UPDRAFT

Last modified July 28, 2026

Privacy Policy

Effective July 28, 2026

This Privacy Policy explains how Updraft Labs, LLC (“Updraft,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you visit our websites, create an account, join a workspace, build or operate a store, communicate with us, or otherwise use our services (collectively, the “Service”).

Scope and our role

This Policy applies to personal information Updraft handles for its websites, onboarding, accounts, workspaces, merchant console, AI features, generated and hosted storefronts, commerce tools, billing, analytics, and support.

Updraft acts as a controller or business for information about our website visitors, account users, merchants, billing contacts, and support contacts, and for information we use to run, secure, analyze, and comply with law for the Service.

When a merchant uses Updraft to handle personal information about its storefront visitors or customers, the merchant generally determines why and how that information is used. For that processing, the merchant is the controller or business and Updraft acts as its processor or service provider, except when we use limited information for our own security, fraud prevention, billing, legal compliance, and Service-integrity purposes.

If you interacted with a store built using Updraft, review that merchant's privacy policy and contact the merchant first about its practices or a privacy request. We will assist the merchant where required and you may contact us if you need help identifying the relevant merchant.

Information we collect

We collect information you provide, information generated through your use, information provided by merchants and other users, information from services you connect, and information collected automatically.

Account and workspace information

This includes name, email address, profile details, authentication identifiers, account settings, workspace membership and role, invitations, security events, and communications about the account. If you choose Google sign-in, Google provides authentication and basic profile information according to your Google settings.

Business and storefront information

This includes onboarding answers, business identity and contact details, product and catalog data, brand materials, images, prices, inventory, tax and shipping settings, store policies, domain information, connected-service settings, storefront code, generated pages, publication status, and operational readiness information.

Content, AI, and support information

This includes prompts, messages, instructions, attachments, images, files, approvals, AI inputs and outputs, generated or edited code, conversation history, feedback, support requests, and related service context. Context may include the page or feature in use, selected store records, and safe operational metadata needed to answer a request or carry out an approved action.

Merchant-customer and transaction information

When we provide storefront and commerce tools for a merchant, we may process cart and order contents, customer name and contact details, shipping and billing addresses, delivery selections, order and fulfillment status, transaction and payment status, refunds, disputes, support requests, and related records. The merchant controls this data subject to its own policies and applicable law.

Billing and connected-payment information

We collect plan, subscription, invoice, payment status, limited billing details, Stripe customer and subscription references, connected-account status, payment capability and payout status, checkout references, transaction totals, refunds, disputes, and tax-readiness information. Stripe processes payment credentials and full card numbers. Updraft does not store full card numbers.

Device, usage, and diagnostic information

This includes IP address, browser and device type, operating system, referring pages, pages and features viewed, interactions, timestamps, cookie or local-storage identifiers, session and acquisition data, approximate location inferred from IP address, logs, traces, performance data, error and crash details, and security events.

We may derive workflow state, preferences, usage patterns, risk signals, and store-readiness status from information above to operate, secure, support, and improve the Service. We do not use sensitive personal information to infer personal characteristics.

How we use information

We use personal information to:

  • create and secure accounts, authenticate users, manage workspaces, and enforce permissions;
  • provide onboarding, generate and host storefronts, manage content and domains, and deliver requested Service features;
  • process prompts and other context through AI features, generate outputs, and carry out user-approved actions;
  • support merchant catalogs, carts, orders, fulfillment, refunds, disputes, integrations, and customer service;
  • process Updraft subscriptions and support merchant-connected payment operations;
  • send transactional messages, workspace invitations, security notices, support responses, and marketing messages you requested;
  • understand acquisition and Service use, measure feature performance, debug errors, improve workflows, and develop the Service;
  • detect fraud, abuse, prohibited conduct, security incidents, and violations of our terms;
  • protect users, merchants, customers, Updraft, and third parties; and
  • comply with law, respond to legal process, enforce agreements, resolve disputes, and maintain business records.

Where law requires a lawful basis, we rely on performance of our contract with you, our legitimate interests in operating and improving a safe Service, consent when we ask for it, and compliance with legal obligations. The basis depends on the information, purpose, and local law. You may withdraw consent for future processing when consent is the basis.

How we disclose information

We disclose personal information only as reasonably needed for these purposes:

  • Infrastructure and operations providers that supply hosting, content delivery, storage, databases, queues, domains, communications, and technical support. Updraft primarily uses Cloudflare infrastructure for Service delivery.
  • AI and model providers that process inputs, outputs, attachments, and relevant Service context. Current AI routing may use Cloudflare AI Gateway, OpenRouter, and underlying model providers selected through that infrastructure.
  • Analytics and observability providers. We use PostHog for product analytics, acquisition measurement, error monitoring, logs, traces, and AI observability.
  • Payment providers. Stripe processes Updraft subscription payments and merchant-connected storefront payments, onboarding, checkout, refunds, disputes, and related account information.
  • Authentication, email, support, and abuse-prevention providers, including Google when you choose Google sign-in and Cloudflare Turnstile where used to prevent automated abuse.
  • Merchant-selected integrations and import sources when you connect them or instruct us to exchange information.
  • Workspace members according to their roles, and merchants whose stores you visit or buy from.
  • Professional advisers, auditors, insurers, financing sources, and transaction counterparties under appropriate confidentiality duties.
  • Courts, regulators, law enforcement, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, and Service integrity.

