Privacy Notice

(1) Introduction

Platform.sh SAS doing business as Upsun is a French company located at 22 rue de Palestro, Paris, 75002 France, which may include its affiliates and subsidiaries (“Upsun”, “Us”, or “We”).  This Privacy Notice explains how We collect, use, and share your personal data when you use our services, visit our sites and communicate with us.

Upsun offers different services, products, software, and offerings , including but not limited to, all information, tools and services (including any beta services) available from Us to you, that are run under the brand "Upsun'' and on related sites. Sites refers to Platform.sh, Upsun and Blackfire commercial websites, Services, API, Documentation and other online resources made available by Upsun, but excluding Customer sites which are subdomains under eu.platform.sh, .us.platform.sh, .platformsh.site, .upsun.app, and .upsunapp.com. (the 'Sites')

(2) Personal Data We collect

We collect various categories of personal data directly from you when engaging with our services. This includes, but is not limited to,  personal details, online identifiers, contact details, account-related information, usage data  and payment details.

• Personal Details and Online Identifiers such as full name and username, email address, phone number, company name, user type, country and User ID.
• Financial and Payment-related Data such as billing information, transaction records, and account balance, payment methods.
• Marketing Communications such as information that you provide to us when you chat with Us, communicate with us electronically  or  in  person,  or  interact  with  our  chat  bot,  which  may  include  your  preferences  in  receiving  marketing  materials  from  us  and  your  communication preferences.
• We may also collect information about you, including your interactions with our Sites and services, from cookies and tracking technologies such as IP address, device and app identifiers, browser type, operating system details, location, language, metadata and user interactions (e.g., pages viewed, files accessed, searches performed, and product usage details).

In addition, Upsun provides tools to make your development workflow more productive, such as our Command-Line Interfaces (‘CLIs’) and will occasionally provide application-specific modules or libraries, which you may opt into, for integration into your project in order to make its configuration simpler. Such applications, libraries, or modules report usage information to us. Information collected may contain the type of actions performed, log data of API activity, as well as configuration information (‘usage data’). This information may be linked to you, and we may use this information to better provide technical support to you and to improve our services.

(3) What We use your Personal Data for

We process personal data to provide, maintain, and improve our products and services, comply with applicable legal and contractual obligations, and support our business interests and customer relationships. Specifically, we may use your personal data for the following purposes:

• Service Provision and Account Management:
  To create, manage and authenticate user accounts; provision access to our platform and services; personalize your experience; and manage settings, preferences, and permissions related to your account.
• Customer Support and Communications:
  To respond to your inquiries, troubleshoot issues and provide technical assistance, communicate important service updates or changes, and send administrative or service-related notifications.
• Operation and Security:
  To operate, monitor, and secure our platform and associated services, including usage tracking, system performance optimization, threat detection, fraud prevention, abuse mitigation and enforcement of our terms of services.
• Analytics and Service Improvements:
  To analyze usage patterns and service performance; conduct research and development; develop new features and capabilities; and optimize user experience and customer satisfaction.
• Billing and Payment Processing:
  To manage subscriptions, process payments, issue invoices, and fulfill tax and accounting obligations.
• Legal and Regulatory Compliance:
  To comply with applicable laws and regulations, respond to lawful requests from authorities; manage disputes or claims; and protect and enforce our legal rights and interests.
• Marketing:
  Subject to your communication preferences and applicable law, to send you relevant information about our products, services, promotions, and events; conduct market research; and tailor offers and advertisements.

(4) With Whom We May Share Your Personal Data

We may share personal data with trusted third parties under limited circumstances to deliver and support our services (we do not sell your data), fulfill legal obligations, or protect our rights. These may include:

• Service Providers and processors:
  We share personal data with third-party service providers who help us operate our platform, such as cloud hosting providers, customer support tools, analytics services, marketing and advertising partners and payment processors.
• Business Partners (as directed by you):
  In some cases, we may share data with partners, integrations, or third-party services that you choose to connect to your account or use in conjunction with our platform.
• Legal and Regulatory Authorities:
  We may disclose personal data if required by law, court order, or other legal processes, or when necessary to comply with applicable legal obligations, enforce our agreements, protect the rights, safety of our company, users, or others, or to detect and prevent fraud or other illegal activities.
• Corporate Transactions:
  In events such as mergers, acquisitions, sales of assets, financing, or other similar transactions, personal data may be transferred to relevant third parties involved, subject to maintaining data protection safeguards consistent with applicable laws and regulations.
• Affiliates:
  We may share personal data within our corporate group to provide and enhance services, manage operations, and coordinate customer support.

We ensure that all third parties with whom we share personal data implement appropriate safeguards and comply with applicable data protection laws and have undergone thorough due diligence. We ensure data processing agreements or equivalent contracts are in place to enforce these requirements. 

Your personal data may be collected, transferred and stored outside your country or jurisdiction, including countries without an adequacy decision by the European Commission,  or other supervisory authorities. In such cases, We ensure that appropriate safeguards are implemented by executing standard contractual clauses, or other approved transfer mechanisms and/or agreements, to ensure an adequate level of protection and security for your personal data.

(5) Your data protection rights

You can access, update, or request deletion of your personal data we held about you directly within your account settings section. In addition, You have also the following rights:

• Right to Restrict Processing: You can ask us to restrict the use of your data under specific circumstances (e.g., while a correction is pending).
• Right to Data Portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format, and transmit it to another controller.
• Right to Object: You may object to the processing of your data where it is based on legitimate interests, or used for direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint – You have the right to file a complaint with your local data protection authority if you believe your rights have been violated.

Please note that some of your rights are not absolute and we might need to retain your personal data for compliance with laws or other legitimate reasons. To exercise any of these rights, please see the ‘Contact us’ section below.

(6) Third-party links

Our services may contain links to other sites that are not operated by Us. If you click on a third-party link, you will be directed to that third party's site. We do not endorse these sites, nor are we responsible for the content or accuracy of any information contained on them. We strongly advise you to review the privacy policies of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

(7) How long We keep your Personal Data

We will retain your personal data for a period of time consistent with the purpose of collection  or as long as required to fulfill our legal obligations. We determine the appropriate retention period for personal data on the basis of the amount,  sensitivity, and on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal data will be deleted. If there are any data that we are unable, for technical reasons, to delete entirely from our systems, we will implement appropriate measures to prevent any further use of such data.  

(8) Security

We take compliance with regulations, security standards, guidelines very seriously and promote security measures that will maintain the confidentiality, integrity and availability of personal data. We use reasonable organisational, technical and administrative measures to protect customer personal data from unauthorised access, alteration, disclosure or destruction.

(9) Contact us

If you have any questions, requests, feedback,  or concerns regarding this Privacy Notice or you want to exercise any of your rights,  you can  send an email to dpo@upsun.com or if you are an existing customer please create a support ticket through your account to allow for identity verification.

(10) Data Privacy Framework

Platform.sh Inc. and Blackfire.io Inc., comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Please see our Data Privacy Framework Notice. 

(11) Changes to this Privacy Notice

We may update this Privacy Notice from time to time. We recommend that you revisit this Privacy Notice regularly. This Notice was last reviewed and updated September 2025.