Privacy Policy

LiftUp is operated by QalbIT Infotech ("we", "us", "our"). This policy applies to our marketing website (liftup.sh) and the LiftUp Console application (app.liftup.sh). It does not apply to third-party sites or tools we link to, which have their own policies.

We act as a Data Controller for information about you as our customer, and as a Data Processor for information you put into LiftUp about your own customers (for example leads captured into the CRM).

Account information

• Name, work email, organization name, and password (hashed)
• Profile details you optionally provide (role, phone)
• Authentication metadata (two-factor settings, Google SSO identifiers)

Customer content & lead data

• Leads submitted to your products via the lead API (name, email, phone, message, custom fields, attachments)
• Blog posts, media, and editorial workflow data
• AI usage metadata (prompts, generated outputs, token counts)

Technical & usage data

• IP address, browser, device, and approximate country (via request headers)
• Pages visited, actions taken, error logs
• Cookies and similar technologies (see our Cookie Policy)

Billing data

When you subscribe to a paid plan, payment information is handled by Razorpay. We never store your full card number; we receive a billing token and the metadata required to issue invoices.

• Provide and operate the LiftUp service, including the CRM, content, AI, and insights modules
• Authenticate you, secure your account, and enforce permissions
• Send transactional emails (account, billing, security)
• Process payments, calculate taxes where applicable, and issue invoices
• Provide customer support and respond to enquiries
• Detect, investigate, and prevent abuse, fraud, or security incidents
• Improve LiftUp through aggregated analytics and product research
• Comply with legal and regulatory obligations

LiftUp is a multi-tenant SaaS. Your organization's data is logically isolated by an organization_id global scope enforced on every database query and request — not by a UI filter you can bypass. Cross-tenant data access is architecturally impossible during normal operation.

We do not sell your personal information. We share information with vetted processors only as necessary to operate LiftUp:

• Cloud hosting and CDN providers — to run the application and serve static assets
• Razorpay — to process USD and INR payments, manage subscriptions, and UPI AutoPay
• Google APIs (Analytics 4, Search Console, Gmail, Calendar) — only when you connect them and only with the scopes you grant
• OpenAI-compatible providers — to run AI generation when you use Content AI or Image AI
• Transactional email and notification providers — to deliver account, security, and digest emails
• Customer support tools — to handle your enquiries

We may also disclose information if required by law, valid legal process, or to protect the rights, property, or safety of LiftUp, our users, or others.

We are based in India and may transfer information across borders to operate the service or to use the third-party processors listed above. Where required, we rely on appropriate safeguards such as standard contractual clauses.

We retain personal information for as long as your account is active or as needed to provide the service. We also retain information to comply with legal obligations, resolve disputes, and enforce our agreements. Backups are kept on a rolling cycle; deletions propagate to backups within a reasonable period.

When you cancel your subscription, customer content remains available for export for a grace period (typically 30 days) before deletion, unless a longer period is required.

Subject to applicable law, you may have the right to access, correct, export, restrict, or delete your personal information; object to certain processing; and lodge a complaint with a supervisory authority.

To exercise these rights, write to [email protected] from the email on file with us. We may need to verify your identity before acting on a request.

We use industry-standard safeguards including TLS 1.3 in transit, encryption at rest, hashed API keys, two-factor authentication, audit logging, nightly backups, and continuous health checks. See our Security Policy for details.

LiftUp is not intended for individuals under 16. We do not knowingly collect personal information from children.

We may update this policy from time to time. Material changes will be flagged in-app or by email to account owners. The "Last updated" date at the top of this page always reflects the current version.

Questions about this policy? Email [email protected] or write to QalbIT Infotech, India.