Privacy Policy

1. Who We Are

The Upgrade Shop (“we,” “our,” or “us”) is a fully managed digital and software agency for small businesses. We build and run a business’s website, CRM, email, WhatsApp, online store, courses, funnels and other digital tools for the owner. A real person, the account manager, looks after every package, and each account has its own AI assistant that works alongside the team. We are registered in Israel under company registration number 300330123, with registered address at Har Hatzofim 11, Holon, Israel.

Customers use our service through the dashboard at app.upgradeshop.ai. This policy also covers our public website at upgradeshop.ai, including the waitlist form, the contact form and the chat with Max, our own AI assistant on that website. The terms that govern the service are in our Terms of Use.

2. Scope of This Policy: The Roles We Play

Depending on the context, we act in one of two legal roles with respect to personal data:

2.1 Data controller: for our own customers and visitors

We are the data controller for the personal data of:

• Account holders and their team members who use our dashboard
• People who join our waitlist
• People who chat with Max or use the contact form on upgradeshop.ai
• People who buy from us through our checkout
• Prospects and customers we correspond with

This policy describes how we handle that data.

2.2 Data processor: for our customers’ contacts

When a business owner uses our service to manage their own contacts and customers (storing contacts in the CRM, sending WhatsApp messages, running email campaigns, hosting a website, operating an online store, or managing course students), the business owner is the data controller for that data, and we act as their data processor.

In that role we process the data only on the business owner’s instructions and under the terms in the “Data we handle for you” section of our Terms of Use. The list of sub-processors is in Section 12 of this policy, and we give customers 30 days’ notice by email before we add or replace one. Business owners are responsible for having a lawful basis to collect their contacts’ data and for giving their contacts an appropriate privacy notice.

3. Information We Collect About You

3.1 Account and registration data

• Name, email address, and password (or OAuth token from Google sign-in)
• Business name, website URL, and contact details you provide during onboarding
• Profile picture if connected via Google

3.2 Billing and payment data

Our online reseller Paddle.com handles subscription billing (see Section 7). We do not store full card numbers on our servers. We retain:

• Subscription package, tier, billing period, and payment status
• Invoice history and transaction references
• Billing address and tax details if provided

3.3 Service usage data

• Pages and features accessed inside the dashboard
• Actions taken (automations created, campaigns sent, content published)
• Error logs and performance diagnostics
• IP address, browser type, and device information

3.4 Support and communications

• Messages you send to your account manager, our team or our support
• Feedback, bug reports, requests and approvals
• Conversations with your AI assistant, and with Max while you are setting up

3.5 Visitors to upgradeshop.ai

If you use our public website we collect only what you give us or what your browser sends:

• Waitlist: your name, email address, WhatsApp number and language, and the IP address of your request. We use them to manage the waitlist, to tell you about the launch and about the Founder Price, and to contact you by email or WhatsApp about those things. You can ask us to stop at any time.
• Contact form: your name, email address, phone number if you give one, and your message. We use them to answer you.
• Chat with Max: Max is an AI assistant, not a person. We log the conversation to run and improve the chat. We keep conversations anonymous unless you give us your name, email address or phone number. Please do not type sensitive personal information, such as health or payment card details, into the chat.
• Checkout: the details needed to take payment and issue your invoice, handled as described in Section 7.
• Browser storage: the website stores your language choice in a cookie and in your browser’s local storage so that it remembers it on your next visit. If you start our checkout, the form keeps what you have typed in your browser’s local storage so that you don’t lose it; it stays on your device. We do not run advertising cookies or third-party analytics on upgradeshop.ai.

4. Meta Platform Data (Facebook and Instagram)

The service integrates with Facebook and Instagram through the Meta Graph API so that you can manage your social presence, respond to customers, run and monitor ad campaigns, and analyse performance from one place. Facebook and Instagram are your own accounts: they are services you connect, not our sub-processors. This section describes exactly what we access, how we use it, and how you can revoke our access.

