Your work stays yours.
What Upshift keeps about you, why, for how long, and who else handles it.
Who is responsible
Upshift is a personal project of Noël Vranckx, in Belgium, who decides what happens with the data described here. Write to hello@aiforscm.com with any question or request about your data.
What is kept, and why
Your account. Your name, email address and password (stored only as a hash) are managed by Supabase Auth. Your profile, learning progress, notes, saved items, planner briefs and documents are stored privately in the Upshift database in Ireland. This is needed to give you the account you asked for.
The waiting list. If you ask for an invitation, your name and email address are kept to send it. The entry stays as the record of your invitation while your account exists, and is deleted with your account or when you ask.
Keeping accounts personal. The book PDFs you download carry your email address at the foot of each page. To notice an account that is being shared, Upshift keeps the countries you visit from (a two-letter code, for 30 days), and the site owner can see how many devices are signed in to an account and which files it downloaded. This rests on the legitimate interest of keeping the books and accounts personal.
Reading analytics. To learn which books and pages are useful, Upshift records the pages you open, how long each one is in view, how far you scroll, which links to other sites you follow, which site or campaign link brought you here, your country and the kind of device. No cookie or browser storage is used for this. Guests are counted with a code the server makes from the connection and browser, which changes every day; the IP address itself is not stored. When you are signed in, visits are linked to your account and the site owner can see an account’s reading history. Browsers that send Global Privacy Control or Do Not Track are not counted. This rests on the legitimate interest of improving the material.
Who is online. While you are signed in, the site owner can see that your account has the site open. Nothing about this is stored.
Feedback and messages. Messages and files you send are kept with the page you sent them from and your account, or the email address you give, so they can be read and answered.
The project planner. When you use the planner, your brief, your answers and the profile context you filled in (company, role, background, instructions and tools) are sent through the Vercel AI Gateway to Anthropic’s Claude model, which writes the questions and the requirements document. Under their commercial terms these providers may not use it to train models. This is needed to give you the document you asked for; leave the profile fields empty if you prefer not to share them.
Emails about new posts. If you ask for new posts by email, your address is kept with the date and the page you asked from, and used for nothing but a note when a post is published, or a round-up at the pace you chose. Every email carries a link to stop them, and you can also stop them at any time on the unsubscribe page. An address that has unsubscribed is kept only so it is not written to again, and is deleted on request. This rests on your consent.
Security. To stop floods of requests, the server counts requests per network address for a short time, using a code made from the address rather than the address itself.
Who else handles it
Upshift uses a few services that process data on its behalf, each under a data processing agreement:
- Supabase: the database, sign-in and file storage, in Ireland.
- Vercel: hosting, with the site running in Dublin, and the AI Gateway.
- Anthropic: the AI model behind the project planner.
- Stripe: payments, once purchases open.
Vercel, Anthropic and Stripe are US companies. Transfers to them rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. Nothing is sold or shared for advertising.
How long it is kept
| Account, workspace, purchases | Until you delete your account |
|---|---|
| Reading analytics and downloads | About 13 months |
| Countries you visit from | 30 days |
| Feedback and messages | Two years after the last message, or until you delete your account |
| Requests to hear about a book | Until the book is out, and at most two years |
| Waiting list | Until you delete your account, or ask |
Cookies and browser storage
Upshift sets only what the site needs to work, so there is no cookie banner:
| Sign-in cookies (sb-…) | Keep you signed in |
|---|---|
| upshift-referral | Carries an invitation link to sign-up, for 30 days |
| upshift-auth-return | Returns you to your page after signing in, for a day |
| upshift_country | Signed-in only: avoids recording the same country on every page, for 7 days |
| upshift:trail (session storage) | The way back to the page you came from, until the tab closes |
| upshift-newsletter (local storage) | Remembers on this device that you asked for new posts |
Your rights
You can see, correct, download and delete your data. On your profile, “Download all my data” gives you everything kept about your account in one file, and “Delete my account” removes it all. You can also object to the analytics, ask for processing to be limited, or withdraw consent you gave: write to hello@aiforscm.com, and you will have an answer within a month.
If you think your data is mishandled, you can complain to the Belgian Data Protection Authority, gegevensbeschermingsautoriteit.be.
Upshift is meant for people aged 13 and over. External links follow the destination’s own privacy practices.
Last updated 27 September 2026.