{ "version": "2026-10-17", "effectiveDate": "17 October 2026", "hashes": { "terms": "60aee85bda1d34d4c74600622f5a12fbb42d85eb177de371951864ef15afc5cc", "privacy": "dda20337c19256716d1d0765ba948250f635ff953014ab58ccb4b677e1ec5e3a", "dpa": "33ef1a80c442ed96129fa40b84793df50a2f026617db1e07acb6db56862c58f6" }, "documents": { "terms": { "path": "/terms", "title": "Terms of Service", "description": "Business terms for Upsurge accounts, subscriptions, integrations, AI tools, customer data and service use.", "summary": "The terms for using Upsurge to understand and improve your commerce experience.", "sections": [ { "id": "agreement", "title": "1. Our agreement", "paragraphs": [ "These terms are between ONECOMPASS LIMITED, Cyprus registration HE 410135, whose registered office is at Griva Digeni, 81, Marinos Court, Floor 1 & 2, 6043, Larnaca, Cyprus (“Upsurge”, “we”, “us”), and the business identified in the account or order (“you” or “Customer”).", "Upsurge is a business service. You must be at least 18 and authorized to bind the business you represent. By affirmatively accepting this version as an authorized representative, you enter an agreement comprising these terms, your accepted order and the applicable Data Processing Addendum (DPA). A signed order takes priority on commercial matters; the DPA takes priority on processing personal data; mandatory transfer clauses take priority where applicable. We record the version, accepting account, declared business identity and acceptance time. Publication alone does not replace an existing agreement or establish your acceptance.", "Our Privacy Policy explains how personal data is handled. Acknowledging it is not consent to optional marketing, tracking or unrelated data use. Any required consent must be obtained separately." ] }, { "id": "services", "title": "2. Services and access", "paragraphs": [ "Upsurge provides commerce analytics, customer profiles and audience tools, recommendations, Smart Search, overlays and quizzes, experiments, attribution, AI chat and content tools, workflow automation and integrations. Availability depends on your plan, configuration and supported providers. A feature being listed in the product does not mean it is enabled for your account.", "During the subscription, you may use the service and related SDKs, plugins and APIs for your authorized business activities within the agreed limits and documentation. You must keep registration and billing details accurate, protect credentials, manage team permissions, and promptly report suspected unauthorized access. You are responsible for activity you authorize and for the stores and connections you configure.", "We may update the service to maintain security, comply with law or improve functionality. We will give reasonable advance notice of a material reduction in paid core functionality where practicable. A substantial adverse change during a prepaid term allows you to terminate the affected service and request a proportionate refund for its unused prepaid period, except where the change is required by law." ] }, { "id": "subscriptions", "title": "3. Plans, fees and cancellation", "paragraphs": [ "Your accepted order or checkout states the price, currency, billing interval, usage limits, any trial, renewal arrangements and applicable charges. Taxes are additional only where disclosed and permitted by law. We do not impose an undisclosed overage charge or convert a free trial into paid service without the required advance disclosure and authorization.", "Where you expressly select a recurring subscription, it renews for the stated interval until cancelled. You authorize the agreed recurring payments through the payment processor. We will notify you of a price change at least 30 days before it takes effect; it will apply no earlier than the next renewal, giving you an opportunity to cancel.", "You may cancel renewal through a billing portal if available or by emailing hello@upsur.ge from an authorized account contact before the next renewal. Cancellation normally takes effect at the end of the paid period. We will confirm the effective date. A request to exercise privacy rights is handled separately and is not a substitute for cancelling billing.", "Except where an order, these terms or mandatory law provides otherwise, fees for a billing period already begun are non-refundable and unused limits do not roll over. We will correct duplicate or erroneous charges. Nothing here removes a statutory refund right. If we discontinue a paid service for reasons unrelated to your breach, or you terminate because of our uncured material breach, we will refund its unused prepaid period proportionately.", "If an undisputed payment is overdue, we may suspend paid access after notice and a reasonable opportunity to resolve it. You remain responsible for properly incurred charges. Optional third-party services may charge you separately under their own terms." ] }, { "id": "customer-responsibilities", "title": "4. Your stores, campaigns and lawful use", "paragraphs": [ "You control your products, claims, offers, customer communications, audience rules and workflow actions. You are responsible for their accuracy and lawfulness, required notices and permissions, honoring customer choices, and fulfilling purchases, discounts and support promises. Upsurge does not become the seller of goods offered by your store.", "Before collecting or sending personal data, determine your GDPR role and lawful basis, provide appropriate information, and obtain and record consent where required. Non-essential browser storage, tracking, fingerprinting and advertising require the controls applicable to your audience. Do not load or run those features before required consent, and stop them when it is withdrawn. For SDK version 3, pass real, separate consent choices for analytics, personalization, marketing and fingerprinting; omitted permissions remain off. Do not substitute a blanket grant or treat an analytics choice as permission for the other purposes. Verify that the updated SDK, server and store integration have been deployed; earlier integrations require additional merchant-side blocking.", "Configure only the data and permissions needed for each integration. Do not include unnecessary personal data in URLs, events, uploaded files, prompts or logs. Do not submit special-category data, criminal-record data, payment-card numbers, passwords or children’s data unless expressly agreed in writing with appropriate safeguards." ], "bullets": [ "Do not send spam, deceptive messages, unlawful discrimination or content that infringes another person’s rights. Honor applicable marketing consent, unsubscribe and suppression requirements.", "Do not bypass consent or security controls, exceed access permissions, extract another merchant’s information, introduce malicious code, or disrupt or overload the service.", "Do not resell access, remove proprietary notices, or copy or reverse-engineer the service except as expressly permitted by the agreement or mandatory law.", "Do not use the service for prohibited AI practices, unlawful surveillance or solely automated decisions with legal or similarly significant effects without the required legal basis and safeguards." ] }, { "id": "data", "title": "5. Customer data and confidentiality", "paragraphs": [ "You retain your rights in the content and data you provide, subject to the rights of individuals and other rightsholders. You grant us a limited right to host, process, reproduce and transmit that material as necessary to provide, secure and support the agreed service and carry out your lawful instructions. This is not permission to sell identifiable shopper data or use it for unrelated advertising or independent model training.", "The DPA accepted with these terms includes the processing, security, retention and subprocessor schedules for the standard service. Any separately negotiated restrictions or non-standard processing must be agreed in writing before that processing begins. Your configuration and authorized API or workflow