Privacy and Cookie Policy
English translation provided for convenience. Only the French version is legally binding.
1. At a glance
- Upsellr is a platform intended for professionals. We process personal data of professional contacts: website visitors, prospects, customers and users.
- We do not sell your data and we do not rent it.
- The data that our customers import into the platform belongs to them. For that data, we act on their behalf, as a processor.
- Our AI agents rely on models accessed through Vercel AI Gateway. We configure our access so that your data is not used to train our providers’ models.
- You may exercise your rights at any time by writing to dpoupsellr.io.
2. Who is responsible for your data?
The controller is Upsellr SAS, a simplified joint-stock company (SAS) with share capital of €1,075, registered with the Cannes Trade and Companies Register (RCS) under number 930 942 164, whose registered office is located at 200 chemin de Meayne, 06550 La Roquette-sur-Siagne, France (“Upsellr”, “we”).
Contact for any question regarding your data: dpoupsellr.io, or by post to the registered office address, for the attention of the data protection contact.
3. Scope
This policy applies to the processing carried out by Upsellr as controller in connection with:
- browsing the upsellr.io website and its subdomains;
- the demonstration and trials offered on the website;
- the creation and use of an account on the Upsellr platform;
- our business relationships with our prospects, customers and partners;
- our communications, our support and our recruitment.
It does not apply to data that our customers process by means of the platform, for example their suppliers’ data or the data contained in their catalogs. For that data, the customer is the controller and Upsellr acts on its behalf in accordance with the Data Processing Agreement. If you are concerned by such data, please contact first the relevant Upsellr customer company.
4. What data do we process?
| Category | Examples | Source |
|---|---|---|
| Identification and professional contact details | Last name, first name, job title, company, email, phone number | You, forms, account creation, public professional sources |
| Account data | Username, password (stored in irreversibly encrypted form), authentication factors, role, preferences, language | You, your organization |
| Usage data | Actions performed in the platform, missions and workflows launched, credit consumption, votes for future connectors | Generated by your use |
| Exchanges with our AI agents | Messages and instructions sent to the agents, approvals, feedback | You |
| Demonstration data | Address of the store or product page analyzed, product identifiers entered (EAN), email where applicable | You |
| Technical data | IP address, device and browser type, connection logs, timestamps, approximate location inferred from the IP address | Generated automatically |
| Cookies and trackers | See section 12 | Your device, with your consent where required |
| Billing data | Company name, address, VAT number, payment history, last four digits and expiry date of the card | You, our payment service provider |
| Support and exchanges | Content of requests and exchanges with support, including where these are assisted by an agent | You |
| Job applications | CV, cover letter, exchanges relating to recruitment | You, recruitment platforms |
Payment card data. Payments are processed by a PCI-DSS certified payment service provider. Upsellr does not store your full card number.
Sensitive data. We do not collect data falling within special categories (health, opinions, origin, etc.). Do not disclose any in your exchanges with our teams or our agents.
5. Why and on what basis?
| Purpose | Legal basis | Retention period |
|---|---|---|
| Providing the website and the platform, ensuring their operation | Performance of the contract; legitimate interest for visitors | For the duration of use |
| Offering a demonstration based on a store’s address | Pre-contractual measures taken at your request | 90 days after the demonstration, unless an account is created |
| Creating and managing your account and your users | Performance of the contract | Duration of the account, then deletion in accordance with the contractual return periods |
| Carrying out the missions entrusted to the agents, displaying credit consumption | Performance of the contract | Duration of the account |
| Invoicing, collecting payments, keeping accounts | Legal obligation; performance of the contract | 10 years from the end of the financial year for accounting records |
| Responding to your support requests | Performance of the contract; legitimate interest | 3 years from the closing of the request |
| Sending service-related communications (security, billing, contractual changes, balance alerts) | Performance of the contract; legal obligation | Duration of the account |
| Business prospecting by email to professionals, for offers related to their job function | Legitimate interest; you may object at any time | 3 years from your last contact |
| Newsletter and editorial content | Consent | Until you unsubscribe |
| Audience measurement for the website and emails, other than exempted cases | Consent | See section 12 |
| Ensuring security, preventing fraud and abuse, in particular the creation of multiple accounts on the free offer | Legitimate interest | Logs: 12 months; identification data relating to a proven abuse: 3 years |
| Managing and improving our services based on aggregated and anonymized statistics | Legitimate interest | Anonymized data: no time limit |
| Retaining proof of acceptance of the terms and of approvals | Legitimate interest; legal obligation | 5 years after the end of the relationship |
| Handling notices of illegal content and requests from authorities | Legal obligation | Period necessary for handling, then the applicable limitation period |
| Managing pre-litigation and litigation | Legitimate interest | Duration of the proceedings and of the available appeals |
| Processing job applications | Pre-contractual measures; consent to retain a profile | 2 years after the last contact, with your consent |
Where processing is based on our legitimate interest, we ensure that it does not disproportionately affect your rights. You may obtain details of the balancing test carried out by writing to us.