4.1 What we access from Facebook

• Your Facebook profile ID, name, and email address (to identify the connecting user)
• The list of Facebook Pages you manage and a Page access token for each (only for Pages you select)
• Public content on connected Pages: posts, comments, reviews, ratings, and engagement metrics
• Messenger conversations sent to and from the connected Page
• Lead Ads form definitions and lead submissions delivered through those forms
• Ad campaign data, ad insights, ad creatives, and ad account metadata for the ad account you authorise
• Page-level insights: organic reach, impressions, and engagement metrics

4.2 What we access from Instagram

• Your Instagram Business or Creator account ID, username, display name, profile picture, and account type
• Your recent posts and their public metadata (media URLs, captions, timestamps)
• Comments on your posts and direct messages sent to and from your account
• Account-level insights: reach, views, impressions, and engagement metrics

4.3 How we use Meta Platform Data

• To display your connected Pages and accounts on your dashboard
• To show Facebook reviews and recommendations in your dashboard and optionally on your public website
• To execute comment auto-reply and DM automations you configure
• To surface inbound messages in your shared inbox so your team can respond
• To display ad campaign performance, spend, leads, and ROI in your Marketing module
• To allow you, or your account manager with your approval, to pause, resume, or adjust ad campaign budgets
• To pull Lead Ads form submissions into your CRM automatically
• To publish images, reels, and carousels to your connected Instagram account at your direction
• To show organic reach and engagement alongside paid ad performance in one combined view

4.4 What we do NOT do with Meta Platform Data

• We do not sell, rent, or lease Meta Platform Data to any third party
• We do not use Meta Platform Data for advertising targeting other than as explicitly authorised by you
• We do not share Meta Platform Data across the accounts of different customers
• We do not use Meta Platform Data to train general-purpose AI or machine-learning models
• We do not keep Meta Platform Data after you disconnect the integration, beyond the deletion period in Section 4.5 and any period the law requires

4.5 How to revoke our access to Meta Platform Data

You can revoke access at any time in two ways:

• Inside the service: go to Social, find the connected Facebook or Instagram account, and click Disconnect. This invalidates the access token and stops all processing immediately.
• Inside Facebook:go to Settings & Privacy → Settings → Apps and Websites and remove The Upgrade Shop from the list of authorised apps.

After revocation we delete the relevant access tokens immediately and delete stored Meta Platform Data within 30 days, except where retention is required by law. You can also ask us to delete your Meta Platform Data by emailing [email protected].

5. WhatsApp Business Data

The service integrates with the WhatsApp Business API (operated by Meta Platforms, Inc., an independent company) to enable business messaging. When you connect a WhatsApp Business number, we access and process:

• Your WhatsApp Business Account ID and phone number
• Message templates you create and submit for Meta approval
• Inbound and outbound messages between your business number and your customers
• Delivery and read status of messages
• Contact phone numbers and names of people who message your business

We use this data to operate the shared inbox, run broadcast campaigns, power your AI assistant’s conversations with your customers, and trigger automation workflows.

You are responsible for ensuring that your customers have opted in to receive WhatsApp communications from your business. Message history is kept while your account is active. When the account ends it is handled as set out in Section 13.

6. Google Integration Data

If you connect Google services, we access the following with your authorisation, and only for the services you connect:

• Google sign-in: your name, email address and profile picture, to identify you.
• Google Analytics: aggregated website traffic metrics (sessions, users, bounce rate, top pages) for your connected website. We do not access individual visitor identities.
• Google Search Console: search performance data (impressions, clicks, average position, top queries) for your website’s domain, and site verification for that domain.
• Gmail: reading and sending email from your connected mailbox, for the email features you use.
• Google Drive, Docs and Sheets: read-only access to the files and spreadsheets you choose to use with the service.
• Google Calendar: reading your calendar and creating or changing events on it.
• Google Contacts: read-only access to your contacts, so that you can import them.

Analytics and Search Console data is fetched from Google every day and stored in our database as daily summaries (for Analytics) and as search performance rows (for Search Console), so that your Analytics module can show trends over time. It stays there while the integration is connected and is deleted with the rest of your account data under Section 13, or sooner if you ask us. We use data we receive from Google only to provide the features you connected it for. We do not sell it, and we do not use it for advertising. You can disconnect any Google integration at any time from your dashboard settings.

7. Payment and Billing Data

Prices are in US dollars. Subscriptions are sold through our online reseller Paddle.com, which is the Merchant of Record for all our orders. Paddle receives the details it needs to take your payment, handle tax and prevent fraud, and uses them under its own privacy notice. Accounts that started before we moved to Paddle may still be billed through our previous payment provider, SUMIT, until they move. We receive and store only:

• A tokenised customer reference from the provider (no raw card data on our servers)
• Transaction IDs, amounts, dates, and statuses
• Package, tier, billing period, and renewal dates
• Invoices issued to your business

We keep billing records for as long as the tax and accounting laws that apply to us and to your account require.

