This privacy policy describes how Sauce Media LLC (“Sauce Media”, “we”, “us”) collects, uses, shares, stores, and protects information when you use Henshu at henshu.app, including agency workspaces, sub-workspaces, shared review links, and other workspaces hosted on Henshu domains. It explains which companies help us run Henshu, including the AI providers behind its assistant and automatic transcription, how long we keep information, and how to use your privacy rights.
Henshu is used by teams. Each workspace has an owner — usually an agency or company — that decides who is invited and what is put into the workspace.
Organizations that need a data processing agreement with us can ask at hello@henshu.app.
We do not collect your Google, Dropbox, or social platform passwords.
We use information only for the purposes below. Where the EU or UK General Data Protection Regulation applies, the legal basis for each is shown. For workspace content, we act on the workspace owner’s instructions, and the owner determines its own legal basis.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide Henshu | Show workspaces, route tasks, deliver messages and notifications, store and play files and video, run the features you use, publish posts you schedule | Performance of our contract with you or your organization |
| AI features | Answer questions and take actions through Shu, transcribe Review audio, generate profile images you request (section 4) | Performance of contract; our legitimate interest in offering the features that are part of Henshu |
| Billing | Subscriptions, seats, invoices, payment status | Performance of contract; legal obligations (tax and accounting) |
| Service emails | Invitations, sign-in codes and links, password resets, welcome and account notices | Performance of contract |
| Security and support | Detect abuse, investigate incidents, keep audit records of workspace changes, fix bugs, answer support requests | Legitimate interests in keeping Henshu secure and working; legal obligations |
| Improve Henshu | Understand which features are used, using daily counts that do not identify you by name or email | Legitimate interests |
| Advertising measurement | Count visits, new accounts, and paid checkouts that follow ads we run, using Meta’s pixel and Conversions API (sections 2, 6, and 11) | Legitimate interests in measuring advertising we pay for. Do Not Track and Global Privacy Control turn this measurement off |
| Legal compliance | Respond to lawful requests, enforce our Terms, and handle privacy requests | Legal obligations; legitimate interests |
We do not sell personal information, show third-party ads inside Henshu, or give information to data brokers. We do share the limited identifiers in the advertising-measurement row above with Meta so Meta can measure and optimize ads we run for Henshu. That sharing is described in sections 6, 11, and 14. We do not make decisions that have legal or similarly significant effects about you based solely on automated processing.
Henshu includes features that send content to outside AI providers. Henshu does not use your content to train AI models. Each provider handles the requests it receives under its own terms and privacy policy, which can allow it to keep requests for a limited period, for example to detect abuse.
When someone asks Shu a question or asks it to do something — from Home, from a task, in a direct message with Shu, or by mentioning Shu — Henshu sends the request to OpenRouter, which passes it to an AI model. Each request includes:
Shu only receives information the person asking is allowed to see, and it acts with that person’s permissions. It does not receive the contents of files stored in Google Drive or Dropbox. Other members of your workspace can ask Shu about tasks and conversations that involve you. A workspace owner can disable AI in Workspace settings. This blocks new Shu requests, image generation and transcript processing in that workspace, including queued work that has not started. Data already sent to a provider cannot be recalled by changing a setting.
Henshu’s default assistant route uses Anthropic Claude Sonnet 5.5 with OpenAI GPT-6.1 Sol as a fallback through OpenRouter. Deployments may configure different models; Workspace settings displays the configured primary, fallback, image and transcription models. OpenRouter routes requests to the chosen model’s developer or hosting provider. Processing location depends on that provider and route; a workspace setting does not select or guarantee data residency.
Shu’s questions, answers, and actions are saved in your account (in Shu’s conversation history and your direct message with Shu) so you can continue a conversation and undo Shu’s changes.
When AI and transcript processing are enabled, Henshu can transcribe video or audio uploaded to Review or Publish, and voice messages, automatically in the background. Workspace owners can disable transcript processing separately from other AI features in Workspace settings. This stops new transcript jobs and transcript use by Shu; existing transcripts remain until removed through the applicable data-deletion controls. Files up to 30 minutes are supported; longer files are refused instead of processing a partial transcript. When configured, a local Whisper model processes audio on the Henshu server. Otherwise audio is sent to OpenAI Whisper, or through OpenRouter to the configured speech model (by default Google Gemini for Review and OpenAI Whisper for voice messages). The same controls apply when Shu runs a video QC check. A saved transcript identifies the provider/model used.