We may disclose information in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business. We may also disclose aggregated or de-identified information that cannot reasonably identify you. Where law applies, we maintain de-identified information in de-identified form and do not attempt to reidentify it except to test our de-identification process.

Content and business information you publish to a storefront becomes public and may be viewed, copied, indexed, cached, or shared by others. Information you send to a merchant or workspace is available to that merchant or authorized workspace members.

AI processing

When you use AI features, Updraft sends your Input and relevant Service context through our AI infrastructure to third-party AI providers. Providers may process and retain information under their contracts and policies. Available providers or models may change as we operate the Service.

Do not submit unnecessary sensitive, regulated, confidential, or children's personal information to AI features. Review generated Output before use. Our Terms of Service explain additional AI responsibilities and limitations.

Payments

Stripe collects and processes payment credentials under its own Privacy Policy. Updraft receives limited information needed to manage subscriptions, confirm transaction status, support connected accounts, display operational status, and handle merchant-requested payment actions. Merchants and Stripe separately determine some uses of storefront payment and customer information.

Cookies and analytics

We and our providers use cookies, local storage, and similar technologies for authentication, session continuity, security, preferences, abuse prevention, analytics, and Service operation.

PostHog helps us collect page views, navigation and interaction events, referral and acquisition information, feature use, performance, errors, and diagnostic information. We may associate analytics with an account or workspace after sign-in. We configure sensitive input areas to avoid automatic capture, but information you deliberately submit through the Service is processed as described elsewhere in this Policy.

You can control cookies through browser settings and use available unsubscribe or privacy controls. Blocking necessary storage may prevent sign-in or other features from working. Because browsers do not follow a uniform “Do Not Track” standard, the Service does not currently respond to those signals.

Sale and targeted advertising

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or process it for targeted advertising as those terms are defined by applicable U.S. state privacy laws. We do not use sensitive personal information to infer characteristics about you.

If these practices change, we will update this Policy and provide legally required notices and choices before the new practice begins.

Retention

We retain personal information for as long as reasonably needed to provide the Service and fulfill the purposes described above. Retention depends on the type of information and may include the life of an account, workspace, store, subscription, merchant instruction, or customer transaction, plus time needed for backups and technical deletion cycles.

We may retain information longer when reasonably needed for tax, accounting, payment, domain-registration, legal, fraud-prevention, security, dispute, enforcement, or recordkeeping obligations. When information is no longer needed, we delete, anonymize, or isolate it from active use. Deletion from active systems may not immediately remove copies from backups, public caches, exports, another user's account, a merchant's records, or third-party systems.

Security

We use technical and organizational safeguards designed to protect personal information, including access controls and protections for data in transit and at rest where appropriate. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for using strong credentials, protecting account access, and choosing appropriate workspace permissions.

International processing

Updraft is based in the United States. We and our providers may process information in the United States and other countries, whose privacy laws, protections, and government-access rules may differ from those where you live. Contact us if you have questions about international processing. This paragraph does not limit rights available under applicable law.

Your choices and privacy rights

You may update certain account information in the Service, manage workspace membership, cancel a subscription, disconnect integrations, control browser storage, or unsubscribe from non-essential marketing emails. Transactional, security, billing, or legal messages may continue while you have an account or when otherwise necessary.

Depending on where you live and subject to legal exceptions, you may have rights to:

  • know or access personal information we process about you;
  • correct inaccurate personal information;
  • delete personal information;
  • receive a portable copy of information you provided;
  • restrict or object to certain processing;
  • withdraw consent for future processing;
  • opt out of sale, targeted advertising, or qualifying profiling; and
  • appeal our refusal of a privacy request.

Updraft does not currently engage in sale, targeted advertising, or profiling that produces legal or similarly significant effects. You may submit a request to support@updraft.site. To appeal a decision, reply to our decision and state that you are appealing it.

We may verify your identity and authority before completing a request. Authorized agents may submit requests where law permits, but we may require proof of authorization and direct identity confirmation. Rights can be limited—for example, when we must retain information, need it to provide a requested Service, or process it on a merchant's behalf. We will not unlawfully discriminate against you for exercising a privacy right.

If Updraft processes your information only for a merchant, send the request to that merchant. We will support verified merchant instructions as required. Residents of the European Economic Area, United Kingdom, or Switzerland may also complain to their local data-protection authority.

Children

The Service is intended for adults and is not directed to children under 13. Updraft does not knowingly collect personal information directly from children under 13. If you believe a child provided personal information to Updraft, contact support@updraft.site.

Merchants are responsible for determining whether their stores are directed to children and for complying with laws that apply to their customers and products.

Changes to this Policy

We may update this Policy as the Service, our practices, or law changes. We will post the updated version and change the last-modified date. When required, we will provide additional notice through the Service or by email before a material change takes effect.

Contact

Questions or requests about this Policy or Updraft's privacy practices may be sent to support@updraft.site.