Privacy Policy · AgentShift

1. Who is responsible

AllShift AI LLC (“AllShift”, “we”) operates AgentShift and decides how the data described here is used. For your own account data we are the controller. For the data you enter about your clients and contacts, you decide why it is collected and we process it on your instructions — in most privacy laws’ terms, you are the controller and we are your processor. Contact for anything in this policy: t.allman@allshiftai.com.

2. What we collect

About you

Account: name, email, password (stored only as a hash), phone, licence number and state, brokerage, team.
Business profile: your commission plan (split, cap, royalty, fees), market area and market assumptions, voice and disclosure notes used to write in your style.
Billing: plan, subscription status, and Stripe identifiers. Your card details go straight to Stripe; we never see or store the number.
Usage: which features you use, the requests you make to Shift and its responses, tool runs and their results, canvas layouts, error logs, and the approvals you give. Standard server logs record IP address, browser and timestamps.
Voice: when you use Hey Shift, audio is processed to text and the text is handled like any other request. We do not keep recordings. Wake-word detection runs on your device.

About your clients and contacts

Names, contact details, relationship notes, life events, home details and estimated values, transaction details, documents you upload, consent records and communication preferences — whatever you import or enter.
Listings and comparable sales you supply, and the analyses computed from them.
Referral details received from LendShift or RealShift when a professional there refers a client to you with the client’s consent. Until you claim a referral, identifying details are withheld.

We do not buy data about you or your contacts from data brokers, and we do not scrape MLS content or photographs.

3. Why we use it

To run the Service you asked for: compute CMAs, net sheets, timelines, scores and compliance checks; draft content; keep your book and pipeline.
To remember context between sessions so Shift does not make you repeat yourself. This memory is scoped to your account.
To bill you, and to tell you about your account (trial ending, payment failed, material changes).
To keep the Service secure, prevent abuse, and debug problems.
To improve the Service using aggregate, de-identified patterns across accounts (for example, which kinds of comparable sales users tend to exclude). These patterns never contain names, addresses or other identifiers, and are shared across Shift-family products only in that de-identified form.
To meet legal obligations and respond to lawful requests.

We do not sell personal information, and we do not use it for third-party advertising.

4. AI processing

Shift uses large language models to understand requests and draft text, and embedding models to search your own notes and memory. Your prompts, the relevant parts of your data, and the model’s responses are sent to those providers over encrypted connections and processed to produce the answer. Our providers are contractually restricted from using your data to train their models, and we do not use it for that purpose either. Where the model drafts content about a person, fair-housing screening runs on the output before you see it. AI output is reviewed by you before anything is sent or published; the Service does not act on its own.

5. Who can see it

You and your seats. On Team and Brokerage plans, people on the same subscription can see shared contacts, pipeline and deadlines according to the roles the administrator sets. Brokerage administrators can see compliance records across the office.
Service providers who process data for us under contract: Supabase (database and authentication), Vercel (hosting and edge network), Stripe (payments), our AI model and embedding providers, and an email delivery provider for account messages. Each receives only what it needs for its job.
Shift-family products, only when you or your client initiates a referral with recorded consent, or when you connect your account to a sister product in Settings. A referral carries the client’s details to the receiving professional; ambient context shared between products is limited to what you have consented to and is queued to the sister only when it has a reason to speak to the same user.
Authorities, when the law requires, or to protect someone from harm. We will tell you unless we are legally prevented from doing so.
A successor, if AllShift is acquired or merges, under the same protections as this policy, with notice to you.

6. Your clients’ rights, and your responsibilities

Because much of the data in the Service is about people who are not our users, you are responsible for having a lawful basis to hold it, honouring their preferences, and telling them how their information is used where the law requires. The Service records written contact consent and Do-Not-Call status and will not suggest outreach to anyone marked as opted out. If a contact asks you to delete their information, delete it in the Service and it is removed from your account; if they contact us directly, we will refer them to you and act on your instruction, or act ourselves where the law requires.

7. Where it lives and how it is protected

Data is stored in the United States. It is encrypted in transit and at rest. Each account’s data is isolated by database-level row security so one agent cannot read another’s rows; billing fields can only be written by our payment webhook. Access by our staff is limited to what is needed to run and support the Service and is logged. No system is perfectly secure; if a breach affects your data we will notify you without undue delay and as the law requires.

8. How long we keep it

Account and business data: for as long as your account is open, then exportable for 30 days after closure, then deleted from live systems, with backups rolling off within a further 30 days.
Conversation history and memory: for as long as your account is open, unless you clear it in Settings.
Billing records: seven years, as tax and accounting law requires.
Compliance and approval records: for the life of the account plus the period your state requires transaction records to be kept, because that is what they are for.
Server and security logs: up to 90 days.

9. Your choices and rights

You can, at any time and without charge:

see and correct your account and business data in Settings;
export your data in standard formats;
clear Shift’s memory of your conversations;
disconnect Shift-family products and withdraw referral consent going forward;
close your account, which deletes your data on the schedule above;
ask us what personal information we hold about you, ask us to delete it, and object to or restrict a use of it.

Write to t.allman@allshiftai.com for anything you cannot do in the product. We will verify it is you and respond within 30 days, or tell you why we need longer. We will not treat you differently for exercising a right. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and other states with privacy statutes have the rights those laws provide; we honour them for everyone. We do not sell or “share” personal information as those laws define it, and we do not respond to browser “do not track” signals because we do not track you across other sites.

10. Cookies

We use the cookies needed to keep you signed in and to keep the Service secure. We do not use advertising cookies or third-party trackers on the application. Our own analytics, where enabled, are first-party and aggregate.

11. Children

The Service is for working professionals. We do not knowingly collect information from anyone under 18. If you believe we have, tell us and we will delete it.

12. Changes to this policy

When we change this policy we update the effective date above. For material changes — a new use of data, a new category of recipient — we email account holders at least 14 days in advance.

13. Contact

AllShift AI LLC · t.allman@allshiftai.com