Privacy Policy

I. Introduction

Welcome to https://shiftupai.com/. This site is owned and operated by ShiftUp Inc. ("ShiftUp," "we," or "us"). This Privacy Policy governs your use of our website and our Salesforce-native application ("Application") (together, the "Site"). By accessing or using the Site, you acknowledge that you have read, understood, and agree to this Privacy Policy. Your use of this Site indicates your consent.

This Privacy Policy is organized into the following sections:

1. Introduction
2. Information We Collect
3. How We Collect Your Information
4. How We Use Your Information
5. How We Share Your Information
6. How We Protect Your Information
7. No Use by Children
8. Correcting or Updating Your Information
9. Specific California Resident Rights
10. Updates to This Policy
11. Contact Information

II. Information We Collect

Defining Personally Identifiable Information

Personally identifiable information is any information collected by us or provided by you that with reasonable efforts could be used to identify you. Personally identifiable information includes the information you give to us directly, the information we automatically collect, and when applicable, information supplied to us by third parties. Specifically, we may collect the following types of information:

• information that directly identifies you, such as your name, business email address, phone number, company name, role or title, and other contact details provided during registration, contact forms, newsletter sign-ups, demo requests, onboarding, use of the Application, or support inquiries;
• account and billing information (e.g., plan selection, invoicing details, and, where applicable, limited payment-related information from a third-party payment processor, if used);
• CRM Data You Connect: records and metadata from your organization's Salesforce instance that your administrator authorizes us to access (for example, account, contact, and opportunity records; notes and tasks; fields and custom objects relevant to revenue intelligence);
• Calendar Data You Connect (Google and Microsoft): if you choose to connect a Google or Microsoft calendar, we request read-only access to your calendar events and basic identity information (such as your email address and account ID). We receive and process calendar event information needed to sync upcoming meetings, schedule our notetaker, and display meeting details in your Salesforce workspace.
• Meeting Content (Notetaker Data): if you use features that schedule a notetaker or otherwise capture meeting information, we may process and store meeting content and related metadata, which may include (as applicable) meeting audio and video recordings, transcripts, meeting chat content, meeting notes, summaries, action items, and other outputs generated from meeting content, as well as meeting metadata (such as participants, start and end time, meeting URL, meeting platform, and meeting status)
• information regarding your requests for services or assistance;
• approximate geolocation derived from your IP address;
• information about your interactions with the Site; and
• analytics and device data such as IP address, device and browser type/version, operating system, referring source, and diagnostic logs.

With respect to calendar integrations, we may also collect and store:

• Calendar connection record: a minimal connection record (your calendar's unique ID, your Salesforce org ID and user ID, provider, and provider email) to route calendar updates correctly.
• Meeting details stored in Salesforce: a limited set of meeting details in Salesforce (start and end time, subject, meeting URL, meeting platform, and status) to show the meeting within your Salesforce experience.
• Internal bot-tracking entries: short-lived internal tracking entries for scheduled bots to prevent duplicate recordings and to support operational cleanup.
• Tokens: we do not store your Google or Microsoft access tokens or refresh tokens in our systems. Tokens are handled by our calendar sync provider (Recall.ai) to keep your calendar connected.

Please note that ShiftUp's product is designed to operate inside Salesforce and to leverage existing enterprise security and compliance controls of that environment. As a result, many categories of data we process are stored in, and accessed through, your organization's Salesforce environment (including records, fields, and objects your administrator authorizes). Where we process information outside of Salesforce (for example, to support integrations, security, logging, customer support, and feature delivery), we do so in accordance with this Privacy Policy and subject to contractual and technical controls.

III. How We Collect Your Information

We collect this information in the following ways: directly from you; automatically using technology like cookies, web bugs, and other web technologies; and directly from our partners and vendors.

Information Directly From You

As you use the Site, we collect information you provide directly, including:

• Contact Information: name, business email, company, role/title, and other details submitted during registration, contact forms, newsletter sign-ups, demo requests, onboarding, or support communications.
• CRM Connection and Settings: configuration choices you or your administrator provide when connecting your Salesforce instance to the application (e.g., permission scopes, field mappings).
• Calendar Connection and Settings: if you connect a Google or Microsoft calendar, you provide authorization to connect your calendar and you may provide configuration choices related to syncing (for example, which calendar to connect).
• Messages/Notes: content you submit via text boxes, feedback forms, surveys, and communications with our support team.
• Account Information: username and email for the Salesforce user setting up the ShiftUp product integration.