If you use the profile image generator, the name and description you enter and any reference photos you add are sent through OpenRouter to Seedream (ByteDance, China) to create an image. This only happens when you use the generator. Only add photos of other people if you have their permission.
These companies process personal information for us. “Location” is where they are based or where processing mainly happens; some process data in other countries too.
| Provider | What it does for Henshu | Information it receives | Location |
|---|---|---|---|
| Google Cloud (Google LLC) | Hosting, databases, file and video storage, video processing for Review, and backups | All information Henshu stores | United States (Iowa region) |
| OpenRouter, Inc. | Routes Shu, transcription (when OpenAI is not configured), and profile-image requests to AI models | The content described in section 4 | United States |
| AI model providers reached through OpenRouter, according to the configured route: Anthropic, OpenAI, Google and ByteDance | Generate Shu’s answers, transcripts, and profile images | The content described in section 4 for the feature used | China, the United States, and other countries, depending on the model and host |
| OpenAI (OpenAI, L.L.C.) | Transcribes Review audio, when Henshu is configured to use it | Up to 30 minutes of each Review file’s audio | United States |
| Stripe (Stripe, Inc. and affiliates) | Payments, subscriptions, invoices, and the billing portal | Billing contact details, workspace and subscription details, and payment information you enter on Stripe | United States and other countries |
| Resend | Sends Henshu’s emails | Recipient email address and name, and the email’s content (for example an invitation link or sign-in code) | United States |
| UploadPost (social publishing provider) | Connects social accounts, publishes the posts you schedule, and reads their statistics | Social account authorizations and profile identifiers, and the media, captions, and schedule of each post you publish | Spain |
| GitHub (GitHub, Inc., a Microsoft company) | Runs our automated daily check that backups can be restored | During each check, a copy of the archived Henshu databases and settings files described in section 9, which include account records (such as names, email addresses, and password hashes) and workspace content (such as tasks and comments). The copy is deleted when the check ends. | United States and other countries (machines GitHub runs in Microsoft Azure) |
| Google (Sign in with Google, Google Fonts), jsDelivr, and SheetJS | Sign-in with a Google account; deliver fonts, a document-preview library, and (only as a fallback) a spreadsheet-import library to your browser | Your Google account’s basic profile when you sign in with Google; your IP address and browser details when your browser loads fonts or a library | United States and global delivery networks |
| Meta Platforms, Inc. | Measures visits, signups, and purchases from ads we run, through the Meta Pixel in the browser and the Conversions API on our server | A hashed email address, IP address, browser type, Meta cookie identifiers, the page address without its query string, and the signup or purchase event, including the amount charged | United States and other countries |
More about how they handle data: Google Cloud data processing terms, OpenRouter, Stripe, Resend, and Meta privacy policies. More information about our social publishing provider and the providers above is available on request at hello@henshu.app. We will update this list before we add or replace a provider that receives personal information.
A storage provider is connected only after you choose to authorize it. Connections start private. Henshu uses the Google Drive and Dropbox APIs solely to provide Files features and carry out user-initiated actions: listing supported files and folders, showing metadata, downloading selected files, uploading files, creating folders, and copying selected files between HDrive, Google Drive, and Dropbox. A copy is started by a signed-in Henshu user who can access the source and write to the destination; it creates a new file at the destination and leaves the source in place. Authorized users can also request supported rename, move, trash and delete operations through Files or an authorized automation. These actions are checked against the connected account and destination permissions; they are not performed merely because an account was connected. Google Shared Drives and Dropbox team spaces may not appear in the current browser.
When you connect Google Drive or Dropbox, we store encrypted OAuth credentials, the email address and stable account identifier returned by the provider, and connection status. We access file and folder metadata such as names, IDs, MIME types, sizes, and modification times, and the contents of files selected for download, upload, or copying.
