Privacy Notice

(1) Introduction

Platform.sh SAS doing business as Upsun is a French company located at 22 rue de Palestro, Paris, 75002 France, which may include its affiliates and subsidiaries (“Upsun”, “Us”, or “We”). This Privacy Notice explains how We collect, use, and share your personal data when you use our services, visit our sites and communicate with us.

Upsun offers different services, products, software, and offerings, including but not limited to all information, tools, and services (including any beta services) available from Us to you, that are run under the brand “Upsun” and on related sites. “Sites” refers to Platform.sh, Upsun, and Blackfire commercial websites, Services, API, Documentation, and other online resources made available by Upsun, but excluding Customer sites which are subdomains under eu.platform.sh, .us.platform.sh, .platformsh.site, .upsun.app, and .upsunapp.com.

(2) Personal Data We collect

We collect various categories of personal data from you when engaging with our services. This includes, but is not limited to, personal details, online identifiers, contact details, account-related information, usage data and payment details. Personal details, contact details, and payment information are generally provided directly by you; usage, device, and log information is generally collected automatically; and certain information may be received from third parties (for example, business partners or integrations you connect to your account).

• Personal Details and Online Identifiers such as full name and username, email address, phone number, company name, user type, country and User ID. 
• Financial and Payment-related data such as billing information, transaction records, and account balance, payment methods.
• Marketing Communications such as information that you provide to us when you chat with Us, communicate with us electronically or in person at events we participate in, or interact with our sales or customer service personnel, or request promotional material from us, which may include your preferences in receiving marketing materials from us and your communication preferences.
• We may also collect information about you and your interactions with our sites and services from cookies and similar tracking technologies, including IP address, device and application identifiers, browser type, operating system details, location, language, metadata, and user interactions (including user interactions captured via session replay tools), e.g., pages viewed, files accessed, searches performed, and product usage details. Where possible, these tools are configured not to capture fields that are likely to contain personal data and are retained only for a limited period necessary for these purposes. We do not intentionally collect special category (sensitive) personal data through these tools; where any is inadvertently captured, we take steps to delete it upon discovery. For more detail on the specific cookies we use and how to manage your preferences, see our Cookie Notice.

In addition, Upsun provides tools to make your development workflow more productive, such as our Command-Line Interfaces, and will occasionally provide application-specific modules or libraries, which you may opt into, for integration into your project in order to make its configuration simpler. Such applications, libraries, or modules report usage information to us. Information collected may contain the type of actions performed, log data of API activity, as well as configuration information. This information may be linked to you, and we may use this information to better provide technical support to you and to improve our services.

Our sites and services are not directed to individuals under the age of 18, and we do not knowingly collect personal data from them. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete it.

(3) What We use your Personal Data for

We process personal data to provide, maintain, and improve our products and services, comply with applicable legal and contractual obligations, and support our business interests and customer relationships. Specifically, we may use your personal data for the following purposes:

• Service Provision and Account Management: To create, manage and authenticate user accounts; provision access to our platform and services; personalize your experience; and manage settings, preferences, and permissions related to your account. Legal basis: performance of a contract with you.
• Customer Support and Communications: To respond to your inquiries, troubleshoot issues, provide technical assistance, communicate important service updates or changes, and send administrative or service-related notifications. Legal basis: performance of a contract with you and our legitimate interest in providing effective support.
• Operation and Security: To operate, monitor, and secure our platform and associated services, including usage tracking, system performance optimization, threat detection, fraud prevention, abuse mitigation, and enforcement of our terms of services. Legal basis: our legitimate interest in securing our platform, and compliance with legal obligations where applicable. We do not currently use these processes to make decisions about individuals that produce legal or similarly significant effects without human involvement; if this changes, we will update this Notice.
• Analytics and Service Improvements: To analyze usage patterns and service performance; conduct research and development; develop new features and capabilities; help us diagnose issues; and optimize user experience and customer satisfaction. Legal basis: our legitimate interest in improving our products and services.
• Billing and Payment Processing: To manage subscriptions, process payments, issue invoices, and fulfill tax and accounting obligations. Legal basis: performance of a contract with you and compliance with legal obligations (e.g., tax law). 
• Legal and Regulatory Compliance: To comply with applicable laws and regulations; respond to lawful requests from authorities; manage disputes or claims; and protect and enforce our legal rights and interests. Legal basis: compliance with legal obligations, and our legitimate interest in protecting our legal rights.
• Marketing: Subject to your communication preferences and applicable law, to send you relevant information about our products, services, promotions, and events; conduct market research; and tailor offers and advertisements. Legal basis: your consent, or our legitimate interest in marketing our services, revocable at any time as described in Section 5. 