If you use the Store or Payments modules, you connect your own payment gateway (for example SUMIT, Green Invoice or Stripe). That gateway is your own provider, not our sub-processor. We store the connection tokens and the order and payment data needed to show your orders, and we process that data on your behalf as described in Section 10. Tax documents issued through your gateway are yours.

8. Your AI Assistant and Conversation Data

Every account has its own AI assistant, named by you, that works with the modules your account has. It talks to you in the dashboard, and where you have the WhatsApp module it also talks to you and to your customers through your WhatsApp Business number. Max is our own AI assistant, on our own website and while you set up.

• Your conversations with your AI assistant and with Max: logged, and used to run the service, provide support, and keep context across sessions.
• Your customers’ conversations with your AI assistant: processed on your behalf (see Section 10). The message content is used to generate responses and is kept as a memory of the conversation with that contact, so that the assistant remembers earlier exchanges.

We keep technical logs of requests sent to AI providers and the responses, to run the service and investigate problems. These logs and the contact memory are deleted with the rest of the account data under Section 13. A customer can ask us to delete the memory or logs for a particular contact by emailing [email protected].

AI responses are generated by third-party AI providers, listed in Section 12 with the task each one is used for. We send each provider only what the task needs. Each provider processes that data under its own terms for business customers. The people talking to an assistant should be told that it is an AI assistant, and customers are responsible for that notice in their own conversations. If you prefer that your account’s data is not sent to DeepSeek, ask your account manager or email [email protected] and we will stop using DeepSeek on your account. The tasks it handled then run on other AI providers, which cost more, so some actions may use more Action Points.

9. Who Can Access Your Data: Our People

We are a managed service, so people work inside customer accounts. Depending on the package and tier, that includes your account manager, a marketer, a designer, and other members of our team. They may be our employees or independent contractors, and they may be in different countries.

They can see and use the contacts, conversations, content and settings of an account only as far as they need to in order to do the work for that customer, and they are required to keep it confidential. Spending your advertising budget and work that we quote for need your approval first. We do not allow anyone to use account data for any other purpose.

10. Data We Process on Your Customers’ Behalf

When you use The Upgrade Shop to run your business, you entrust us with your customers’ personal data. You are the data controller; we are your data processor. The categories of data we process on your behalf include:

10.1 CRM: Contacts and Companies

• Names, phone numbers, email addresses, and business details of your contacts
• Pipeline stage, lead source, and activity history
• Custom fields you define for your business
• Tags, notes, and communication logs

10.2 Messaging and Inbox

• WhatsApp, Facebook Messenger, and Instagram DM conversations with your customers
• Message content, timestamps, and delivery status
• Broadcast campaign recipient lists and engagement data

10.3 Email Marketing

• Email addresses and names of your mailing list subscribers
• Subscription preferences, opt-in/opt-out status, and consent timestamps
• Campaign open rates, click-through rates, and bounce data

Mail sent to your business’s domain.If you turn on email forwarding, mail that people send to addresses on your domain is received by Amazon Web Services and forwarded to you. We keep the full message for 30 days and the sender’s address for 30 days, so we can forward it and look into delivery problems, and then we delete them. We process this mail on your behalf, like the rest of the data in this section.

10.4 Website Visitors

• Form submissions made on websites we host for you
• Analytics events collected on your website (depending on your tracking configuration)

You are responsible for the cookie and consent notices that your website needs, as the controller of your visitors’ data. Your account manager can tell you what your website collects.

10.5 Online Store

• Order details, product purchases, and transaction history of your customers
• Subscription plan and billing status of your customers’ recurring orders
• Shipping addresses if collected

10.6 Digital Courses

If you run digital courses through our service, we process data about your enrolled students on your behalf:

• Student names and email addresses
• Enrollment status, progress through course content, and completion records
• Video watch progress and assessment results

You are responsible for including appropriate disclosures about this data processing in your own privacy policy presented to your students.

10.7 Dispatch and Field Service

• Customer names and contact details associated with service jobs
• Job details, status history, and technician assignments
• Scheduling and appointment data. If you use maps and routing, addresses are sent to Google Maps to plan routes.

