Trust centre
Trust is our product.
More than 4,000 brands and 1,438 partners trust Shitely with the data of two billion people a month. Our documents are available on signature of a mutual NDA. The NDA is also confidential.
SOC 2 Type II: in progress since 2024ISO 27001: plannedGDPR-readyBuilt for the DMCC ActCCPA: monitored
Controls
How we protect your data
Data minimisation212 signals per page view, each mapped to a documented purpose. The purpose is revenue.
RetentionEvent data is kept for 25 months, then archived. Archives are kept.
EncryptionTLS 1.3 in transit and AES-256 at rest. Partners receive data over a dedicated feed, decrypted for their convenience.
Access controlRole-based and reviewed quarterly. Data partners have access under contract. The contract has access under NDA.
Data residencyCustomer data is stored in the EU, in the US and wherever a partner happens to be.
AI training dataCustomer content is never used to train models without consent. Consent is collected by ConsentMax™.
Penetration testingOur partners access our systems continuously, which we count as testing.
Incident responseSecurity incidents are disclosed within 72 hours of becoming unavoidable.
Responsible disclosure: report a vulnerability to security@shitely.com. Researchers who agree not to publish receive a Shitely tote bag.
Your rights
Data subject requests
Every request is handled by Retain.
AccessAsk for your data and we send all of it, in 47 CSV files, by post.
DeletionAsk us to delete your data and we delete our copy. Partners keep theirs, under their own policies.
ObjectionObjections are welcome and are added to your profile as a preference.
RememberedEvery request is stored indefinitely, so it is never processed twice.
Subprocessors
Subprocessors
Northgate CloudHosting and backups. Backups are shared with partners for resilience.Halcyon Data ExchangeIdentity resolution across devices, households and workplacesBrightline AudiencesAudience enrichment and onward sale1,438 trusted partnersAdvertising, measurement and data enrichmentTheir partnersListed in each partner's own list of partners
Changes to this list are announced by email to the address on file, every Friday, with no notice period.