(4) With Whom We May Share Your Personal Data

We may share personal data with our affiliates and trusted third parties under limited circumstances to deliver, support and improve our services (we do not sell your data), fulfill legal obligations, or protect our rights. These may include:

• Service Providers and Processors: We share personal data with third-party service providers who help us operate our platform, such as cloud hosting providers, customer support tools, analytics services, marketing and advertising partners, and payment processors.
• AI-Powered Tools: We may use artificial intelligence (AI) and machine learning tools, including our own AI-enabled product features and third-party AI service providers, to support customer service, troubleshooting and technical support, and product improvement. Personal data you provide (for example, through support tickets, chat interactions, or product usage) may be processed by these tools to generate a response or help us improve our processes and products. Where we use third-party AI providers, we require them to handle personal data under contractual terms consistent with this Privacy Notice.
• Business Partners (as directed by you): In some cases, we may share data with partners, integrations, or third-party services that you choose to connect to your account or use in conjunction with our platform.
• Legal and Regulatory Authorities: We may disclose personal data if required by law, court order, or other legal processes, or when necessary to comply with applicable legal obligations, enforce our agreements, protect the rights, safety of our company, users, or others, or to detect and prevent fraud or other illegal activities.
• Corporate Transactions: In events such as mergers, acquisitions, sales of assets, financing, or other similar transactions, personal data may be transferred to relevant third parties involved, subject to maintaining data protection safeguards consistent with applicable laws and regulations.
• Affiliates: We share personal data within our corporate group to provide and enhance services, manage operations, and coordinate customer support.

We ensure that all third parties with whom we share personal data implement appropriate safeguards, comply with applicable data protection laws, and have undergone thorough due diligence. We ensure data processing agreements or equivalent contracts are in place to enforce these requirements.

Your personal data may be collected, transferred, and stored outside your country or jurisdiction, including countries without an adequacy decision by the European Commission or other supervisory authorities. In such cases, We ensure that appropriate safeguards are implemented by executing standard contractual clauses, or other approved transfer mechanisms and/or agreements, to ensure an adequate level of protection and security for your personal data.

Our lead supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) in France. 

(5) Your data protection rights

You can access, update, or request deletion of personal data we hold about you directly within your account settings section. In addition, you have the following rights:

• Right to Access: You can request confirmation of whether we process your personal data and obtain a copy of it.
• Right to Rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to Erasure: You can ask us to delete your personal data, subject to certain legal exceptions.
• Right to Restrict Processing: You can ask us to restrict the use of your data under specific circumstances (e.g., while a correction is pending).
• Right to Data Portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format, and transmit it to another data controller.
• Right to Object: You may object to the processing of your data where it is based on legitimate interests, or used for direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority if you believe your rights have been violated.

Please note that some of your rights are not absolute and we might need to retain your personal data for compliance with laws or other legitimate reasons. To exercise any of these rights, please see the ‘Contact us’ section below.

(6) Third-party links

Our services may contain links to other sites that are not operated by Us. If you click on a third-party link, you will be directed to that third party's site. We do not endorse these sites, nor are we responsible for the content or accuracy of any information contained on them. We strongly advise you to review the privacy policies of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

(7) How long We keep your Personal Data

We will retain your personal data for a period of time consistent with the purpose of collection or as long as required to fulfill our legal obligations. We determine the appropriate retention period for personal data on the basis of the amount, nature, and sensitivity of the data, and applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal data will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will implement appropriate measures to prevent any further use of such data.

(8) Security

We take compliance with regulations, security standards, and guidelines very seriously and promote security measures that will maintain the confidentiality, integrity, and availability of personal data. We use reasonable organizational, technical, and administrative measures to protect customer personal data from unauthorized access, alteration, disclosure, or destruction. We maintain independently audited security programs, including ISO/IEC 27001, SOC 2 Type 2, and PCI DSS Level 1 certifications; see our Trust Center for details. In the event of a data breach affecting your personal data, we will notify affected individuals and relevant authorities as required by applicable law.

(9) Contact us

If you have any questions, requests, feedback, or concerns regarding this Privacy Notice, or if you want to exercise any of your rights, you can send an email to dpo@upsun.com, or if you are an existing customer, please create a support ticket through your account to allow for identity verification.

(10) Data Privacy Framework

Platform.sh Inc dba Upsun complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Please see our Data Privacy Framework Notice. Platform.sh Inc. is the U.S. affiliate operating under the "Upsun" brand referred to throughout this Notice.

(11) Changes to this Privacy Notice

We may update this Privacy Notice from time to time. We recommend that you revisit this Privacy Notice regularly. This Notice was last reviewed and updated on 15 September 2026 (version 1.2).

Active version 1.2 | Updated 17 September 2026