Where the provision of data is a condition for entering into the contract, mandatory fields are indicated in the forms. Failing this, we cannot create your account or process your request.
6. Artificial intelligence
6.1. AI agents. The platform relies on artificial intelligence agents. When you exchange with them, you are interacting with an AI system and not with a person. Our support may also be assisted by an agent.
6.2. Model providers. To carry out your requests, our agents transmit the necessary information to artificial intelligence models accessed through the Vercel AI Gateway. We configure our access, according to the options offered by these providers, so as to exclude the use of this information for training their models.
6.3. Improvement of our services. We may use platform usage signals (corrections, approvals, rejections) to improve our services, only in aggregated and anonymized form.
6.4. No automated decision-making. We do not take any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Where contested, automatic abuse detection mechanisms give rise to a review by a member of the team.
7. Who can access your data?
Your data is accessible, to the extent necessary:
- to authorized members of the Upsellr team, who are bound by confidentiality;
- to authorized users of your organization, for your account data;
- to our service providers, who act on our instructions and in accordance with contractual confidentiality and security commitments, in the following categories: hosting and cloud infrastructure, databases and search, AI gateway (Vercel AI Gateway) and model providers, web page retrieval, image processing, payment and billing, email delivery, support tools, audience measurement, customer relationship management tools;
- to the third-party platforms you connect (store, PIM, marketplace), in accordance with your instructions;
- to our advisers (lawyers, chartered accountants, statutory auditors), who are bound by professional secrecy;
- to administrative or judicial authorities, where required by law;
- to an acquirer or successor, in the event of a merger, acquisition or transfer of all or part of our business, in compliance with this policy.
8. Transfers outside the European Union
Some of our service providers, including Vercel Inc., are established in the United States or may process data outside the European Economic Area. These transfers are governed by:
- the European Commission’s adequacy decision on the EU–US Data Privacy Framework, for certified service providers;
- failing that, the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.
You may obtain a copy of the applicable safeguards by writing to dpoupsellr.io.
9. Security
We implement technical and organizational measures appropriate to the risks: encryption of data in transit and at rest, encryption of connection secrets, segregation of data by organization, two-factor authentication and passkeys, control and logging of internal access, backups and versioning, monitoring of processing. No measure provides absolute security; in the event of a data breach presenting a risk to your rights, we will inform you under the conditions provided for by law.
10. Your rights
In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:
- access to your data and obtaining a copy;
- rectification of inaccurate or incomplete data;
- erasure, in the cases provided for by law;
- restriction of processing;
- objection to processing based on our legitimate interest, on grounds relating to your particular situation, and objection at any time, without giving reasons, to business prospecting;
- portability of the data you have provided to us, where processing is based on your consent or on the contract;
- withdrawal of your consent at any time, without affecting the lawfulness of prior processing;
- setting instructions regarding what happens to your data after your death.
How to exercise your rights. Write to dpoupsellr.io or by post to the registered office address. You may also change some of your data directly in your account settings, and unsubscribe from our commercial emails via the link included in each message. We respond within one month, which may be extended by two months taking into account the complexity or number of requests, in which case we will inform you. Where there is reasonable doubt as to your identity, we may ask you for additional information.
Complaint. You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL) (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your place of residence or work.
11. Information for United States residents
This section supplements this policy for individuals residing in a US state that has a consumer data protection law, in particular California, as well as under the California Online Privacy Protection Act. It applies to the extent that these laws are applicable to Upsellr.
11.1. Categories of data collected in the past twelve months. Identifiers (name, email, IP address, account identifiers); professional information (company, job title); commercial information (subscribed plan, credit purchase history); internet activity (browsing on the website, use of the platform); approximate geolocation inferred from the IP address; content of your exchanges with our agents and our support. The sources, purposes and retention periods are described in sections 4 and 5. This data is disclosed, for business purposes, to the categories of recipients described in section 7.
11.2. No sale or sharing. Upsellr does not sell your personal data and does not share it for cross-context behavioral advertising, within the meaning of these laws, and has not done so in the past twelve months. We do not knowingly collect data from individuals under 18 years of age. We do not collect sensitive personal data within the meaning of these laws and do not use any data for profiling that produces legal or similarly significant effects.
11.3. Your rights. Depending on your state of residence, you may request: to know what data we hold and to access it; its correction; its deletion; its portability; and you may opt out of its sale, its sharing, targeted advertising and profiling. We will not discriminate against you for exercising these rights.
