Shiken

GDPR overview

GDPR compliance is claimed explicitly and backed by concrete artefacts rather than a badge alone. A Data Processing Agreement is published openly at /data-processing-agreement, last modified 1 September 2023, and covers the EU GDPR, the ePrivacy Directive, the UK GDPR, Swiss federal law, the CCPA and Australian privacy law. International transfers rely on the EU Standard Contractual Clauses of Decision 2021/914, the ICO's UK Addendum or an adequacy decision. Customers may object to new sub-processors within thirty days of notification. Data subject rights — access, rectification, erasure, objection, restriction and portability — are set out, with the UK Information Commissioner's Office named as the supervisory authority and info@shiken.ai as the single channel. No Article 27 EU representative and no Data Protection Officer are named anywhere on the site.

Who owns the data?

The terms draw a clear line. Everything the service produces or supplies — question banks, coaching and assessment rubrics, scores, generated feedback, summaries, avatars and virtual humans, collectively called System Content — remains the property of Meddicle Ltd. Customers may use it for their own internal business or educational purposes, but may not disclose it wholesale as delivered or use it to build a competing product. For personal data processed on a customer's behalf, including learner records, recordings and transcripts, the publisher acts as a processor under a published Data Processing Agreement, and the customer remains responsible for lawful collection, consents and authorisations.

Reuse rights

Customers may reuse System Content freely for internal business or educational purposes without asking permission, which covers running the generated courses, quizzes, roleplays and summaries inside their own organisation. Two limits apply without exception: the content may not be disclosed wholesale in the form the service delivered it, and it may not be used to build a competing product or service. Reverse engineering, decompiling or attempting to extract source code, object code, model weights or algorithms is also prohibited. Separately, the terms make the customer, not the publisher, responsible for telling meeting participants that recording and AI transcription are taking place and for honouring any request to stop or delete a recording.

Data retention & training

Hosting summary

The site makes no general statement about where customer data is hosted. The Data Processing Agreement confirms only that the publisher owns no hardware in its outsourced providers' data centres, that production servers and client-facing applications are logically and physically separated, and that hosting sub-processors maintain independently validated SOC 2 and ISO 27001 programmes. The security page says uploads are stored securely in the cloud in a data centre, without naming a country. Concrete locations appear only in the section covering Google data, where three sub-processors are named: Vercel Inc. in the United States for application hosting, Supabase Inc. in the US and EU for encrypted-at-rest storage, and Recall.ai Inc. in the United States for calendar sync and meeting-bot infrastructure. The privacy policy states that data may be transferred outside the United Kingdom, protected by adequacy decisions, Standard Contractual Clauses or the ICO's UK Addendum. Buyers with residency requirements should ask directly, since the published information is narrower than it first appears.