Your customers' data is the whole product, so this document matters more here than most places. Every section opens with a plain-English line — the legal text below it is the binding part.
LiftSignals operates a customer-intelligence platform for e-commerce businesses. Under data-protection law we wear two hats. For your account information — your name, email, company, billing details — LiftSignals is the data controller. For the store data you connect — your customers' records, orders, and behavior — you are the controller and LiftSignals is your data processor, acting only on your instructions and this policy.
That distinction runs through everything below: your customers are yours. This store data belongs to you and to them — never to us.
We collect three categories, and nothing outside them:
We process data to perform our contract with you, to pursue legitimate interests in operating and improving the Service, and to meet legal obligations. Concretely, that means: running your nightly model scoring; generating your insights, audiences, and reports; providing support; billing and account administration; securing the platform; and complying with the law.
Each use is tied to one of those legal bases. If we ever wanted to use data for something new, we would ask first — not update a document and hope you don't notice.
We share data only with service providers who help us deliver LiftSignals, each bound by contract to protect it:
Beyond that, data moves only when the law compels it, or in a business transfer such as a merger or acquisition — in which case you receive 30 days' notice before any change takes effect.
Deletion at the end of these windows is permanent and irreversible. The 30-day window after cancellation exists so you can export everything first — and so an accidental cancellation isn't a catastrophe.
LiftSignals is SOC 2 Type II certified — our security, availability, and confidentiality controls are independently audited, not self-declared. Data is encrypted with 256-bit AES at rest and TLS 1.3 in transit. Internally, role-based access controls limit who can touch what, and continuous vulnerability scanning watches the perimeter.
We maintain documented incident-response procedures. If a breach ever affects your data, we notify you in accordance with GDPR's 72-hour requirement — with what happened, what it touched, and what we're doing about it.
If you're in the EU or UK (GDPR), you have the right to access your personal data, rectify inaccuracies, request erasure, restrict or object to processing, receive your data in a portable format, and lodge a complaint with your supervisory authority. We respond to requests within 30 days.
If you're a California resident (CCPA), you have the right to know what we collect, request deletion, opt out of sale — straightforward here, since we don't sell data — and to never be discriminated against for exercising any of these rights.
To exercise any right, email privacy@liftsignals.com. EU-specific matters can also go to eu-privacy@liftsignals.com.
Your end customers hold rights over their data too, and you'll sometimes receive their requests. Through privacy@liftsignals.com — or self-service in the app — you can request access, deletion, or portability for any end customer's data held in your workspace. We action these within 30 days, so you can meet your own obligations as controller without chasing us.
We use three narrow categories: strictly necessary cookies for authentication and security, analytical cookies that are anonymized and tell us which features earn their keep, and functional cookies that remember your preferences.
We use no advertising or cross-site tracking cookies — a marketing-intelligence company that tracked you around the internet would be a strange thing to trust.
LiftSignals is built for businesses and not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached our systems — for instance through a connected store — tell us at privacy@liftsignals.com and we will delete it promptly.
If we make material changes to this policy, we email you at least 14 days before they take effect, and the "Last updated" date above changes with them. Silent edits are not how this document works.
Questions, concerns, or rights requests: privacy@liftsignals.com. General inquiries are answered within 5 business days; formal rights requests within 30 days. EU representative: eu-privacy@liftsignals.com.