The person who connected a Google Drive or Dropbox account may explicitly change its visibility from Private to Public to this workspace. This does not publish the drive to the internet. Signed-in members of that Henshu workspace with Files access may browse, download, and copy files out to a destination they are permitted to manage. Members with Manage Files permission may also upload files, create folders, and copy files into the connected account. Only the person who connected the account can change its visibility or disconnect it, and making it visible in one workspace does not expose it in another.
Your original files remain with Google Drive or Dropbox, and Henshu does not continuously mirror or synchronize a connected hierarchy. Directory metadata is passed to authorized signed-in browsers for display. Selected file content passes through Henshu’s server when it is downloaded or copied. For an upload or cross-platform copy, Henshu writes a bounded temporary staging copy, sends it to the selected destination, and deletes the staging copy after the attempt. A successful copy remains at the selected destination under that destination’s storage and retention rules.
Henshu stores your connected account email, the provider’s stable account identifier, and encrypted OAuth access and refresh credentials while the connection remains active. Connected-storage data is transmitted only among the source and destination selected for the requested action, Henshu infrastructure needed to provide and secure the feature (hosted on Google Cloud), the initiating user’s signed-in browser, and authorized workspace members when the connector has explicitly made the drive workspace-visible. Shu, Henshu’s assistant, sees only the names of connected drives, never the account email or file contents. It is not sold, used for advertising, or shared with data brokers. A private connected-drive tab is not exposed to other Henshu workspace members.
If a user copies a file from Google Drive or Dropbox into Henshu’s own storage (HDrive), the copy becomes Henshu workspace content and is handled like any other upload under this policy. For example, if that copy is added to a task’s Review, its audio may be transcribed when the workspace allows processing, as described in section 4.
Disconnecting Google Drive or Dropbox removes the stored connection credentials and all Henshu workspace-visibility grants for that connection and, when the credentials are readable, requests revocation of Henshu’s provider access. Deleting your Henshu account also removes its stored connected-drive data. Disconnecting or deleting your Henshu account does not delete your original files from either provider.
Henshu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Henshu does not use Google Drive or Dropbox data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. Personnel may access Google Drive data only with your explicit permission for support, when necessary to investigate security or abuse, when required by law, or for internal operations using aggregated and anonymized information.
Henshu publishes to Instagram, Facebook, TikTok, and YouTube through our social publishing provider (see section 6). When someone in your workspace connects a social account, the platform’s authorization is granted to and held by that provider for Henshu; Henshu stores the account’s public handle, display name, profile picture, and a reference to it. When your workspace publishes or schedules a post, its media, caption, and timing go to that provider and then to the platform. Henshu also reads post statistics through that provider for the connected accounts. The platforms’ own policies also apply:
Removing a social account in Henshu stops Henshu from using it. The authorization held by our publishing provider is not revoked automatically, so to end access completely, also remove the app’s access in the platform’s own security settings, or ask us at hello@henshu.app and we will have it removed.
Sauce Media is based in the United States, and Henshu is hosted in the United States. If you use Henshu from another country, your information is transferred to and processed in the United States. Some AI features send content to providers that may process it in China or other countries (section 4). Those countries’ data protection laws may differ from yours.
Where the EU or UK GDPR, Swiss law, or similar laws require a safeguard for these transfers, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) included in our providers’ data processing terms, or on a provider’s certification under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions where it has one. You can ask us for more information about the safeguard used for a particular provider.
