Privacy Policy

Last updated 27 October 2026

This policy explains what personal data Ravindra Bisht, trading as LiftCRO handles, why, and your rights. There are two kinds: data about our customers (people who use the LiftCRO dashboard), where we are the controller, and data about visitors to our customers' websites, where our customer is the controller and we only process it on their instructions.

1. Customer data (we are the controller)

What	Why	Legal basis
Name, email, password hash, workspace and team membership	To provide your account and let teams work together	Contract
Billing contact, company name, tax ID (payment card details are held by our payment provider, not us)	To bill subscriptions and keep accounting records	Contract, legal obligation
Audit log of actions, sign-in sessions, IP address for rate limiting	Security, abuse prevention, and showing your team who changed what	Legitimate interest
Support messages and product emails you choose to receive	To help you and send results alerts	Contract, consent (alerts can be turned off)

We don't sell personal data and we don't use advertising trackers in the dashboard.

2. Website visitor data (our customer is the controller)

When a customer installs the snippet, it collects, for visitors who enter an experiment:

a random visitor ID stored in a first-party cookie (lcro_vid) and the assigned variation (lcro_assign in local storage);
device type, browser and operating system family, and whether the visitor is new or returning;
traffic source: the utm_source value or the referring site's hostname;
the goals and custom events the customer configured, with an optional numeric value (for example order revenue).

It does not collect names, emails, full IP addresses or page content. IP addresses are used in transit to block bots and abuse and are not stored. Customers can require consent before the snippet sets cookies, and visitors can opt out with liftcro.optOut(). Visitors who want to exercise their rights should contact the website they visited; we help our customers answer those requests.

3. Who we share data with

We use a small number of service providers to run LiftCRO, listed on our subprocessors page. Each is bound by a data processing agreement. We may disclose data if the law requires it, and we will tell the affected customer unless we are forbidden to.

4. International transfers

Our primary hosting is in the EU. Where a provider processes data outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an adequacy decision.

5. How long we keep data

Account data: while your account exists, then deleted within 30 days of closing it.
Raw visitor events: for your plan's retention period after an experiment ends; aggregated results are kept until you delete the experiment.
Invoices: as long as tax law requires (usually 6–10 years).
Backups: overwritten on a rolling 30-day cycle.

6. Security

Data is encrypted in transit (TLS). Passwords are hashed with bcrypt. Access to production systems is limited to staff who need it, protected by two-factor authentication and logged. Support staff can sign in to your workspace only to help you, and every such action is recorded in your audit log.

7. Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent. Email [email protected] and we'll answer within 30 days. You can also complain to your data protection authority.

8. Contact

Ravindra Bisht, trading as LiftCRO, 25 That Lamgara, Almora, Uttarakhand, India. Privacy questions: [email protected].