Information Automatically Collected Using Technology

We use cookies, pixels, log files, and similar technologies to collect: (i) usage data (pages/features used, clickstream, time on page), (ii) device/technical data (IP address, device and browser type/version, OS, referral source), and (iii) approximate geolocation from IP. We may use analytics and advertising tools (for example, Google Analytics/GA4 and LinkedIn Insight Tag). Where required by law, we obtain consent via our cookie banner and honor your choices through that banner and/or your browser settings.

These technologies do not collect personally identifiable information but may be used in conjunction with other information gathered. Over time, we may also collect information about your other activities online and combine this information for the purposes of behavioral profiling.

Do Not Track

Browsers and devices allow individuals to send "do not track" signals to websites. At this time, we do not take actions to respond to "do not track" signals.

Information From Third Parties

We may receive information from service providers and partners that help us deliver, secure, and support the Site (e.g., hosting, analytics, error monitoring, customer-support tooling). In addition, when your organization connects Salesforce, we process CRM data that your administrator authorizes for use with our revenue-intelligence features. If you connect a Google or Microsoft calendar, we receive calendar event updates from our calendar sync provider (Recall.ai) to support syncing and scheduling as described in this Privacy Policy.

Payment Information

Payments for our services may be processed by third-party payment processors. We do not store full payment card numbers. The payment processor's privacy policy governs its handling of payment information.

IV. How We Use Your Information

We collect and use information from you for the following purposes:

• to operate and maintain our site
• to present our content to you through our site
• to communicate with you
• to fulfill our obligations to you as presented when you provided the information
• to notify you about changes to our site
• to enhance and optimize your experience
• to process authorized Salesforce CRM data using AI/LLM tools to surface opportunity signals, create account and opportunity insights, and recommend next-best actions for sellers
• to generate guided selling outputs inside Salesforce, such as account plans, opportunity hypotheses, and conversation roadmaps
• to support user accounts, onboarding, and product support
• to communicate product updates, billing notices, and transactional messages
• to respond to your requests, feedback, or inquiries
• to conduct marketing and promotional campaigns (subject to consent, and opt-out options)
• to develop and improve features (including optional beta waitlists, newsletters, and scheduling tools)
• to comply with legal, regulatory, and contractual obligations
• to leverage your organization's existing Salesforce security/compliance posture in connection with our Salesforce-native deployment
• to sync upcoming meetings into your Salesforce experience when you connect a Google or Microsoft calendar
• to schedule our notetaker and manage meeting-related workflows, including preventing duplicate recordings
• to capture, transcribe, summarize, and organize meeting content (for example, generating notes, action items, and other outputs) when you use notetaker features
• to display meeting details in your Salesforce workspace (for example, start and end time, subject, meeting URL, meeting platform, and status)
• to display and make available meeting content and related insights in your Salesforce workspace (as configured by your organization)
• to maintain service functionality, including scheduling workflows, preventing duplicate recordings, and operational cleanup related to meetings
• to perform operational cleanup after meetings and after you disconnect a calendar connection
• for any other purpose within your consent

In some instances, we also use information to contact you about goods and services that you may find valuable; however, if you would not like to receive information about ongoing promotions or tools we believe are relevant to you, please contact us at privacy@shiftupai.com.

Calendar Retention and Deletion

If you disconnect your calendar (or revoke access from Google or Microsoft), we remove your calendar connection from our system and begin cleanup. We delete the connected calendar from our sync provider and remove related calendar records in Salesforce. Internal bot-tracking entries are deleted when a meeting ends, and any remaining entries are automatically purged shortly thereafter as a safety cleanup.

Data Retention

We retain personal information for as long as reasonably necessary to: (a) provide and maintain the Site and Application; (b) comply with legal, regulatory, and contractual obligations; (c) resolve disputes; (d) enforce our agreements; and (e) protect the rights, property, and safety of ShiftUp, our users, and others. Retention periods vary depending on the type of information, how it is used, and applicable requirements. Where feasible, we de-identify, aggregate, or delete personal information when it is no longer needed for these purposes.

Targeted Advertising

When you visit our Site, cookies and pixels may be used for analytics and advertising, which can constitute "sharing" for cross-context behavioral advertising under the CPRA. You can opt out via our cookie banner where available and through the platform controls linked below.

• https://www.google.com/settings/ads/anonymous
• https://www.facebook.com/settings/?tab=ads

You can also visit https://optout.aboutads.info to control the collection of web data on your computer and to opt out of additional targeted marketing.