requests form part of your documented instructions. Shared intelligence or other processing for separate purposes needs its own lawful arrangement and disclosures.", "Each party will protect the other’s confidential information with reasonable care, use it only for the agreement, and disclose it only to people who need access and are bound by confidentiality or where disclosure is legally required. This does not cover information independently developed, lawfully received without restriction or publicly available without breach. Personal data remains protected under applicable law regardless." ] }, { "id": "ai", "title": "6. AI features and automated actions", "paragraphs": [ "AI can generate text, images, recommendations, search rankings, predictions and proposed actions. It can be wrong, incomplete, biased, non-unique or unsuitable. Review outputs, targeting, prices, discounts and customer-facing claims before using them, and provide human oversight appropriate to the impact. No uplift, conversion rate, revenue outcome or prediction accuracy is guaranteed.", "You authorize actions within the permissions and workflows you enable, including configured messages, handoffs, updates and discounts. Some actions can run automatically after configuration; supervise them and limit permissions appropriately. You are responsible for the rights to your inputs and the lawful use of outputs. Where required, inform people that they are interacting with AI or viewing AI-generated content.", "As between the parties, you retain rights in your inputs and may use outputs for your business. We assign any rights we may hold in outputs generated specifically for your account to you, to the extent transferable, excluding our underlying software, models, templates and third-party material. We cannot promise that an output is copyrightable, exclusive or free of third-party rights.", "Provider-specific processing and usage restrictions apply to connected AI services. No statement here represents that all providers use the same retention or training settings. You must assess the provider and avoid submitting content that your agreement or privacy obligations do not allow it to receive." ] }, { "id": "integrations", "title": "7. Third-party services", "paragraphs": [ "Connecting a commerce platform, advertising account, email or support provider, spreadsheet, messaging tool, external assistant or webhook authorizes the exchanges and actions within the permissions you grant. You must hold the necessary rights to connect the service and comply with its terms.", "Providers control their own services and may change, limit or discontinue APIs. We are not responsible for third-party products outside our control, but remain responsible for our own contractual duties and for subprocessors as required by the DPA and law. Disconnecting a connection can stop future access without deleting records already transferred; use the relevant deletion processes as well." ] }, { "id": "intellectual-property", "title": "8. Upsurge intellectual property", "paragraphs": [ "We and our licensors retain rights in the service, software, interfaces, documentation, underlying models and branding. You receive only the use rights granted in this agreement. Third-party and open-source components remain subject to their applicable licenses. You may voluntarily provide feedback; we may use it to improve the service without an obligation to pay, but this does not authorize reuse of your confidential information or personal data outside the agreement." ] }, { "id": "suspension", "title": "9. Suspension, termination and data return", "paragraphs": [ "Either party may terminate for a material breach not remedied within 30 days after written notice. We may suspend the affected access immediately where reasonably necessary to prevent a security threat, unlawful processing or material harm, or to comply with law. Where lawful and practicable, we will explain the reason, limit the suspension to what is necessary and restore access when it is resolved.", "After termination, access ends and outstanding properly incurred charges remain payable. Coordinate data return before access ends; contact us for an available machine-readable export and an agreed transition plan. Where applicable, mandatory EU rules on switching data-processing services take priority over conflicting terms or charges.", "Personal data is returned or deleted on your instruction under the DPA, except where law requires retention. The agreed schedule must cover active systems, replicas and backups. We do not promise that cancelling a subscription instantly erases all records. Confidentiality, payment obligations already incurred, intellectual-property provisions and provisions intended to survive continue as necessary." ] }, { "id": "warranties", "title": "10. Service commitments and limitations", "paragraphs": [ "We will provide the paid service with reasonable skill and care and materially in accordance with the accepted order. Tell us about a material failure so that we can investigate and remedy it. Any separately agreed service-level commitment applies according to its terms.", "Subject to those commitments and mandatory law, we do not promise uninterrupted or error-free operation, compatibility with every third-party system, or a particular commercial result. Trials and clearly identified beta features are offered for evaluation and may change or end. No disclaimer removes our obligations under the DPA or applicable data-protection law." ] }, { "id": "liability", "title": "11. Liability", "paragraphs": [ "To the extent permitted by law, neither party is liable to the other for indirect or consequential losses or lost profits arising from the agreement. Each party’s aggregate liability under or in connection with the agreement is limited to the fees paid or payable for the affected service in the 12 months preceding the event giving rise to the claim.", "These exclusions and cap do not apply to fraud, willful misconduct, gross negligence, death or personal injury caused by negligence, unpaid agreed fees, or liability that cannot lawfully be limited. They do not restrict an individual’s rights to compensation under GDPR Article 82, supervisory-authority powers, or liability under mandatory transfer clauses. Any allocation between the parties remains subject to those mandatory rights and rules." ] }, { "id": "law", "title": "12. Governing law and disputes", "paragraphs": [ "The agreement is governed by the laws of the Republic of Cyprus, excluding conflict-of-laws rules. Subject to mandatory jurisdiction rules, the courts of the Republic of Cyprus have jurisdiction over contractual disputes. The parties will first make a good-faith effort to resolve a notified dispute, without limiting urgent court relief or applicable limitation periods.", "The service is offered for business use. If mandatory consumer protections nevertheless apply, these terms do not remove them, including any mandatory rights concerning withdrawal, remedies, governing law or local courts. Nothing limits a person’s right to complain to a data-protection authority or seek a remedy under the GDPR." ] }, { "id": "changes-contact", "title": "13. Changes and contact", "paragraphs": [ "We will notify account contacts of material changes to effective terms at least 30 days in advance, unless a shorter period is necessary for legal or urgent security reasons. Changes will not retroactively alter accrued rights. If you do not agree, you may cancel before they apply; a materially adverse change during a prepaid term allows termination of the affected service with a proportionate refund of the unused prepaid period. Where affirmative acceptance is required, notice or continued use does not replace it.", "If a provision is unenforceable, the remaining provisions continue to apply. A failure to enforce a provision is not a waiver. Neither party may transfer the agreement in a way that reduces the other’s accrued rights or data-protection safeguards; any lawful business succession