Privacy Policy

ShiftX Partners

Effective date: 21 October 2026

Applies to: shiftx.partners (the “Website”) and app.shiftx.partners (the “Platform”, our client and team workspace, including the client portal)

1. Who we are and what this policy covers

ShiftX Partners (“ShiftX”, “we”, “us”, “our”) is an advisory firm for founders and leadership teams on growth, revenue, process and critical risk. ShiftX Partners is a brand of Scaalex Business Solutions Private Limited, a company incorporated in India under the Companies Act, 2013 (CIN U74999KA2018PTC119269), whose registered office is at 4, 402, Olive Geeth, BDA Site No 1178, 1st Stage, 4th Block, 9th A Cross, HBR Layout, Bengaluru, Karnataka 560043. Our office is at WeWork 37 Cunningham, Cunningham Cross Rd, SRT Road, Vasanth Nagar, Bengaluru, Karnataka 560001.

This policy explains what personal data we collect through the Website and the Platform, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It is written to meet India’s Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”), and, to the extent they continue to apply, the Information Technology Act, 2000 and its rules.

In this policy, “personal data” means any data about an identifiable individual. Where a client of ours gives us data about its own people, customers or counterparties, the client decides why that data is used and we handle it on the client’s instructions. See section 3.

2. Who this policy applies to

  • Website visitors to shiftx.partners.

  • Prospects who contact us or book a call.

  • Client contacts: people our clients name to use the client portal, to receive updates, to respond to requests and to share documents.

  • Team members: ShiftX employees, partners and contractors who use the Platform.

  • People named in client material, such as signatories, directors, employees and counterparties mentioned in documents, meeting recordings or messages that a client shares with us.

3. Our role: fiduciary and processor

  • For Website visitors, prospects, client contacts and our own team, ShiftX decides why and how the data is used. We are the Data Fiduciary under the DPDP Act.

  • For personal data inside a client’s own material (documents, transcripts, requests), the client is the Data Fiduciary and ShiftX acts as its processor. We use that data only to deliver the engagement and as the client instructs. Questions or requests about that data should go to the client first. We will help the client respond.

4. What we collect

4.1 From Website visitors and prospects

  • Contact and enquiry form details: name, email, phone number, company, subject and message.

  • Booking details if you book a strategy call: name, email, time and any notes you give.

  • Basic technical data: IP address, device and browser type, pages viewed and referring page. We use analytics only where this policy says so in section 12.

4.2 From client contacts

  • Identity and contact details: name, designation, employer, email address and mobile number.

  • Account details: sign-in credentials, session records and, where you choose “Remember me”, a longer-lasting sign-in on that device.

  • Activity: sign-ins, pages and updates viewed, requests raised, replies and comments, files uploaded or downloaded, and consent choices.

4.3 From our team

  • Account and role details: name, work email, role and the engagements and clients each person works on.

  • Employment administration data kept in the Platform: employee profile, joining details, leave records, timesheets, expenses, salary and payslip records. Access is limited to the Owner and people given an HR or payroll role.

  • Work records: tasks, hours, comments, updates and messages.

  • Audit logs of sign-ins and actions.

4.4 Client engagement material

  • Documents and files a client shares: contracts, financial statements, plans, decks, board papers, due diligence material and similar records, which may include personal data of named people.

  • Meeting recordings and transcripts captured through our meeting tool, and notes, decisions and actions drawn from them.

  • Project updates, milestones, requests, messages and attachments exchanged in the Platform.

4.5 What we do not ask for

We do not ask for health, biometric, genetic or children’s data. If such data is inside a document a client shares, we treat it as part of the engagement material under section 3 and protect it the same way. Please do not send us data you do not need to.

5. How we use personal data

  1. To provide our services and run the Platform: set up accounts, deliver projects, track tasks, updates and decisions, share documents and answer requests.

  2. To communicate with you: reply to enquiries, confirm calls, send project updates, reminders and notices, and send service alerts by email, WhatsApp or web push as described in section 6.