| Information | How long it is kept |
|---|---|
| Your account and profiles | While your account exists. When you delete your account (section 10), it is removed after a 30-day cancellation window. |
| Workspace content | While the workspace exists, unless a member deletes it earlier. The workspace owner controls it. |
| Items in a workspace’s Trash | Deleted items go to Trash for the period the workspace chooses: 7, 30, or 90 days (30 by default). Files are then permanently deleted automatically. Deleted tasks, projects, and channels become due for permanent deletion at the end of that period and are removed the next time someone with access to the workspace’s Trash opens it, so they can be kept longer than the chosen period. |
| A deleted workspace | Deleting a workspace deactivates and hides it immediately, but its data is kept so the workspace can be restored. To have a deleted workspace’s data permanently erased, its owner can ask us at hello@henshu.app. |
| A workspace whose paid plan is cancelled | The workspace moves to the free plan at the end of the paid period and its data stays available. Cancelling does not delete data. |
| Shu conversations and its undo record | Until your account is deleted. |
| Review transcripts | With the task until it is permanently deleted; the copy cached for a file is deleted when that file is permanently deleted. |
| Sign-in sessions | A session works for up to 30 days, or until you sign out or end it in Settings › Devices. Each workspace also keeps a record of its sessions (email address, browser details, and when the session started and expires). Records of expired sessions are not yet deleted automatically in every workspace, so they can be kept until your account in that workspace is deleted. When all of your sessions are ended at once, for example after a password change or when your account is removed or deleted, a record that those sessions are no longer valid, which includes your email address, is kept for about 30 days. |
| Saved accounts on a browser (the account switcher) | For each browser, the email address, workspace, and sign-in token of each account signed in there, kept on our server until you sign out on that browser, remove the account from its list, or delete your account. |
| Invitation links, password-reset links, and email verification codes | Invitations expire after 30 days; password-reset links after 1 hour; verification codes shortly after they are sent. |
| Notifications | Each workspace keeps its most recent 100 notifications. |
| Last IP address, time zone, and last-seen time of each member of a workspace, which Sauce Media staff who administer the platform can see | Up to 90 days after the member was last seen. |
| The time you were last online, which other members see in the Team members list on Home | With your account while it exists, and deleted with it. |
| Public website and demo analytics | Up to 181 days from the start of a browsing session. Signup attribution covers a 30-day window; live visitor presence expires after 90 seconds without activity. |
| Advertising measurement | The browser cookies in section 11 last up to 90 days. The copy we keep so the same signup or purchase is not sent to Meta twice is kept for about 90 days for an account and about 400 days for a purchase. Meta keeps what it receives under its own policy. |
| Daily feature-usage counts | Up to 120 days. |
| Record of changes made in a workspace (who changed what; no message or file contents) | While the workspace exists. When your account is deleted, your email address is removed from it. |
| Connected Google Drive or Dropbox credentials | Until you disconnect the drive or delete your account. |
| Billing records | While the subscription exists and afterwards for as long as tax and accounting law requires. Stripe keeps its own payment records under its policy. |
| Privacy request records | We keep a record of each privacy request (who asked, when, and what we did) to show that we handled it. |
| Server logs | Server logs rotate automatically as they reach a size limit, so how long an entry lasts depends on activity. Logs are also captured in the backups below. |
We keep backups so we can recover Henshu after a failure. Backups are not used to look up or process individual records. Deleted information can remain in them until the backup itself is deleted:
Depending on where you live, you may have the right to access your personal information, get a copy of it in a portable format, correct it, delete it, restrict or object to how we use it, and withdraw any consent you gave. We will not treat you differently for using these rights.
Email hello@henshu.app from the address tied to your account. For deletion, use the subject “Data Deletion Request”; for other requests, say what you would like. We may need to confirm your identity first. We reply within one month, or tell you within that month if we need up to two more months for a complex request, where the law allows. You can also authorize an agent to make a request for you; we may ask the agent for proof of that authority and ask you to confirm your identity.
Deletion is scheduled 30 days after it is requested so it can be cancelled if it was a mistake, and then runs automatically. If you are the only owner of a workspace, transfer ownership to another member first. Deletion covers your account in the workspace it belongs to, its access to that workspace’s sub-workspaces, and every workspace account linked to the same sign-in. It:
Other content in a workspace — for example tasks and projects you created or were assigned to, files you uploaded, and mentions of you in other people’s messages — belongs to that workspace and stays there. Where a History entry or notification records only a name, and someone else in the workspace also goes by that name (another member, a member of the agency that runs the workspace, or someone who left review notes under it) or the name was typed by someone who was not signed in (for example when sending files through a Shu Drop link), Henshu cannot tell it is yours and leaves it unchanged. Ask the workspace owner to delete it, or contact us and we will pass your request to them. Deleted information can remain in backups until they are deleted (section 9).
If you reach this page from an automated platform request (Meta, TikTok), the deletion endpoint is at POST https://henshu.app/api/data-deletion and the public status page is at https://henshu.app/data-deletion-status?code=…. We review these requests by hand, because the platform sends only its own account identifier.