remains subject to those protections.", "For billing, cancellation and service notices, contact hello@upsur.ge. For privacy and data-processing matters, contact privacy@upsur.ge. Formal written notices may also be sent to our registered office. Keep your account contact details current so we can deliver service and legal notices." ], "links": [ { "label": "Service and billing support", "href": "mailto:hello@upsur.ge" }, { "label": "Privacy and data-processing requests", "href": "mailto:privacy@upsur.ge" } ] } ] }, "privacy": { "path": "/privacy", "title": "Privacy Policy", "description": "How Upsurge handles account and storefront data, browser storage, AI features, and privacy rights in the EU and EEA.", "summary": "Understand what information Upsurge handles, why it is used, and how to exercise your rights.", "sections": [ { "id": "who-we-are", "title": "1. Who we are and when this policy applies", "paragraphs": [ "Upsurge is operated by ONECOMPASS LIMITED, a Cyprus private limited company registered under number HE 410135, with its registered office at Griva Digeni, 81, Marinos Court, Floor 1 & 2, 6043, Larnaca, Cyprus. In this policy, “Upsurge”, “we”, “us” and “our” refer to that company. Contact our privacy team at privacy@upsur.ge.", "This policy explains processing associated with our website, merchant accounts, agreement and privacy-notice acknowledgment records, support, billing, and the e-commerce services merchants connect to their stores. It covers individuals in the European Union and European Economic Area (EEA), as well as other people whose information we handle.", "We act as a controller when deciding how to use account, business-contact, billing, security and support information for our own business purposes. For storefront information handled to provide a merchant’s chosen service, that merchant normally determines the purposes and we act as its processor under a data-processing agreement. If the merchant acts for another controller, we may act as a subprocessor. Merchant privacy notices explain their own purposes, legal bases and integrations.", "Shared intelligence or identity processing can involve additional purposes and controller responsibilities. It is described separately below; a processor agreement alone does not authorize independent reuse of shopper data." ] }, { "id": "information", "title": "2. Information we handle and where it comes from", "bullets": [ "Account and business details: name, email, company, store domains, account and team identifiers, roles, preferences, authentication and session records. These come from you, your organization’s administrator or the sign-in service you use.", "Commercial and billing records, where applicable: business contact and address, tax information, agreed plan, subscription, invoice and payment status associated with any agreed paid services.", "Storefront activity: page URLs and titles, referrers and campaign parameters, product views, searches, cart and checkout activity, purchases, order values, overlay and recommendation interactions, quiz answers, experiment assignments, and engagement summaries such as scrolling and time on a page. Sources include the merchant’s browser integration, server events and connected commerce systems.", "Identifiers and device context: device, visitor, session and merchant-provided user IDs; browser, operating system, screen dimensions, language and time zone; and, when enabled, a browser fingerprint. Some identity features use hashed identifiers. Hashing or replacing a name with an ID does not necessarily make the information anonymous.", "Customer records: names, email addresses, phone numbers, external customer IDs, order and spending history, audience memberships, recent activity, consent and suppression records, and inferred interests or predictions. Merchants may import these from their commerce platform, submit them through APIs or collect them through campaigns.", "AI and support content: chatbot and merchant-assistant messages, prompts, outputs, uploaded documents and images, knowledge sources, relevant product/cart/customer context, support handoffs, and records of tool actions and generated content. Where a merchant lets its team answer in the chat, a visitor who asks for a person opens a support ticket holding the conversation, the team’s replies, the ticket’s status, priority and assignee, the page and language where it was opened, and when the visitor last saw a reply or closed the chat or page. Visitors, merchants and connected systems supply this information.", "Support reply email: in such a conversation a visitor may give an email address to receive team replies they have not seen in the chat. Giving it is optional. It is used only to email replies in that conversation, through Twilio SendGrid under the store’s name; it is not shown to the merchant’s team and can be removed in the chat at any time. Records of each reply email, including a hashed form of the address, are kept with the ticket. If an address bounces, it is deleted and a hashed form is kept so that it is not used again for that conversation.", "Integration and operational records: connection credentials or tokens, permissions, workflow inputs and outputs, delivery and synchronization records, troubleshooting information, request metadata and audit logs. Network services receive IP addresses for connection delivery and security, including abuse prevention and rate limiting." ], "paragraphs": [ "The combination collected depends on the features and integrations a merchant enables. Ordinary page URLs, referrers and custom event properties can contain personal information. Merchants should exclude sensitive URL parameters and unnecessary personal information before sending events. Do not submit payment-card numbers, passwords, health information, special-category data or criminal-record information in events, prompts, chats or uploaded content.", "The public analytics ingestion path derives coarse country information only when its analytics-consent signal is present and does not retain the IP address in that analytics location field. This is not a promise that all infrastructure or security logs exclude IP addresses." ] }, { "id": "purposes", "title": "3. Purposes and legal bases", "paragraphs": [ "For processing where we act as controller, we identify a purpose and legal basis rather than treating acceptance of this policy as consent to everything. The following bases apply under Article 6 GDPR, subject to the particular relationship and circumstances." ], "bullets": [ "Provide an individual subscriber’s account and requested services, answer pre-contract requests and administer payment: performance of a contract or steps you request before a contract (Article 6(1)(b)). Required account and payment information is necessary to supply the requested service; without it we may be unable to do so.", "Manage corporate accounts and communicate with their staff: our legitimate interests in administering business relationships and supporting authorized users (Article 6(1)(f)). An employer’s contract does not itself make each employee a party to that contract.", "Protect accounts, investigate abuse, diagnose service faults, and establish or defend claims: legitimate interests in secure and reliable services and protecting legal rights (Article 6(1)(f)), balanced against individuals’ rights and reasonable expectations.", "Maintain legally required accounting records and respond to binding legal obligations: compliance with the applicable legal obligation (Article 6(1)(c)).", "Optional marketing and non-essential tracking where consent is required: your freely given, specific consent (Article 6(1)(a) and applicable electronic-communications rules). You can decline or withdraw without losing unrelated service functionality. Any permitted business marketing based on legitimate interests remains subject to an unconditional right to object to direct marketing.", "Process a merchant’s shopper data for analytics, search, personalization, campaigns, chat or workflows: the merchant