  3. To assist our team with AI tools: summarise meetings, draft or improve text, and estimate effort. A ShiftX team member reviews AI output before it is relied on. See section 7.

  4. To keep the Platform secure: verify identity, manage access, keep audit logs, prevent misuse and investigate incidents.

  5. To run our team and firm: employment administration, payroll, leave, expenses and internal reporting.

  6. To meet legal duties: tax, accounting, company law, professional and regulatory obligations, and to respond to lawful requests.

  7. To back up data so that we can recover from failure.

  8. To improve the Website and Platform, using aggregated or limited data.

We do not sell personal data. We use AI providers only under terms that do not allow them to train on client engagement material (section 7).

6. Messages and notifications

Depending on how you use the Platform, we may contact you by:

  • Email, for account notices, password resets, project updates and requests.

  • WhatsApp (through the WhatsApp Business Platform), for project updates and reminders you have agreed to receive, using pre-approved message templates.

  • Web push notifications, if you allow them in your browser or device.

We send these for service purposes, not for advertising. You can switch off WhatsApp or push messages at any time by telling us or through your device or account settings. Account security emails cannot be switched off while you hold an account.

7. AI tools

The Platform uses artificial intelligence services, currently Anthropic’s Claude, to help our team summarise meetings and notes, draft and improve text, and estimate effort. When these features are used, the relevant text (for example a meeting transcript or a draft) is sent to the AI provider to produce the result.

  • AI output can contain mistakes. A ShiftX team member checks it before it is used in advice or shared with a client.

  • We use the provider’s commercial API terms. Under the terms in force at the effective date, the content we send is not used to train the provider’s models. We will re-check this when those terms change and confirm the position in writing if a client asks.

  • A client that does not want its material sent to AI tools can tell us in writing and we will exclude it.

8. Who we share data with (subprocessors)

We use the following service providers to run the Website and Platform. They process data for us under written terms that require confidentiality and appropriate security. This list is current as of the effective date and we will update it when it changes. Clients can ask for the latest list at any time.

Render

What it does for us: Hosts the Platform and its database and file storage

Data involved: All Platform data

Cloudflare (R2)

What it does for us: Stores encrypted off-site backups

Data involved: Backups of Platform data and files

Framer

What it does for us: Hosts the Website and handles Website forms

Data involved: Enquiry and booking details, technical data

Google (Workspace, Calendar)

What it does for us: Email, calendar scheduling and sign-in connections we set up

Data involved: Names, email addresses, meeting times and email content sent from the Platform

Google (Analytics)

What it does for us: Measures how visitors use the Website

Data involved: Pages viewed, device and browser type, approximate location, and cookie identifiers

Meta (WhatsApp Business Platform)

What it does for us: Delivers WhatsApp messages

Data involved: Mobile number and message content

Anthropic

What it does for us: AI processing

Data involved: Text sent to AI features (section 7)

Fireflies.ai

What it does for us: Meeting recording and transcription

Data involved: Recordings and transcripts

Browser and device push services (Google, Apple, Mozilla)

What it does for us: Deliver web push notifications

Data involved: A push address for your browser and the notification text

We also share personal data when:

  • the law or a court, regulator or authority requires it;

  • our lawyers, auditors, insurers or other professional advisers need it, under duties of confidence;

  • a business transaction involving ShiftX requires it, with the same protection;

  • you or the client has agreed.

Our sister platform. ShiftX and Scaalex run on similar software with separate systems and databases. If one person has an account on both, the Platform may use the person’s email address to show a count of new updates on the other. No content is shared between the two.

9. Where data is stored and sent abroad

Some of our providers store or process data outside India. We choose providers with strong security practices and transfer data only as the DPDP Act allows. Our main application and database are hosted in Oregon, United States. If a client needs its data kept in India or in a particular country, it must tell us in writing before onboarding. Some features, such as AI summaries and off-site backups, may then be limited.

