Privacy Policy

This notice explains how Techshift Digital Ltd ("we", "us", "our") handles personal data in connection with the SyftOS marketing website, our enquiry and sales process, and the SyftOS platform. It is written to meet the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

1. Who we are

SyftOS is a product of Techshift Digital Ltd, a company registered in England and Wales (company number 15218025), with its registered office at 1 The Briars, Waterberry Drive, Waterlooville, PO7 7YH. We are registered with the Information Commissioner's Office (ICO) as a data controller. For any privacy question, or to exercise your rights, contact us at hello@techshift.digital.

2. The two roles we play

Data protection law distinguishes a controller (who decides why and how data is processed) from a processor (who processes data on a controller's instructions). We act in both roles:

• As a controller — for visitors to this website, people who make an enquiry, and the account identity of our customers' users (names, emails, sign-in and security records, billing contacts). This notice covers that processing.
• As a processor — for the business content our customers' agents work with inside the platform (the data in their connected tools, documents, runs and approvals). We process that on the customer's instructions under a separate Data Processing Agreement (available on request), not under this notice. The customer is the controller of that content.

3. Website visitors & enquiries

What we collect

• Enquiry details you submit through our contact form or by email — name, work email, company, team size and your message.
• Limited technical and usage data needed to serve and secure the site, and, with your consent, Google Analytics usage data (see §8).

Why, and our lawful basis

• To respond to your enquiry and arrange a demo — our legitimate interests (and your consent where you contact us).
• To operate, secure and improve the website — our legitimate interests in running our business safely.
• To send information about SyftOS you have asked for — consent or legitimate interests.

This site self-hosts its fonts and sets no advertising or cross-site tracking cookies. It uses Google Analytics to understand aggregate usage (see §8). See our Cookie Policy.

4. Account holders (our customers' users)

What we collect

• Account identity — name, email, hashed password, two-factor and sign-in/security records, API tokens.
• Billing contact — handled through Stripe; we never see or store full card details.
• Governance records — who approved or rejected which action, and when (in the append-only audit log).

Why, and our lawful basis

• Providing the service (provisioning, authentication, billing) — performance of our contract with the account holder.
• Security and audit logging — our legitimate interests and our legal obligations.
• Billing records — our legal obligations.

5. Customer content (our processor role)

The business data agents work with inside the platform is processed on the customer's behalf under a Data Processing Agreement, available on request, which sets out our instructions, security measures, sub-processors and breach-notification duties (UK GDPR Article 28). If you are an individual whose data sits inside a customer's account, that customer is the controller; please contact them to exercise your rights, and we will assist them as their processor.

6. Who we share data with

We do not sell personal data. We share it only with trusted service providers (sub-processors) who process it on our behalf under written contracts, and where required by law. Our sub-processors include hosting and storage providers, Stripe (billing) and the AI model providers used to run agents; the current providers are named on our security page.

7. Automated processing & AI

SyftOS is an AI platform, so we are explicit about how it makes decisions. It is governed and human-in-the-loop by design: every action an agent takes that changes anything in the outside world is proposed by the agent and approved by a person before it happens. We do not make decisions producing legal or similarly significant effects about you by solely automated means without human involvement. AI is used to draft, suggest and prepare work for a human to review.

8. Cookies & analytics

We use no advertising or cross-site tracking cookies. We do use Google Analytics to understand how the website is used and to improve it. Google Analytics sets cookies and processes limited visitor data (such as a pseudonymous identifier, IP address, user agent and the pages you view) to produce aggregate statistics; we have IP-anonymisation enabled and use this on the basis of your consent. You can decline these cookies, and full detail, including how to opt out, is in our Cookie Policy.

9. International transfers

Some of our service providers are based outside the UK (for example, in the United States). Where personal data is transferred outside the UK, we rely on an appropriate safeguard for each transfer and assess it beforehand. That safeguard is either UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge") where the recipient is certified under it, or the UK International Data Transfer Agreement / Addendum.

10. How long we keep data

• Enquiry data — up to 24 months after our last contact, then deleted or anonymised.
• Account & governance records — for the life of the account and a defined period after closure (90 days by default), then deleted, except where law requires longer (e.g. billing records).

11. Your rights

Under UK data protection law you have the right to be informed, and to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and rights relating to automated decision-making. To exercise any of these, email hello@techshift.digital; we will respond without undue delay and within the statutory time limit.

If you are unhappy with how we have handled your data, please raise it with us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

12. Changes

We may update this notice from time to time. The "last updated" date above reflects the current version.

13. Contact

Questions about this notice, or to exercise your rights? Email hello@techshift.digital.