determines and documents its legal basis. We process on its documented instructions under the applicable data-processing agreement; our contract with the merchant does not replace a lawful basis for its shoppers." ] }, { "id": "cookies", "title": "4. Cookies, browser storage and consent", "paragraphs": [ "Upsurge uses cookies and browser storage for sign-in, preferences and storefront features. Non-essential analytics, attribution, advertising and fingerprinting require prior consent where applicable under EU national laws implementing the ePrivacy Directive. A merchant must explain each purpose and provider and offer an accessible way to refuse and later withdraw consent.", "Consent controls: SDK version 3 starts with analytics, personalization, marketing and fingerprinting permissions off. The integration must pass a separate affirmative choice for each purpose before the corresponding processing starts. Analytics consent alone does not authorize personalization, marketing or fingerprinting. The updated server also rejects browser analytics events without an affirmative analytics signal and gates profile and workflow processing by the additional purposes they require. These controls apply to SDK version 3 and the current integrations. Merchants must keep their installed integration up to date and configure their consent controls correctly.", "Use the store’s consent controls to refuse or change your choices as easily as accepting them. The updated integration stops the affected optional processing when permission is withdrawn; merchants must connect their consent controls to that update and retain evidence of the choices obtained. You can also clear browser storage, but doing so does not erase information already received by a merchant or Upsurge and may reset your stored choices. For deletion of existing information, use the rights process below." ], "bullets": [ "Account and preference storage includes the authentication session cookie, the upsurge_locale preference cookie (up to one year), and local language/theme preferences. Actual authentication lifetime depends on the session configuration.", "After the relevant permission, storefront local storage can include upsurge_device_id and, after identification, upsurge_user_id. The version 3 integration uses temporary in-memory identifiers before permission for persistent storage. Local storage has no automatic browser expiry; it remains until cleared or reset. Optional fingerprint-derived identifiers are refreshed after seven days; refresh is not a promise of deletion of server-side records.", "Session storage includes session IDs, acquisition details, experiment assignments, cart context, attribution state and workflow state. A logical SDK session normally times out after 30 minutes of inactivity; browser session storage generally lasts for the tab session and may be restored by the browser.", "Fingerprinting is off by default and requires both merchant enablement and a separate affirmative fingerprinting permission in the updated integration. When used, the fingerprint library may also contact its vendor’s infrastructure. Do Not Track support is configurable and is not enabled by default; do not assume a browser signal alone blocks collection." ] }, { "id": "ai-profiling", "title": "5. AI, personalization and shared intelligence", "paragraphs": [ "Recommendations, Smart Search, audience rules and customer insights can use activity, purchases and inferred interests to rank products, group customers, measure campaigns or estimate outcomes such as churn, next purchase or customer lifetime value. These inferences can be inaccurate. Merchants decide how to use them and should offer the choices described in their own privacy notices.", "AI chat and content tools may transmit messages, relevant conversation history, retrieved knowledge, product information and permitted customer/cart context to the model provider. The current chatbot uses Google’s Gemini services; other AI features or merchant-connected workflows can use Google, OpenAI or Anthropic. Outputs and tool actions may be stored with the conversation or workflow. Connecting an external assistant can also allow data access or actions within the permissions you authorize.", "Upsurge includes consent-scoped identity and shared-intelligence capabilities. Cross-store matching and reuse for shared signals require a separately established purpose, lawful basis, appropriate notices and any necessary consent. These capabilities must not be treated as anonymous merely because they use hashed or pseudonymous IDs. Before enabling them, the parties must establish their respective controller/processor roles and the specific disclosures and controls.", "Customer-profile prediction models are trained per merchant. A separate platform identity graph can maintain platform-scoped hashed identifiers; configured platform exports can forward consent-scoped identity and intent events. Platform exports are enabled in the serving staging and production environments. RudderStack processes these events in its US production region, with sample-event storage enabled for a rolling 30 days. The shared stream remains enabled. Its purpose and role assessment and end-to-end withdrawal/deletion verification remain outstanding and have been deferred; this policy does not represent those checks as complete or authorize additional processing. Contact our privacy team about requests affecting this stream.", "Google’s published Gemini terms distinguish service and billing arrangements. Its paid-service data-use terms do not permit use of prompts or responses to improve its products, but its published abuse-monitoring policy describes 55-day retention and some features have additional storage rules. Vertex AI has separate feature-specific rules. Current generation uses the direct Gemini API; knowledge embeddings use that API with a Vertex AI fallback, while product embeddings use Vertex AI in the US. The reviewed source does not enable Files, explicit caching, Interactions, Live or grounding features. The deployed Gemini keys have been matched to billing-enabled projects, and the production project is on a paid tier. Direct Gemini processing is not limited to the Vertex AI region. This policy makes no blanket promise of zero retention or identical model-training terms across providers. Applicable provider contracts, account settings and the data sent must be verified for each enabled feature. The data-processing addendum limits processing on a merchant’s behalf to authorized purposes; independent model training or unrelated reuse requires a separate lawful arrangement.", "The service is intended for commerce assistance and optimization. Merchants must not use it to make solely automated decisions producing legal or similarly significant effects on individuals without the safeguards required by law, including any applicable right to human intervention and to contest the decision." ], "links": [ { "label": "Google Gemini API terms", "href": "https://ai.google.dev/gemini-api/terms" }, { "label": "Google Gemini abuse-monitoring policy", "href": "https://ai.google.dev/gemini-api/docs/usage-policies" } ] }, { "id": "recipients", "title": "6. Who can receive information", "bullets": [ "Authorized staff and service providers that help deliver hosting, authentication, databases, storage, analytics infrastructure, AI processing, communications, monitoring and support. Our service providers include Google Cloud/Firebase, Google Gemini, Cloudflare R2, Dash0, Typesense Cloud, RudderStack and Twilio SendGrid. ONECOMPASS has confirmed that it uses these services under company accounts and has accepted their data-processing terms. Which provider receives a particular person’s data depends on the feature, account settings and data sent. The AI processing paths and location distinctions are described above and in the data-processing schedule.", "The merchant operating a storefront and its authorized team members, who can access customer information, reports, conversations and campaign or