Skip to content
3-Day Free Trial on Selected Packages!
upon shift
Sign up

Privacy Policy

1. Data Controller and Data Processor Status This Privacy Policy explains how your personal data is collected, processed, and protected when you use our platform and website at https://uponshift.com ("Service"). Our roles in legal processes are as follows:

  1. Data Controller: For the registration, billing, and contact data you provide when creating your account, the Data Controller is Çağrı Çiftçi (Upon Shift), residing at Tomtom, İstiklal Cd. Beyoğlu İş Merkezi No:187/147, 34433 Beyoğlu/Istanbul, Turkey.
  2. Data Processor: Regarding the documents you upload to the knowledge base on the platform to train your bots and the dialogues your end-users (your customers) have with the chatbots, Upon Shift is merely in the position of a "Data Processor". The legal responsibility for this data and the obligation to obtain informed consent from end-users belongs entirely to the customer (you) using the Service.

2. Data We Collect

  1. Account and Subscription Data: Name, email address, company title, tax information, and platform login records.
  2. Financial Data: Payments are processed by licensed and secure third-party payment providers. Your full credit card numbers or CVC security codes are strictly not stored on our servers.
  3. System and Usage Data: IP address, browser/device information, access logs, and click/interaction data within the platform.
  4. Customer Content (AI Data): Documents you upload to train bots (PDF, Word, URL contents, etc.), commands (prompts) you give, and outputs generated by the system.

3. Artificial Intelligence (AI) Operation and Data Transfer (Very Important) Upon Shift is an AI SaaS platform. Due to the nature of the Service, the content you upload to your bots and the messages written on the chat screen are transmitted via APIs to global artificial intelligence infrastructure providers such as OpenAI, Anthropic, and Google to be processed and generate responses.

  1. Sensitive Data Warning: It is entirely your responsibility NOT TO UPLOAD Turkish ID Numbers, Social Security Numbers, credit card information, health data, passwords, or other Special Categories of Personal Data to the knowledge base or chatbots. Upon Shift accepts no legal, administrative, or penal liability for leaks or KVKK (Turkish Personal Data Protection Law) or GDPR violations arising from the intentional or unintentional transmission of such sensitive data to third-party AI providers.
  2. AI Training: In accordance with our corporate API policies, the third-party AI providers we integrate with do not use the data you send to train their own general artificial intelligence models. Your data is processed solely to answer the current query.

4. Purposes of Processing and Legal Basis We process your personal data under the KVKK and (to the extent applicable) GDPR based on the following legal grounds:

  1. Performance of a Contract: To create your account, manage your subscription, and provide artificial intelligence services uninterruptedly.
  2. Legal Obligation: Mandatory logging requirements (e.g., Law No. 5651), maintaining accounting and tax records.
  3. Legitimate Interest: To ensure the security of our system, troubleshoot technical errors, and prevent fraud.

5. Data Sharing and Third Parties Upon Shift does not sell your personal data to advertising companies or third parties for any purpose. Data is only shared with the following parties in mandatory situations to perform the service:

  1. Our cloud infrastructure and secure data hosting providers.
  2. Our payment (billing and collection) service providers.
  3. Global AI (LLM) service providers mentioned in Section 3, forming the core of the Service.
  4. Authorized official authorities when required by a legal order, court decision, or official investigation.

6. Multi-Tenant Data Isolation Our platform architecturally has a highly secure isolation system. The knowledge base data and bot configurations uploaded by our customers are logically completely isolated from each other. Information or documents uploaded by one customer cannot under any circumstances be used to train or respond to another customer's bot and cannot be accessed by other accounts.

7. Data Retention and Deletion Your account data is stored in our systems as long as your subscription is active. In case you completely delete your account, your knowledge base data and bots are permanently deleted. However, billing records, transaction logs, and official ledger records continue to be securely archived for the limitation periods mandated by legal regulations (typically between 1 to 10 years).

8. Data Security To protect your data, we implement current technical measures such as encryption during data transfer (SSL/TLS), secure API key architecture, systemic access controls, and audit logs. However, no data transfer over the internet is 100% secure. Upon Shift cannot be held responsible for breaches originating from external cyber attacks or third-party infrastructure providers (AI, Hosting, Meta, etc.).

9. International Transfers As we are a cloud SaaS platform, your data and knowledge base contents may be processed in and transferred to data centers outside your own country (especially those based in the USA and European Union) where the global server providers and AI models we receive services from are located. By using the Service, you are deemed to have explicitly consented to this transfer.

10. Your Rights Under applicable personal data protection laws, you have the right to learn whether your data is being processed, access it, request its correction, request its deletion (right to be forgotten), and object to its transfer. You can contact us via [email protected] for all your privacy, data protection requests, and legal applications.

11. Policy Changes We may update this Privacy Policy at any time due to changes in our system integrations, legal regulations, or the rules of the AI platforms we work with. Significant changes will be published on our website, and your continued use of the service will mean you accept the new policy.