable. Use the contact email above for account and website-check requests. For an existing pilot record, use the same work email and SaaS website in the privacy request form. Shozai may ask for additional verification before disclosing or changing data. There is no fee in ordinary cases. Withdrawing consent does not affect processing already carried out lawfully.

Each matched rights submission is recorded in an append-only request queue and remains pending until the owner records that request’s resolution or permanently deletes the pilot record. A new submission never overwrites an earlier request; the public response does not reveal whether a record matched. The strongest pending request controls processing: a deletion request, withdrawal of consent, restriction request, or objection immediately pauses pilot processing and atomically revokes any linked private report. Deletion and consent-withdrawal requests cannot be resolved back into processing and remain blocked until hard deletion. Resolving another queue item recomputes any remaining hold, but does not recreate or reactivate the revoked bearer link. For a non-deletion request that is still pending at day 90, fulfillment may continue through day 120; the queue and pilot record are removed by the next daily cleanup, normally before day 121.

You may complain first through the same privacy request channel. You may also lodge a complaint with the data-protection supervisory authority where you live or work—for example, the Information Commissioner’s Office in the UK or your local EEA authority.

Privacy requests for existing pilot records

Changes

If Shozai materially changes how this data is used, this notice will be updated before the new use begins and, where required, affected pilot applicants will be told directly.