workflow records within their permissions.", "Providers a merchant or user connects, such as commerce platforms, advertising and attribution services, email services, support systems, spreadsheets, messaging services, webhooks and external AI assistants. Some act for the merchant, some for us and some as independent controllers; their own notices and contracts also apply.", "Professional advisers, authorities or other recipients where necessary to comply with law, investigate unlawful conduct or protect legal rights. In a corporate transaction, relevant information may be disclosed subject to appropriate confidentiality and data-protection arrangements." ], "paragraphs": [ "A list of tools supported by the product is not a list of subprocessors actually receiving your data. The data-processing schedule identifies the service providers, purposes, known processing locations and transfer arrangements, including outstanding verification limitations. Contact the privacy team for information about a particular service or connection." ] }, { "id": "transfers", "title": "7. Processing outside the EEA", "paragraphs": [ "Upsurge’s operator is in Cyprus, but that does not mean every service or database is hosted in the EEA. The 11 October 2026 infrastructure review confirmed US-based Firestore databases and primary application/storage services in staging and production. Attribution warehouse datasets are in the EU, while identity-graph datasets are in the US. Production Typesense search indexes are hosted in Frankfurt, Germany; staging search indexes are in Northern Virginia, United States. RudderStack uses its US production region. Cloudflare R2 stores our static SDK assets in Eastern North America. Dash0 monitoring uses Google Cloud’s Netherlands region. SendGrid uses its global service rather than an EU-specific endpoint. These service locations do not by themselves determine every support or onward-processing location. Provider support, AI services and merchant-selected integrations can involve additional countries. There is no EU-only hosting commitment.", "A transfer subject to GDPR Chapter V requires an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, with assessment of the transfer and supplementary measures where needed. This policy does not assert that a particular vendor is certified under a framework, that all transfers are covered by executed clauses, or that EU-only hosting is provided.", "The processing schedules record the relevant destinations and applicable safeguards. Outstanding verification of the shared RudderStack stream remains separate; publication or acknowledgment of this notice is not proof that those checks are complete. You can contact the privacy team to request information about the applicable safeguards and a copy, with necessary redactions to protect confidential information." ] }, { "id": "retention", "title": "8. How long information is kept", "paragraphs": [ "Retention must be limited to what is necessary for the purpose. Account information is needed while the account is in use and for an appropriate period to resolve support, security or legal matters. Billing records may need to be retained for applicable accounting and tax obligations. Retention after a dispute or legal hold is limited to the records necessary for that obligation.", "For merchant-controlled data, the processing agreement and a verified retention schedule must define how long each category remains in active stores, logs, analytics systems and backups, and what happens when the service ends. Deleting an account or a browser identifier does not necessarily delete every related record.", "Chatbot retention schedule: sessions, stored model threads and messages expire 180 days after session creation; tool audits, discount actions and handoffs after 365 days from their creation; turn observations and evaluation records after 90 days from creation; and completed, failed, cancelled or otherwise terminal knowledge-ingestion and product-embedding jobs after 30 days from completion. Activity does not renew a session deadline. Source controls enforce expiry on relevant reads and writes and provide cleanup. Hourly cleanup and database expiry rules enforce these periods; historical cleanup is verified at deployment. Current knowledge sources and pending or processing jobs are outside that terminal-job schedule.", "Support inbox records follow the chatbot conversation they belong to: support tickets, their messages and reply-email records expire with its session, no later than 180 days after the session was created. A visitor’s reply email address is deleted when the visitor removes it, when it bounces or when the ticket expires. Merchant-authorized customer erasure deletes the support records of conversations linked to that customer and removes the customer’s email address, including the hashed form kept after a bounce, from the merchant’s tickets. Reply-email records keep a hashed form of the recipient address until they expire with the ticket.", "Warehouse retention is category-specific: attribution history uses 90-, 120- or 763-day windows and profile-feature history uses 400 days. Daily cleanup removes expired intent traits and identity links, unneeded identifiers after 400 days of inactivity, completed privacy-request payloads after 90 days, accountability history after 25 months, and model history after 763 days. Active consent denials, suppression controls, unresolved privacy work and documented legal holds remain only while needed for their protective purpose. Daily scheduled cleanup applies these rules in production. Analytics archives use 90- or 763-day lifecycle rules followed by seven-day soft deletion. Rolling analytics snapshots have an eight-day retention policy; the retired manual recovery exceptions have been removed. BigQuery deletion remains subject to its configured time-travel window and a further seven-day fail-safe period. Dash0 monitoring and selected RudderStack sample events have 30-day retention. Provider-specific security logs, backups and termination periods can differ. Merchant-authorized erasure covers records reliably linked to the customer and store; unlinked records and copies held by other systems require coordinated handling. Contact the privacy team or the merchant for the applicable criteria, deletion process or any documented exception." ] }, { "id": "rights", "title": "9. Your EU and EEA privacy rights", "paragraphs": [ "Depending on the processing and the conditions in the GDPR, you can request:" ], "bullets": [ "Access to your personal data and information about its processing; correction of inaccurate or incomplete data; erasure; and restriction of processing.", "A portable copy of data you supplied where processing is automated and based on consent or a contract, and transmission to another controller where technically feasible.", "An objection to processing based on legitimate interests because of your circumstances. You can object to direct marketing, including related profiling, at any time without giving a reason.", "Withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal. Withdrawal must be as easy as giving consent.", "The protections applicable to solely automated decisions with legal or similarly significant effects, including human intervention and the ability to express your view and contest a decision where applicable." ], "links": [ { "label": "Cyprus Commissioner for Personal Data Protection", "href": "https://www.dataprotection.gov.cy/" } ] }, { "id": "requests", "title": "10. How to make a request or complaint", "paragraphs": [ "Email privacy@upsur.ge, or write to our registered address, identifying your relationship with Upsurge and the information concerned. For storefront data, include the merchant or store domain; the merchant is usually the controller. You may contact that merchant directly. Where we act as processor, we assist it with your request and do not independently decide its response.", "We may request proportionate information to verify identity or authority. Do not send identity