If you are in the European Economic Area, the United Kingdom, or Switzerland, you can also complain to your local data protection authority. We would appreciate the chance to address your concern first.
Henshu uses cookies and browser storage for sign-in and preferences. Our public website, demo, and signup pages also use first-party analytics cookies to measure visits and conversions. On henshu.app’s public pages we also use Meta’s pixel and advertising cookies to measure ads we run; inside a workspace only the checkout and payment events described in section 2 are sent. The admin site, the demo, and share links do not load that pixel. First-party analytics and the Meta pixel are both disabled when your browser sends Do Not Track or Global Privacy Control. Henshu does not show a separate cookie banner; those browser signals are the opt-out.
__Host-henshu_session keeps you signed in (up to 30 days), and __Host-henshu_accounts identifies this browser’s list of signed-in Henshu accounts so you can switch between them (for up to 7 days after the list last changed; the list itself is kept on our server as described in section 9).hs_vid identifies a browser for up to 30 days after activity, hs_sid identifies a session for up to 30 minutes after activity, and hs_lsid connects later signup activity to the first website visit for up to 30 days. These are shared across Henshu’s public website, demo, and signup pages. Enabling Do Not Track or Global Privacy Control disables analytics and clears these cookies on the next visit to those pages. You can also remove them in your browser’s cookie settings._fbp is a random browser identifier, _fbc stores the ad click id from an fbclid link, and hs_meta_attr stores campaign labels and the first page address without its query string. Each lasts up to 90 days and is shared across Henshu workspace addresses so a visit can stay attached to the later signup. On public pages the pixel script is loaded from connect.facebook.net; workspaces do not load it. Do Not Track or Global Privacy Control stops the pixel from loading and clears these cookies.henshu_share_unlock remembers that you entered the password for a protected shared link, and a short-lived cookie links a Google Drive or Dropbox connection to the browser that started it.When your browser loads Henshu, it also fetches fonts from Google Fonts and a document-preview library from jsDelivr. The Sign in with Google button loads Google’s sign-in script, and if Henshu’s own copy of its spreadsheet-import library cannot load, your browser fetches it from SheetJS instead. These services receive your IP address and browser details when that happens.
Henshu uses encrypted connections (HTTPS). Google Cloud encrypts stored data at rest, and we additionally encrypt connected-storage credentials. Passwords are stored only as hashes. Access to production data is restricted to authorized Sauce Media staff. No system is perfectly secure; if we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.
Henshu is not for anyone under 16, as our Terms require. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.
In the past 12 months we have collected the categories of personal information described in section 2: identifiers (such as name, email, and IP address), customer records and commercial information (such as subscription details), internet or other electronic activity (such as feature use and session records), audio and visual information (such as video, audio, and photos you upload), professional information (such as your title and workspace), and account sign-in credentials. We collect them from you, from your workspace, and from the services you connect, for the purposes in section 3, and we disclose them to the recipients in sections 5 and 6 for those business purposes. We keep them for the periods in section 9. We do not sell personal information. We share the limited advertising-measurement identifiers in sections 2 and 6 with Meta to measure and optimize ads we run, which California law treats as sharing for cross-context behavioral advertising. Global Privacy Control and Do Not Track are honored as a request to opt out of that sharing: the pixel does not load and we do not send the event. We do not use sensitive personal information to infer characteristics about you. You have the rights to know, access, correct, and delete personal information, and not to be discriminated against for using those rights; use them as described in section 10.
We provide personal information to the service providers in section 6, including providers in the United States and China, to operate Henshu. On request, we will tell you about the measures those providers take to protect it and about the personal information protection systems of the countries involved. You can ask us to disclose, correct, stop using, or delete your personal information, or to stop providing it to third parties, as described in section 10.
We may update this policy. The dates at the top show when this version was last updated and when it takes effect. We will tell account owners about material changes by email or in Henshu before they take effect.
This version applies to accounts created on or after the day it is published on this page. For accounts created before then, it takes effect 14 days after we tell account owners about it by email or in Henshu, and no earlier than October 8, 2026; until then the previous version (effective August 11, 2026) applies to them. We will send a copy of the previous version on request.
Questions or requests about this policy: hello@henshu.app
Sauce Media LLC
Arizona, United States