Terms of Service

These terms are between ONECOMPASS LIMITED, Cyprus registration HE 410135, whose registered office is at Griva Digeni, 81, Marinos Court, Floor 1 & 2, 6043, Larnaca, Cyprus (“Upsurge”, “we”, “us”), and the business identified in the account or order (“you” or “Customer”).

Upsurge is a business service. You must be at least 18 and authorized to bind the business you represent. By affirmatively accepting this version as an authorized representative, you enter an agreement comprising these terms, your accepted order and the applicable Data Processing Addendum (DPA). A signed order takes priority on commercial matters; the DPA takes priority on processing personal data; mandatory transfer clauses take priority where applicable. We record the version, accepting account, declared business identity and acceptance time. Publication alone does not replace an existing agreement or establish your acceptance.

Our Privacy Policy explains how personal data is handled. Acknowledging it is not consent to optional marketing, tracking or unrelated data use. Any required consent must be obtained separately.

Upsurge provides commerce analytics, customer profiles and audience tools, recommendations, Smart Search, overlays and quizzes, experiments, attribution, AI chat and content tools, workflow automation and integrations. Availability depends on your plan, configuration and supported providers. A feature being listed in the product does not mean it is enabled for your account.

During the subscription, you may use the service and related SDKs, plugins and APIs for your authorized business activities within the agreed limits and documentation. You must keep registration and billing details accurate, protect credentials, manage team permissions, and promptly report suspected unauthorized access. You are responsible for activity you authorize and for the stores and connections you configure.

We may update the service to maintain security, comply with law or improve functionality. We will give reasonable advance notice of a material reduction in paid core functionality where practicable. A substantial adverse change during a prepaid term allows you to terminate the affected service and request a proportionate refund for its unused prepaid period, except where the change is required by law.

Your accepted order or checkout states the price, currency, billing interval, usage limits, any trial, renewal arrangements and applicable charges. Taxes are additional only where disclosed and permitted by law. We do not impose an undisclosed overage charge or convert a free trial into paid service without the required advance disclosure and authorization.

Where you expressly select a recurring subscription, it renews for the stated interval until cancelled. You authorize the agreed recurring payments through the payment processor. We will notify you of a price change at least 30 days before it takes effect; it will apply no earlier than the next renewal, giving you an opportunity to cancel.

You may cancel renewal through a billing portal if available or by emailing [email protected] from an authorized account contact before the next renewal. Cancellation normally takes effect at the end of the paid period. We will confirm the effective date. A request to exercise privacy rights is handled separately and is not a substitute for cancelling billing.

Except where an order, these terms or mandatory law provides otherwise, fees for a billing period already begun are non-refundable and unused limits do not roll over. We will correct duplicate or erroneous charges. Nothing here removes a statutory refund right. If we discontinue a paid service for reasons unrelated to your breach, or you terminate because of our uncured material breach, we will refund its unused prepaid period proportionately.

If an undisputed payment is overdue, we may suspend paid access after notice and a reasonable opportunity to resolve it. You remain responsible for properly incurred charges. Optional third-party services may charge you separately under their own terms.

You control your products, claims, offers, customer communications, audience rules and workflow actions. You are responsible for their accuracy and lawfulness, required notices and permissions, honoring customer choices, and fulfilling purchases, discounts and support promises. Upsurge does not become the seller of goods offered by your store.

Before collecting or sending personal data, determine your GDPR role and lawful basis, provide appropriate information, and obtain and record consent where required. Non-essential browser storage, tracking, fingerprinting and advertising require the controls applicable to your audience. Do not load or run those features before required consent, and stop them when it is withdrawn. For SDK version 3, pass real, separate consent choices for analytics, personalization, marketing and fingerprinting; omitted permissions remain off. Do not substitute a blanket grant or treat an analytics choice as permission for the other purposes. Verify that the updated SDK, server and store integration have been deployed; earlier integrations require additional merchant-side blocking.

Configure only the data and permissions needed for each integration. Do not include unnecessary personal data in URLs, events, uploaded files, prompts or logs. Do not submit special-category data, criminal-record data, payment-card numbers, passwords or children’s data unless expressly agreed in writing with appropriate safeguards.

• Do not send spam, deceptive messages, unlawful discrimination or content that infringes another person’s rights. Honor applicable marketing consent, unsubscribe and suppression requirements.
• Do not bypass consent or security controls, exceed access permissions, extract another merchant’s information, introduce malicious code, or disrupt or overload the service.
• Do not resell access, remove proprietary notices, or copy or reverse-engineer the service except as expressly permitted by the agreement or mandatory law.
• Do not use the service for prohibited AI practices, unlawful surveillance or solely automated decisions with legal or similarly significant effects without the required legal basis and safeguards.

You retain your rights in the content and data you provide, subject to the rights of individuals and other rightsholders. You grant us a limited right to host, process, reproduce and transmit that material as necessary to provide, secure and support the agreed service and carry out your lawful instructions. This is not permission to sell identifiable shopper data or use it for unrelated advertising or independent model training.

The DPA accepted with these terms includes the processing, security, retention and subprocessor schedules for the standard service. Any separately negotiated restrictions or non-standard processing must be agreed in writing before that processing begins. Your configuration and authorized API or workflow requests form part of your documented instructions. Shared intelligence or other processing for separate purposes needs its own lawful arrangement and disclosures.