documents or sensitive information unless requested through an appropriate channel. Requests are normally free. GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests, with an explanation.", "Where we are responsible for responding as controller, we respond without undue delay and ordinarily within one month of receipt. If complexity or the number of requests requires an extension, we may extend by up to two further months and will explain the reasons within the first month. If we cannot act on a request, we will explain why and how you can challenge the decision.", "You can complain to the Cyprus Commissioner for Personal Data Protection or to the supervisory authority in the EEA country where you habitually live, work or believe an infringement occurred. You do not need to contact us first. Your rights to judicial remedies remain unaffected." ], "links": [ { "label": "Email the privacy team", "href": "mailto:privacy@upsur.ge" } ] }, { "id": "security-children", "title": "11. Security and children", "paragraphs": [ "The service includes authentication, permission checks, scoped access and protections for selected sensitive records. No online system can guarantee absolute security. Measures and responsibilities applicable to merchant data must be documented in the data-processing agreement and verified for the deployed services.", "Merchant accounts are for adults acting for a business. The service is not designed for collecting children’s data or targeting children. Merchants must assess their audience, applicable age rules and any parental-consent requirements before enabling features. Contact us if you believe a child’s information has been submitted improperly." ] }, { "id": "changes", "title": "12. Changes to this policy", "paragraphs": [ "When an effective version is adopted, its date and version will be stated here. Material changes will be communicated in a manner appropriate to their significance. Where a new purpose requires consent or further notice, an updated policy alone will not supply that consent or replace the required notice." ] } ] }, "dpa": { "path": "/data-processing", "title": "Data Processing Addendum", "description": "GDPR processor terms and processing, security, retention and provider schedules for merchant personal data handled by Upsurge.", "summary": "The responsibilities that apply when Upsurge processes personal data on your business’s behalf.", "sections": [ { "id": "scope", "title": "1. Parties, scope and instructions", "paragraphs": [ "This addendum forms part of the service agreement between the Customer identified by its legal business name, registered address and account in the acceptance record (or its signed order) and ONECOMPASS LIMITED (HE 410135), at Griva Digeni, 81, Marinos Court, Floor 1 & 2, 6043, Larnaca, Cyprus (“Processor”). Privacy contact: privacy@upsur.ge. It takes effect when Customer’s authorized account owner affirmatively accepts this version. Sections 2, 3 and 10–12 contain the standard service schedules; a signed order may add specific processing restrictions.", "It applies to personal data processed on Customer’s behalf through the service. “Personal data”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority” have their GDPR meanings. Customer acts as controller or, if acting for another controller, warrants that it has authority to appoint Upsurge as subprocessor and give the relevant instructions.", "Processor will process data only on documented instructions, including authorized service configuration, for the agreed services and transfers. If Union or Member State law requires other processing, Processor will inform Customer before processing unless that law prohibits notice on important public-interest grounds. Processor will immediately inform Customer if, in its opinion, an instruction infringes applicable data-protection law.", "Customer is responsible for lawful instructions, notices and any required consent, data accuracy and minimization, and the lawfulness of its collection and disclosure. Independent shared-intelligence or model-training purposes are not authorized by this addendum and require a separate lawful arrangement." ] }, { "id": "processing-details", "title": "2. Processing description", "bullets": [ "Subject matter and purpose: providing the commerce, analytics, customer-profile, search, recommendation, campaign, experiment, attribution, chat, support inbox, content and workflow services specifically enabled by Customer.", "Nature of processing: collection, transmission, organization, storage, retrieval, analysis, inference, display, authorized disclosure, correction, export, suppression and deletion, including AI generation and automated actions where configured and, where Customer enables the support inbox, emailing visitors the replies of Customer’s team that they have not seen in the chat.", "Data subjects: Customer’s authorized users, storefront visitors, customers, prospects, support contacts and people whose data Customer lawfully supplies.", "Data types: contact and account details, store-scoped or pseudonymous identifiers, browser and activity data, purchase and order information, campaign and consent records, audience memberships and predictions, conversation and support content (including support tickets and a visitor’s optional reply email address), and integration or workflow records as described in the Privacy Policy and the accepted processing schedule.", "Excluded data: special-category data, criminal-record information, full payment-card credentials and children’s data unless separately agreed in writing with appropriate safeguards.", "Duration: for the agreed service term and the limited return/deletion period documented in the retention schedule in section 11, subject to legally required retention." ] }, { "id": "confidentiality-security", "title": "3. Confidentiality and security", "paragraphs": [ "Processor will ensure that persons authorized to process data are bound by confidentiality or an appropriate statutory duty and receive access only as needed for their responsibilities.", "Processor will implement and maintain measures appropriate to risk under GDPR Article 32, taking account of the state of the art, implementation costs and the nature, scope, context and purposes of processing. The standard security schedule is in section 10; it covers access controls, authentication and tenant separation, encryption, credential management, logging, incident handling, recovery and testing. Security changes must not materially reduce the agreed protection.", "Customer is responsible for securing its accounts, endpoints, source systems and credentials, restricting user and integration permissions, and safely configuring collection and automated actions. Processor remains responsible for its own security obligations." ] }, { "id": "subprocessors", "title": "4. Subprocessors", "paragraphs": [ "Customer authorizes the service providers and processing described in section 12, subject to the restrictions and transfer obligations in this addendum. Customer-selected integrations are not automatically authorized for unrelated purposes. Contact our privacy team for the applicable provider agreement and subprocessor details.", "Processor will give at least 30 days’ advance written notice of a proposed addition or replacement, allowing Customer to object on reasonable data-protection grounds before the change. The parties will work to resolve the objection; if no reasonable solution is available, Customer may terminate the affected service before the change and receive a proportionate refund of its unused prepaid fees.", "Processor will impose substantially the same applicable data-protection obligations on each subprocessor by written contract and remains fully liable to Customer for the subprocessor’s performance of those obligations. Providers independently selected and contracted by Customer are addressed according to their actual role; their designation does not remove Processor’s responsibilities for its own