11.4. Exercising your rights. Write to dpoupsellr.io, with the subject line “US Privacy Request”. We verify your identity by matching the information provided with the information we hold. You may designate an authorized agent, who must provide proof of their authorization. We respond within the period provided for by the applicable law, generally 45 days, which may be extended under the conditions provided for by law.
11.5. Appeal. If we decline to act on your request, you may appeal that decision by replying to our refusal email within 60 days. We will inform you of our reasoned decision within the period provided for by the applicable law. If the refusal is upheld, you may contact the Attorney General of your state.
11.6. Preference signals. We treat Global Privacy Control (GPC) signals as a valid request to opt out of non-essential trackers for the browser concerned. There is no uniform standard for “Do Not Track” signals; we do not change our practices in response to such signals alone, but the GPC signal is honored.
11.7. California — Shine the Light. We do not disclose personal data to third parties for their own direct marketing purposes.
12. Cookies and trackers
This section explains how Upsellr uses cookies and other trackers on the upsellr.io website, in the Upsellr platform and in its emails, and how you can express your choices. It is drawn up in accordance with Article 82 of the French Data Protection Act (loi Informatique et Libertés), which transposes the “privacy and electronic communications” directive, with the guidelines and recommendations of the CNIL, and with applicable US laws.
12.1 What is a tracker?
A tracker is information stored on or read from your device (computer, phone) when you visit a website, use an application or open an email. It may be a cookie, a browser local storage item, a pixel or a technical identifier.
12.2 The trackers we use
12.2.1 Strictly necessary trackers — without consent
They are essential to the operation of the website and the platform, or to the provision of a service you have expressly requested. They cannot be disabled from our management panel.
| Purpose | Examples |
|---|---|
| Authentication and session | Keeping you logged in, multiple sessions, strong authentication |
| Security | Protection against request forgery, detection of abnormal logins and abuse |
| Operation | Load balancing, resuming an interrupted file upload, remembering the interface state |
| Remembering your choices | Recording your tracker preferences |
| Payment | Payment service provider trackers necessary for transaction security and fraud prevention |
12.2.2 Audience measurement
They allow us to understand website traffic and platform usage in order to improve them.
- Where they are configured to produce only anonymous statistics, without cross-referencing with other processing or tracking on other websites, under the conditions set by the CNIL, they may be exempt from consent. You may nevertheless object to them from the management panel.
- In other cases, they are placed only with your consent.
12.2.3 Functional trackers — with consent
They enable optional features, for example a chat window, embedded video content or an appointment booking tool.
12.2.4 Advertising and social media trackers — with consent
They allow us to measure the effectiveness of our campaigns or to offer you tailored content on other websites. They are placed only with your consent. No tracker in this category is placed in the platform.
12.2.5 Detailed list
The list of trackers used, their issuers, their purpose and their lifespan is available at any time from the “Manage my cookies” panel, in the website footer.
12.3 Your choices
4.1. On your first visit. A banner allows you to accept, reject or customize your choices, by purpose. Rejecting is as easy as accepting. Until you have made a choice, no tracker subject to consent is placed; continuing to browse does not constitute consent.
4.2. At any time. You may change or withdraw your consent from the “Manage my cookies” link in the footer.
4.3. Duration. Your choices are retained for six (6) months, after which we ask you again. Trackers subject to consent have a maximum lifespan of thirteen (13) months, and the data they collect is retained for a maximum of twenty-five (25) months.
4.4. Browser settings. You may also configure your browser to block or delete trackers. Blocking strictly necessary trackers may prevent use of the platform.
4.5. Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of non-essential trackers for that browser.
12.4 Tracking pixels in our emails
Our emails may contain pixels, i.e. small invisible images that make it possible to know whether a message has been opened.
| Type of email | Use of pixels | Consent |
|---|---|---|
| Service-related emails: account security, confirmations, invoices, balance alerts, mission reports | Individual measurement of successful message delivery and security | Not required |
| Commercial emails and newsletter | Open tracking and campaign statistics | Required |
For commercial emails, you may at any time refuse open tracking via the link included in each email or by writing to dpoupsellr.io, without having to unsubscribe. You may also block the automatic loading of images in your email client.
12.5 Trackers in the platform
In the platform, we mainly use strictly necessary trackers: session, security, interface preferences and resuming file uploads. Any audience measurement trackers are subject to the rules in section 12.2.2.
13. Minors
Our services are reserved for professionals and are not intended for minors. We do not knowingly collect data concerning individuals under 18 years of age. If you believe that a minor has provided us with data, contact us so that we can delete it.
14. Links to other websites
The website and the platform may contain links to third-party websites or services, in particular those of the platforms you connect. Their practices are governed by their own policies.
15. Changes to the policy
We may update this policy. The date of the last update appears at the top of the document. In the event of a material change, we will inform you by email or in the platform before it takes effect.
Upsellr SAS — Privacy and Cookie Policy — Version 2.0