11. How We Use Your Information, and Our Legal Bases

We process personal data to:

• Provide, operate, and improve the service and its features
• Do the work you have asked our team to do
• Process payments and manage your subscription
• Send service notifications, billing alerts, and product updates
• Run the waitlist and tell waitlist members about the launch and the Founder Price
• Provide customer support and respond to enquiries
• Power the AI assistant features on your account
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with our legal obligations
• Enforce our Terms of Use

11.1 Lawful Basis for Processing

Where the GDPR, the UK GDPR, the Israeli Privacy Protection Law 5741-1981 or a similar law applies, we rely on these bases:

• Customers and their team members: contract performance, to deliver the service you subscribed to; legitimate interests, for security, fraud prevention and service improvement; legal obligation, to keep billing records.
• Waitlist members: your consent to be contacted about the launch and the Founder Price, which you can withdraw at any time; and our legitimate interest in running the waitlist.
• Visitors who chat with Max or use the contact form: our legitimate interest in answering you and running the chat, and taking steps at your request before a contract.
• Our customers’ contacts: the basis is your customer’s, as the controller. We process the data on their instructions.
• Integrations you connect: your consent when you connect them.

12. Sub-processors and Data Sharing

We do not sell your personal data. We share it only with the providers needed to run the service, and only as far as the task needs. These are our sub-processors:

We give customers 30 days’ notice by email before we add a sub-processor or replace one.

The services you connect yourself (Google services, Meta, WhatsApp, Facebook and Instagram, your own payment gateways, and Google Maps for Dispatch) are your own providers, described in Sections 4 to 7 and 10. They are not our sub-processors.

We also share data when required by law, court order, or governmental authority, and in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

13. Data Retention

• Account data: kept while your account is active. When you leave, we keep it for 30 days from when you have received everything in your exit package (the data archive, your domain and your website copy), then delete it, except what the law makes us keep.
• Billing records: kept for as long as the tax and accounting laws that apply require.
• Meta Platform Data: deleted within 30 days of disconnecting the integration, except where legally required.
• WhatsApp message history: kept while your account is active, then handled with the rest of the account data as above.
• AI conversation logs and contact memory: kept while your account is active and deleted with the rest of the account data. You can ask us to delete them sooner by emailing [email protected].
• Customer data processed on your behalf: kept on your instructions while your account is active, and deleted with the rest of the account data as above.
• Waitlist, contact form and chat data: kept while we run the waitlist and the related launch messages, or until we have answered your message. You can ask us to delete it at any time.

14. Security

We implement industry-standard technical and organisational measures to protect personal data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encrypted storage for sensitive credentials and access tokens
• Access controls limiting data access to authorised personnel
• Regular automated database backups
• Monitoring for unusual activity and security incidents

No method of transmission over the internet is 100% secure. If we become aware of a data breach affecting personal data we hold, we will notify the people affected as required by applicable law. Where we process data as a processor for a customer, we will tell that customer without undue delay after we become aware of it, with what we know about what happened and what data is affected.

15. Your Rights

Depending on your jurisdiction, you have the right to:

• Access the personal information we hold about you
• Correct or update inaccurate information
• Request deletion of your information
• Object to or restrict certain processing
• Withdraw consent at any time, where consent is the basis
• Receive your information in a portable, machine-readable format
• Lodge a complaint with a supervisory authority: in Israel, the Privacy Protection Authority (gov.il); in the EU, your local data protection authority; in the UK, the ICO; elsewhere, the authority in your country

To exercise any of these rights, email [email protected]. We will respond within 30 days (or sooner where required by law).

If you are a contact or customer of one of our customers, that business is the controller of your data. Please ask the business first. If you write to us, we will pass your request to the business and help it respond.

16. International Data Transfers

Our production servers are in Germany. We are established in Israel, and our team members and contractors may work from other countries. Some of our sub-processors are in the United States, and others are in China, India and Israel, as listed in Section 12. Data can also reach the places where our people work.

Where the law requires a transfer mechanism, we rely on the European Commission’s Standard Contractual Clauses or an equivalent mechanism. Where a country has been recognised as providing an adequate level of protection, we may rely on that instead.

17. Children’s Privacy

The service is intended for business use by adults. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we have inadvertently collected such data, we will delete it promptly.

18. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you by email or by a prominent notice on the service at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

19. Contact Us

For privacy-related questions, data requests, or complaints:

• The Upgrade Shop
• Company registration number 300330123
• Har Hatzofim 11, Holon, Israel
• Privacy enquiries: [email protected]
• General contact: [email protected]