disclosures." ] }, { "id": "assistance", "title": "5. Rights requests and compliance assistance", "paragraphs": [ "Taking account of the nature of processing, Processor will assist Customer through appropriate technical and organizational measures, insofar as possible, to respond to requests under GDPR Chapter III. Processor will promptly forward requests relating to Customer data and will not respond substantively except on Customer’s instructions or as required by law.", "Taking account of the nature of processing and information available to it, Processor will assist Customer with security obligations, breach assessment and notification, data-protection impact assessments and prior consultation under GDPR Articles 32–36. The parties will coordinate promptly enough to allow Customer to meet applicable deadlines. Any agreed charges for additional assistance must not prevent compliance with mandatory obligations." ] }, { "id": "breach", "title": "6. Personal data breaches", "paragraphs": [ "Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data. The notice will describe the nature of the breach, affected data and subjects and approximate numbers where known, a contact point, likely consequences and measures taken or proposed to address and mitigate it. Information may be provided in phases without undue further delay.", "Processor will take reasonable measures to contain, investigate and remediate the breach and cooperate with Customer. Customer determines its own authority and individual notifications, with Processor’s assistance. A controller’s potential 72-hour authority-notification deadline does not give Processor permission to delay its notice to Customer." ] }, { "id": "transfers", "title": "7. International transfers", "paragraphs": [ "Processor will make restricted international transfers only on documented instructions and with a valid GDPR Chapter V mechanism. Section 12 identifies the service destinations and provider safeguards. Applicable accepted provider terms supply the transfer clauses; this addendum does not replace those clauses or remove the need for necessary supplementary measures and assessment.", "Where Standard Contractual Clauses are required, the parties must execute the applicable European Commission clauses with the correct module, options and completed annexes. Those clauses prevail over conflicting terms. This addendum does not itself execute or replace the clauses, and an Article 28 processing agreement alone is not an international-transfer mechanism." ] }, { "id": "return-deletion", "title": "8. Return and deletion", "paragraphs": [ "At the end of services, at Customer’s choice, Processor will return or delete the personal data and delete existing copies unless Union or Member State law requires storage. Return format, transition access, completion deadlines and backup expiry must be specified in the accepted schedule. Retained data remains protected, is restricted to the permitted purpose and is deleted when the legal requirement ends.", "Where immediate selective deletion from a backup is technically impracticable, the completed schedule must define a limited expiry period, isolation from ordinary processing and reapplication of deletion instructions after any restoration. No indefinite backup exception is created. Processor will provide confirmation of completed deletion on request." ] }, { "id": "audit", "title": "9. Information and audits", "paragraphs": [ "Processor will make available information necessary to demonstrate compliance with this addendum and GDPR Article 28, and allow and contribute to audits, including inspections, by Customer or an auditor mandated by Customer. The parties may use relevant reports and reasonable confidentiality, security and scheduling arrangements, without preventing a necessary audit or a supervisory authority’s lawful access.", "Any commercial liability terms remain subject to mandatory GDPR rights and applicable transfer clauses. This addendum does not restrict individuals’ remedies, supervisory-authority powers, or the parties’ statutory liability and contribution rights." ] }, { "id": "schedules", "title": "10. Processing and security schedule", "paragraphs": [ "The standard service schedule consists of the Customer identity in the acceptance record, the enabled services and documented instructions in section 2, the measures below, retention in section 11 and providers in section 12. Processing beyond this scope requires an agreed written amendment." ], "bullets": [ "Parties and instructions: the recorded Customer business and authorized account contact instruct ONECOMPASS LIMITED through enabled store features, scoped API requests and configured workflows. Section 2 identifies the purposes, data types and subjects. Processing continues for the service term followed by the exit period in section 11; excluded data remains prohibited unless separately agreed.", "Access and confidentiality: Firebase authentication, registered server sessions, role-based account permissions, merchant/site isolation and scoped integration credentials restrict access. Secrets are stored through managed secret services; selected sensitive integration values and erasure selectors are encrypted. Personnel access is limited to assigned responsibilities and confidentiality obligations.", "Protection and response: HTTPS protects external transport; managed cloud storage supplies encryption at rest. Application validation, consent checks and approved-field telemetry reduce unnecessary processing. Security events are investigated through restricted operational logs; incident notice and assistance follow sections 5–6. Changes are validated through automated tests and release checks.", "Recovery and testing: logical expiry, recurring cleanup and configured backup cycles apply as described in section 11. Recovery access is restricted and restored data must have current erasure/suppression instructions reapplied. Customer controls its own source-system security, notices, lawful collection, credentials and feature configuration. These measures do not promise uninterrupted availability or universal encryption that prevents provider access." ], "links": [ { "label": "Discuss a data-processing agreement", "href": "mailto:privacy@upsur.ge" } ] }, { "id": "retention-schedule", "title": "11. Retention and exit schedule", "paragraphs": [ "The following retention rules apply to the production service. Daily warehouse cleanup and hourly chatbot cleanup remove eligible records while preserving documented holds and unresolved privacy work. Logical expiry can prevent ordinary access before asynchronous physical deletion. No single period applies to all records or provider copies.", "These periods do not extend an earlier valid erasure instruction. Linked customer-profile erasure is a separate process; it covers records that can be reliably associated with the subject and store, not every record sharing a potentially ambiguous browser identifier. Unresolved identity links require case-specific handling." ], "bullets": [ "Chatbot sessions, stored model threads and messages: 180 days from session creation, with no extension for later activity. Messages share the session deadline.", "Chatbot tool audits, discount actions and handoffs: 365 days from record creation.", "Support tickets, support messages and reply-email records: they expire with the chatbot session the ticket belongs to, at most 180 days from session creation. A visitor’s reply email address is deleted when the visitor removes it, when it bounces (a hashed form remains on the ticket so that it is not reused) or when the ticket expires; linked customer-profile erasure removes it, and that hashed form, from Customer’s tickets. Reply-email records keep a hashed recipient address until they expire with the ticket.", "Chatbot turn observations and evaluation runs: 90 days from record creation.", "Terminal knowledge-ingestion and product-embedding jobs: 30 days from terminal completion. Active jobs and current knowledge sources/chunks have separate operational purposes and require