V. How We Share Your Information

Though we do not sell or disclose the personal information we collect in the ordinary course of our business, we may share your data with third parties in accordance with the purposes described above. We share personal information with service providers that perform services on our behalf (such as hosting, analytics, customer support, security monitoring, payment processing, and integration providers). These service providers are authorized to use personal information only as necessary to provide services to us and as permitted by applicable contracts. In providing a Salesforce-native application, we process CRM data within or in connection with your Salesforce environment as authorized by your administrator. We also use service providers (e.g., hosting, analytics, support, and payment processing) under contracts that limit their use of personal information to providing services to us. Additionally, in the course of business, if we buy or sell business assets or participate in a company sale, merger, reorganization, or dissolution, the data we have collected may be part of such business transfers.

Below is a non-exhaustive list of some of the partners and vendors we use to provide our services and conduct business:

• Google Analytics. Google Analytics is a tool used to discover user demographics and behavior. You can reference Google's privacy policy regarding how they handle information collected by visiting https://policies.google.com/privacy.
• Google Adsense. Google Adsense is an advertising program created by Google that allows website owners to display ads on their websites. You can learn more about Google's policy for handling information collected by visiting https://policies.google.com/privacy.
• OpenAI, Google Gemini, or similar LLM APIs. We use third-party AI model API providers to support certain Application features, such as generating insights, recommendations, summaries, and suggested content to help users conduct account research, improve account planning, and accelerate pipeline generation within Salesforce. These vendors process information on our behalf under contracts that restrict their use of information to providing services to us. Their privacy policies describe their practices.
• Recall.ai (calendar sync). We use Recall.ai to maintain the calendar connection and receive event updates. Recall.ai stores the OAuth refresh token required to keep the calendar connected. We receive event updates and use them for scheduling and syncing as described above. Recall.ai's privacy policy is available at https://www.recall.ai/privacy

This list is subject to change at our discretion. If you would like more information about our third-party partners, please visit their specific privacy policy pages that describe their practices.

VI. How We Protect Your Information

As a company, the protection of your information is important to us. We have designed and adopted technological and organizational procedures to safeguard your data. It is important to note that while we make efforts to protect your data, security measures are not impenetrable. As a result, we cannot guarantee the absolute security of any information collected or transmitted to our Site. By using our Site, you consent to the transmission of your data at your own risk. Additionally, if you have registered for an account on our Site, you should not share your password or username with any other third parties. It is your responsibility to keep this information confidential. For enterprise customers using our Salesforce-native deployment, we leverage the security and compliance controls of your Salesforce environment in addition to our own organizational and technical safeguards.

VII. No Use by Children

The Site is not directed to, or intended for use by, individuals under 18. We do not knowingly collect personal information from anyone under 18. If you are under 18, do not use the Site or provide any information to us. If we learn we have collected personal information from someone under 18, we will delete it.

VIII. Correcting or Updating Your Information

If you discover that inaccurate information about you has been collected, or if you would like to update the information we currently have, please contact us at privacy@shiftupai.com or by mail at ShiftUp Inc., 3762 E Zachary Drive, Phoenix, AZ 85050.

IX. Specific California Resident Rights

This section is only applicable for individuals who reside in California and should be read in conjunction with our entire Privacy Policy. If you are a California resident, you have the right to

• obtain additional information about "personal information" (as defined in the California Consumer Privacy Act (CCPA));
• request that we disclose certain information collected, used, disclosed, and sold about you;
• request deletion of your personal information; and
• opt out of the sale or sharing of your personal information.

The information covered by these specific rights is information that could be reasonably linked to you. It excludes information that cannot be reasonably linked to you. To help you better understand our practices, the chart below describes the categories of personal information collected, the sources of this information, how we use this information, and with which third parties we have shared this information within the past twelve months.

If you have any questions, comments, or concerns about this Privacy Policy or our services, please contact us at privacy@shiftupai.com or by mail at ShiftUp Inc., 3762 E Zachary Drive, Phoenix, AZ 85050.

X. Updates to This Policy

We may update this policy from time to time. If any updates are made to this policy, they will be posted here. Additionally, if material changes are made to this policy, we will notify you via a notice to this Site, and registered users will receive an additional email. Please check this page frequently for updates.

XI. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy or our services, please contact us at privacy@shiftupai.com or by mail at ShiftUp, Inc., 3762 E Zachary Drive, Phoenix, AZ 85050.