10. How long we keep data

Enquiries and prospect details

How long we keep it: 24 months after the last contact, unless you become a client

Client engagement material

How long we keep it: The length of the engagement, then 7 years for legal, tax and dispute purposes, unless the engagement letter or the law says otherwise

Client portal accounts

How long we keep it: While the person has a role in the engagement, then deactivated when the client tells us they no longer need access

Team account and employment records

How long we keep it: While the person works with us, then as the law requires for employment and tax records

Audit logs

How long we keep it: 3 years

Backups

How long we keep it: Daily backups kept on a rolling 30 days, with a smaller set kept longer for recovery

Data deleted from the live Platform can remain in backups until the backup period ends. We then delete or anonymise it. We may keep data longer where the law requires it or where it is needed for a legal claim.

11. Security

We use measures that suit the data we handle, including:

  • encrypted connections (HTTPS) for the Website and Platform;

  • role-based access, so people see only the clients, projects and records they need;

  • separate sign-in for client portal contacts, with lock-out after repeated failed attempts;

  • encryption at rest of certain sensitive personal details held in the Platform;

  • audit logs of sign-ins, uploads, downloads and access changes;

  • regular encrypted off-site backups;

  • removing access promptly when a person leaves or no longer needs it.

No system is completely secure. Please protect your password, do not share your account, and tell us quickly if you think someone else has used it.

12. Cookies and similar technologies

  • The Platform uses only the cookies it needs to work: a session cookie to keep you signed in, a longer sign-in cookie only if a portal user chooses “Remember me”, and a small preference cookie that remembers display choices such as which task tab you last opened. It uses no advertising cookies.

  • The Website is built on Framer, which may set technical cookies. We also use Google Analytics to understand how visitors use the Website. It sets cookies and records pages viewed, device and browser type, approximate location and similar technical data. We load it only after you accept analytics cookies in the cookie banner, and you can decline or change your choice at any time. At the effective date we do not run advertising or retargeting cookies on the Website.

You can control cookies in your browser settings. Blocking essential cookies may stop the Platform from working.

13. Your rights

Under the DPDP Act you may:

  • ask what personal data we hold and how we use it, and who we share it with;

  • ask us to correct or complete data that is wrong or incomplete;

  • ask us to erase data that is no longer needed, unless we must keep it by law or for a legal claim;

  • withdraw consent you gave, without affecting what we did before you withdrew it;

  • raise a grievance with us, which we will acknowledge within 7 days and resolve within 30 days;

  • nominate another person to exercise these rights if you die or cannot act for yourself.

To use a right, write to our Grievance Officer (section 16). We may need to check your identity first. If your data sits inside a client’s material, we will pass the request to the client or help the client answer it. If you are not satisfied with our reply, you can complain to the Data Protection Board of India once it is operating.

14. If there is a data breach

If a breach of personal data occurs that must be reported, we will tell the Data Protection Board of India and the affected people in the way and within the time the law requires. Where the data belongs to a client, we will tell the client without undue delay and explain what happened, what data was affected and what we are doing about it. We will contain the incident, investigate it and fix the cause.

15. Children

The Website and Platform are for business use and are not meant for anyone under 18. We do not knowingly collect children’s data. If we find we have done so, we will delete it.

16. Grievance Officer and contact

Grievance Officer: Anand PV

Email: contact@shiftx.partners

Phone: +91 99167 00110

Address: ShiftX Partners (a brand of Scaalex Business Solutions Private Limited), WeWork 37 Cunningham, Cunningham Cross Rd, SRT Road, Vasanth Nagar, Bengaluru, Karnataka 560001

17. Changes to this policy

We may update this policy to reflect changes in our services, providers or the law. We will post the new version on shiftx.partners and app.shiftx.partners with a new effective date. For a change that materially affects client data, we will also tell affected clients directly. If we rely on your consent for a new use of your data, we will ask for it again.