1. Who we are and our roles
Shifter is operated by Shifter Strategy FZ-LLC, a UAE company holding UAE trade licence No. 17003064. Privacy questions can be sent to legal@shifter.co.
For our website, sales, billing, administration, security and vendor management, we generally act as a controller of personal data. When we process Customer Data inside a paid customer workflow on your behalf, we generally act as a processor/service provider under the Data Processing Addendum.
2. Personal data we collect
When you send an enquiry, we receive your website address, work email and the message you enter. We use a submission reference and timestamp to identify the request and handle retries. Please do not include sensitive personal information in the form.
When you request a free check, we receive your website address, a short description of what you sell, your main market, your work email and, if you add one, a buyer question. As with enquiries, we use a submission reference and timestamp to identify the request.
If you arrive through a link carrying campaign tags (for example, one of our emails or LinkedIn posts) and then send us an enquiry or partner application, it also records which campaign link brought you. This copy is kept only in that browser tab, is cleared when you close it, and reaches us only if you submit the form. (The tags in the page address are also counted by our website analytics, as described below.) It uses no cookies or identifiers, and it isn't recorded if your browser sends a Do Not Track or Global Privacy Control signal.
If you arrive through a creator's link (shifter.co/c/…), we note that creator's handle. If you have allowed creator credit in your cookie choices, your browser keeps it for up to 90 days so the creator is credited if you later send an enquiry, request a free check or buy; otherwise it is kept only in that browser tab. It reaches us only with a form or purchase you submit, and it is not kept if your browser sends a Global Privacy Control or Do Not Track signal.
Our hosting and email providers process technical information needed to deliver pages and messages, such as IP addresses, request times and delivery records. On our production website, Vercel Web Analytics provides aggregate page-visit statistics without analytics cookies. Vercel custom-event tracking is disabled. Page addresses sent to Vercel Web Analytics include any of the four campaign tags from the link you arrived by, and no other query parameters.
Google Analytics 4 loads only after you explicitly accept analytics cookies. It measures recognised public page visits, plan choices, checkout starts, enquiries accepted by our server and purchases verified by our server with Stripe. Purchase measurements include the actual amount and currency confirmed by Stripe and a hashed transaction identifier to avoid counting the same purchase twice. Analytics use fixed event names and approved plan labels. We do not send form contents, email addresses, submitted website addresses, card details, payment tokens or raw checkout or submission references to analytics. Page addresses exclude query strings and fragments, apart from any of the four campaign tags (utm_source, utm_medium, utm_campaign and utm_content) in the link you arrived by; Google Analytics receives only the origin of an external referring site, without its path, query or fragment.
Google Analytics uses cookies to distinguish visits after consent. Advertising storage, advertising user data and advertising personalisation remain disabled, and Google Signals is disabled. Your consent choice and its notice version are stored in your browser's local storage. You can change your choice using Cookie preferences in the footer; withdrawing consent stops future Google Analytics collection and clears its cookies on this site.
Vercel processes technical request information to produce aggregate statistics, including approximate location, browser and device categories. Its analytics service uses a short-lived request-derived hash rather than an analytics cookie; Vercel says that visitor-session hash is discarded after 24 hours. We do not load website analytics when your browser sends a Global Privacy Control or Do Not Track preference. See the Cookie Policy and Vercel’s analytics privacy information.
If you become a customer, we may also receive billing details, approved brand materials and the business information needed for the work agreed in your Order.
3. How we use personal data
We use enquiry details to review your website, respond about fit, prepare a proposal and keep a record of that conversation. Submitting the form does not subscribe you to a newsletter or start a paid engagement.
We use free-check details to write buyer questions for your category, run them on ChatGPT and Gemini from your main market, email you the results and, at most, one follow-up about them. We enter the buyer questions into those services, not your email address. We don’t publish that you requested a check. Requesting a check doesn’t add you to a newsletter or marketing list; we add you only if you ask.
We use a creator's handle to credit and pay that creator's referral commission. We don't tell creators who you are unless you agree; they see only that a referral they made became a client and the amounts their commission is based on.
We also use data to provide agreed services, handle billing and support, secure our systems, comply with law and maintain necessary business records.
3a. Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies, we process enquiry and free-check details to take steps you have asked for (Article 6(1)(b)), and to keep records and send one follow-up about your results on the basis of our legitimate interest in responding to business requests (Article 6(1)(f)). Optional analytics cookies rely on your consent (Article 6(1)(a)), which you can withdraw at any time. Keeping a creator's handle on your device relies on your consent (Article 6(1)(a)); recording it with a form or purchase you submit relies on our legitimate interest in paying referral commissions (Article 6(1)(f)). Customer work relies on our contract with the customer. You can object to processing based on legitimate interests by emailing legal@shifter.co.
4. B2B marketing and opt-outs
We may contact business representatives about Shifter where permitted by applicable law. We aim to use professional, relevant and non-deceptive outreach and to honour unsubscribe, STOP, do-not-contact and objection requests that are made known to us. Customers using Shifter for outreach workflows remain responsible for lawful basis, consent, suppression lists and compliance for their own campaigns.
6. AI providers and automated tools
Shifter may use AI model providers and automated tools to summarise, draft, classify, route, research, analyse or otherwise support workflows. AI outputs may be inaccurate or incomplete and should be reviewed appropriately, especially before external or high-impact use.
7. International transfers
We operate from the United Arab Emirates and may use service providers or customer-selected systems in other countries. Where required, we use contractual, technical and organisational safeguards appropriate to the nature of the processing and applicable data protection law, including the UAE Personal Data Protection Law where relevant.
8. Privacy rights
Depending on where you are located and the applicable law, you may have rights to access, correct, delete, restrict, object to or receive a copy of certain personal data. You may also have the right to complain to a data protection authority. To exercise these rights, contact legal@shifter.co . For Customer-controlled data, we may refer the request to the relevant Customer.
9. Retention, security and changes
We retain personal data for as long as reasonably needed for the purposes above, including service delivery, records, security, legal, tax, dispute and backup requirements. Operational Customer Data is generally returned or deleted within 90 days after contract end unless the Customer asks otherwise or legal, platform, security, backup or dispute requirements require longer retention. Aggregate website analytics are retained under the applicable Vercel plan and retention terms. The short-lived visitor hash is discarded after 24 hours; this does not mean aggregate statistics are deleted at that time. Google Analytics data retention is governed by the property's configured retention settings. Withdrawing consent stops future collection; it does not automatically erase data already collected. Contact us about privacy or deletion requests.
Free-check requests and results are kept for 12 months from delivery and then deleted, unless you become a customer, continue a conversation with us, or ask us to delete them sooner.
We use reasonable administrative, technical and organisational measures designed to protect data. No internet, cloud, AI, messaging or integration system is perfectly secure. We may update this policy from time to time and post the updated version here.