Each party will protect the other’s confidential information with reasonable care, use it only for the agreement, and disclose it only to people who need access and are bound by confidentiality or where disclosure is legally required. This does not cover information independently developed, lawfully received without restriction or publicly available without breach. Personal data remains protected under applicable law regardless.

AI can generate text, images, recommendations, search rankings, predictions and proposed actions. It can be wrong, incomplete, biased, non-unique or unsuitable. Review outputs, targeting, prices, discounts and customer-facing claims before using them, and provide human oversight appropriate to the impact. No uplift, conversion rate, revenue outcome or prediction accuracy is guaranteed.

You authorize actions within the permissions and workflows you enable, including configured messages, handoffs, updates and discounts. Some actions can run automatically after configuration; supervise them and limit permissions appropriately. You are responsible for the rights to your inputs and the lawful use of outputs. Where required, inform people that they are interacting with AI or viewing AI-generated content.

As between the parties, you retain rights in your inputs and may use outputs for your business. We assign any rights we may hold in outputs generated specifically for your account to you, to the extent transferable, excluding our underlying software, models, templates and third-party material. We cannot promise that an output is copyrightable, exclusive or free of third-party rights.

Provider-specific processing and usage restrictions apply to connected AI services. No statement here represents that all providers use the same retention or training settings. You must assess the provider and avoid submitting content that your agreement or privacy obligations do not allow it to receive.

Connecting a commerce platform, advertising account, email or support provider, spreadsheet, messaging tool, external assistant or webhook authorizes the exchanges and actions within the permissions you grant. You must hold the necessary rights to connect the service and comply with its terms.

Providers control their own services and may change, limit or discontinue APIs. We are not responsible for third-party products outside our control, but remain responsible for our own contractual duties and for subprocessors as required by the DPA and law. Disconnecting a connection can stop future access without deleting records already transferred; use the relevant deletion processes as well.

We and our licensors retain rights in the service, software, interfaces, documentation, underlying models and branding. You receive only the use rights granted in this agreement. Third-party and open-source components remain subject to their applicable licenses. You may voluntarily provide feedback; we may use it to improve the service without an obligation to pay, but this does not authorize reuse of your confidential information or personal data outside the agreement.

Either party may terminate for a material breach not remedied within 30 days after written notice. We may suspend the affected access immediately where reasonably necessary to prevent a security threat, unlawful processing or material harm, or to comply with law. Where lawful and practicable, we will explain the reason, limit the suspension to what is necessary and restore access when it is resolved.

After termination, access ends and outstanding properly incurred charges remain payable. Coordinate data return before access ends; contact us for an available machine-readable export and an agreed transition plan. Where applicable, mandatory EU rules on switching data-processing services take priority over conflicting terms or charges.

Personal data is returned or deleted on your instruction under the DPA, except where law requires retention. The agreed schedule must cover active systems, replicas and backups. We do not promise that cancelling a subscription instantly erases all records. Confidentiality, payment obligations already incurred, intellectual-property provisions and provisions intended to survive continue as necessary.

We will provide the paid service with reasonable skill and care and materially in accordance with the accepted order. Tell us about a material failure so that we can investigate and remedy it. Any separately agreed service-level commitment applies according to its terms.

Subject to those commitments and mandatory law, we do not promise uninterrupted or error-free operation, compatibility with every third-party system, or a particular commercial result. Trials and clearly identified beta features are offered for evaluation and may change or end. No disclaimer removes our obligations under the DPA or applicable data-protection law.

To the extent permitted by law, neither party is liable to the other for indirect or consequential losses or lost profits arising from the agreement. Each party’s aggregate liability under or in connection with the agreement is limited to the fees paid or payable for the affected service in the 12 months preceding the event giving rise to the claim.

These exclusions and cap do not apply to fraud, willful misconduct, gross negligence, death or personal injury caused by negligence, unpaid agreed fees, or liability that cannot lawfully be limited. They do not restrict an individual’s rights to compensation under GDPR Article 82, supervisory-authority powers, or liability under mandatory transfer clauses. Any allocation between the parties remains subject to those mandatory rights and rules.

The agreement is governed by the laws of the Republic of Cyprus, excluding conflict-of-laws rules. Subject to mandatory jurisdiction rules, the courts of the Republic of Cyprus have jurisdiction over contractual disputes. The parties will first make a good-faith effort to resolve a notified dispute, without limiting urgent court relief or applicable limitation periods.

The service is offered for business use. If mandatory consumer protections nevertheless apply, these terms do not remove them, including any mandatory rights concerning withdrawal, remedies, governing law or local courts. Nothing limits a person’s right to complain to a data-protection authority or seek a remedy under the GDPR.

We will notify account contacts of material changes to effective terms at least 30 days in advance, unless a shorter period is necessary for legal or urgent security reasons. Changes will not retroactively alter accrued rights. If you do not agree, you may cancel before they apply; a materially adverse change during a prepaid term allows termination of the affected service with a proportionate refund of the unused prepaid period. Where affirmative acceptance is required, notice or continued use does not replace it.

If a provision is unenforceable, the remaining provisions continue to apply. A failure to enforce a provision is not a waiver. Neither party may transfer the agreement in a way that reduces the other’s accrued rights or data-protection safeguards; any lawful business succession remains subject to those protections.

For billing, cancellation and service notices, contact [email protected]. For privacy and data-processing matters, contact [email protected]. Formal written notices may also be sent to our registered office. Keep your account contact details current so we can deliver service and legal notices.

Service and billing support

Privacy and data-processing requests