a separate retention decision.", "Warehouse: attribution event/history partitions use 90, 120 or 763 days; profile-feature history uses 400 days. Row-level cleanup removes intent traits at their recorded expiry (a 365-day fallback where a legacy expiry is missing), expired or 400-day inactive identity edges, and 400-day inactive identifiers no longer needed by live controls. Completed privacy requests expire after 90 days; audit history, expired affirmative grants and inactive suppressions use 25 calendar months, with dependency safeguards. Active denials, active suppression and unresolved requests are preserved only for their continuing rights-handling purpose. Model history expires after 763 days.", "Other application records: merchant-assistant conversations use 30 days, imported order versions seven days and customer-profile audits 25 months. Current account settings and uploaded knowledge remain for the enabled service; support, security and legal records remain only for the documented purpose, applicable obligation or claim. Current consent/suppression controls are reviewed at service exit once reintroduction and downstream processing have ended.", "Archives and recovery: selected archive prefixes use 90 or 763 days plus seven-day soft deletion. Automatic analytics snapshots use an eight-day cycle, including after source-disk deletion; the retired manual exceptions have been deleted. BigQuery retains deleted versions during its configured time-travel window and a further seven-day fail-safe period. A successful application deletion is not a promise of immediate physical removal from every recovery copy.", "Exit: the privacy contact coordinates return/deletion, integration revocation, scoped removal from active stores and indexes, provider instructions, residual verification and confirmation. The operational target is 30 days after the agreed cutoff, subject to the deadline in the accepted order/DPA and any shorter applicable rights deadline. Disclosed backup/provider cycles and specifically documented legal holds are separate; retained copies stay restricted and restoration must reapply deletion instructions.", "Provider deletion limits are distinct from application retention: Google’s published Cloud DPA allows up to 30 days for recovery after the service term, followed by deletion within its stated maximum of 180 days, subject to its exceptions. RudderStack’s published DPA describes 30-day backups and deletion on request or termination within 30 days, with backup copies within 90 days. These are vendor contractual limits, not configured Upsurge retention periods or a completed customer exit deadline." ], "links": [ { "label": "Google Cloud Data Processing Addendum", "href": "https://cloud.google.com/terms/data-processing-addendum" }, { "label": "RudderStack Data Processing Addendum", "href": "https://www.rudderstack.com/data-processing-agreement/" } ] }, { "id": "provider-register", "title": "12. Service providers and international processing", "paragraphs": [ "The following standard service register describes the enabled provider families, data access and processing locations. Audits on 11–12 October 2026 established the deployed locations. ONECOMPASS has confirmed its use of Google Cloud/Firebase, Gemini, Cloudflare R2, Dash0, Typesense Cloud, RudderStack and Twilio SendGrid under company accounts and acceptance of their data-processing terms. This confirmation was received on 11 October 2026; acceptance dates, agreement versions and the account-specific transfer documents have not been independently inspected. The relevant accepted account agreement identifies the contracting entity and applicable transfer clauses. The privacy team maintains the supporting account and transfer record and supplies relevant details on request; no unobserved contract version or provider certification is asserted.", "Provider-published SCC or adequacy provisions describe available safeguards. They do not establish that those provisions cover this Customer, this account, every data flow or every onward recipient. Public availability of an EU region is also not evidence that it has been selected." ], "bullets": [ "Google Cloud/Firebase: hosting, authentication, databases, storage and processing of service data. Deployed Firestore and primary runtime/storage are US-based; attribution warehouse datasets are in the EU and identity-graph datasets are in the US. The accepted Google Cloud/Firebase data-processing terms govern the account, with their applicable international-transfer provisions.", "Google Gemini/Vertex AI: prompts, permitted context, outputs and usage information. Current generation uses the direct Gemini API; knowledge embeddings use it with a Vertex fallback; product embeddings use Vertex AI in us-central1. Reviewed source does not enable Files, explicit caching, Interactions, Live or grounding. The deployed Gemini keys were matched to billing-enabled projects, including the production project whose paid tier was verified. Direct Gemini processing is not restricted to the Vertex AI region. Google’s published abuse-monitoring and feature-specific retention rules remain relevant.", "Cloudflare R2: static SDK asset storage and delivery, including request metadata. Both buckets use the default jurisdiction path and report Eastern North America (ENAM). Their only lifecycle rule aborts incomplete uploads after seven days; it does not expire completed objects. Object-access logging is not enabled. This configuration makes no EU-jurisdiction commitment.", "Dash0: monitoring through the application telemetry collector, with API and ingestion in europe-west4 on Google Cloud in the Netherlands. The default dataset retains logs, traces, metrics, profiling and web events for 30 days. The collector filters operational telemetry to approved fields before forwarding. Support and onward access must be covered in the transfer schedule.", "Typesense Cloud: search indexes and provider usage information. Search is enabled in both serving environments. The production cluster is in Frankfurt, Germany; staging is in Northern Virginia, United States. Both are single-region, single-node clusters, and the inspected console did not show Search Delivery Network enabled. Provider usage records and support access are separate from index location.", "RudderStack: platform identity/intent forwarding is enabled in both serving environments; separate merchant-selected exports have their own configuration. The platform workspace uses US Prod, with sample-event storage enabled for a rolling 30 days. Its published DPA allows selected event storage up to 30 days; ordinary transient-processing limits do not override that selection. Complete the lawful-purpose, role, field and onward-recipient assessment for each path.", "Twilio SendGrid: platform notifications, support-inbox reply emails to Customer’s visitors, and separate merchant-selected email connections. Support-inbox emails are sent from the platform address under the store’s name, with click tracking turned off; SendGrid delivery events for them are used only to stop email to an address that bounced. Both deployed accounts identify Onecompass Limited, and the production account is paid. The platform and merchant connector use the global service; no EU-specific endpoint is configured. Published retention varies by record: retry bodies up to 72 hours, scheduled messages up to six days, content samples seven days and general metadata 37 days. Suppressions and marketing records may remain until deletion; the vendor DPA provides a separate one-year backup period after termination. These are not a universal email-retention period. The accepted Twilio data-processing terms and their applicable transfer provisions govern provider processing; exit instructions follow section 11." ], "links": [ { "label": "Twilio SendGrid retention guidance", "href": "https://help.twilio.com/articles/4410585868443" }, { "label": "Twilio Data Protection Addendum", "href": "https://www.twilio.com/en-us/legal/data-protection-addendum" } ] } ] } } }