Privacy Policy

Last Updated: April 17, 2026

1. Introduction

Welkin Kft. t/a Uplift Crew (“we,” “us,” or “our”) operates www.upliftcrew.com, a website hosted on the HubSpot Content Management System, and provides virtual health and wellness services. Our Services include: (a) digital products such as e-books, courses, guides, templates, and related wellness content sold individually; and (b) a subscription-based membership program that grants access to exclusive content and asynchronous one-on-one coaching delivered via messaging, email, or other written communication channels (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, subscribe to our membership, engage with our Services, purchase digital products, or interact with us through any of our platforms.

This Privacy Policy has been drafted in compliance with the European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (“CCPA/CPRA”), and the California Online Privacy Protection Act (“CalOPPA”). Where provisions are jurisdiction-specific, they are noted accordingly.

By accessing our website or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our Services.

2. Data Controller Information

For the purposes of the GDPR, the data controller responsible for your personal data is:

Welkin Kft. t/a Uplift Crew
Attila utca 12 18, 1047 Budapest, Hungary
Email: richard@upliftcrew.com

If you have any questions about how we process your personal data, or wish to exercise your rights, you may contact us at the details above.

3. Personal Data We Collect

We collect and process different categories of personal data depending on how you interact with our Services. Under both the GDPR and the CCPA/CPRA, “personal data” (or “personal information”) means any information that identifies, relates to, or could reasonably be linked to you.

3.1 Information You Provide Directly

• Account & Identity Data: When you create an account on Gumroad to purchase our digital products or subscribe to our membership, Gumroad collects your name, email address, and account credentials. When you register for our membership program, you provide your name, email address, and relevant health or wellness goals.

• Subscription & Membership Data: When you subscribe to our membership through Gumroad, we collect information about your selected subscription tier, billing cycle, start date, renewal dates, and membership status. This data is processed through Gumroad and Stripe, and transferred to HubSpot via Zapier.

• Payment & Transaction Data: Purchases of digital products and subscription payments are processed through Gumroad, which uses Stripe as its underlying payment processor. Stripe collects your payment card number, expiration date, CVC code, billing address, and transaction details. We do not directly store your full payment card information—this is handled by Stripe under PCI-DSS compliance. We receive confirmation of transactions, purchase amounts, recurring billing details, and the last four digits of your card.

• Communication & Coaching Data: When you engage with our asynchronous one-on-one coaching service as part of your membership, we collect the messages, questions, and any files or attachments you send via our coaching communication channels (email, messaging platforms, or forms hosted by HubSpot). When you email us or submit a contact form on our HubSpot-hosted website, we collect your name, email address, the content of your message, and any attachments. These records are stored in HubSpot’s CRM system and in Google Workspace (Gmail, Google Drive).

• Health & Wellness Data: In the context of providing our membership services and asynchronous coaching, you may share information about your physical health, mental wellbeing, dietary habits, fitness routines, and wellness goals. This information may be considered special category data under Article 9 of the GDPR and is processed only with your explicit consent.

• Marketing Preferences & Consent Data: When you subscribe to our newsletter or marketing communications via HubSpot forms on our website, we record your subscription preferences, consent type (explicit consent or legitimate interest), and the timestamp and method of consent.

3.2 Information Collected Automatically

• Website Usage Data: Our website is hosted on HubSpot’s Content Management System. HubSpot’s tracking code and cookies collect information about how you interact with our website, including pages visited, time on site, click paths, referral URLs, and session duration.

• Device & Technical Data: We automatically collect your IP address, browser type and version, operating system, device type, screen resolution, language settings, and time zone.

• Cookie & Tracking Data: HubSpot sets cookies on your browser to enable analytics, form tracking, and marketing attribution. Gumroad and Stripe may also set cookies in connection with purchases, subscription management, and affiliate tracking. See Section 10 (Cookies & Tracking Technologies) for further detail.

3.3 Information from Third Parties

• Gumroad: As our e-commerce and subscription management platform, Gumroad shares transaction data with us, including subscriber/purchaser name, email address, purchase and subscription history, product details, membership status, and any refund or dispute information. Gumroad acts as a data controller for its own platform operations and as a data processor for personal data processed in connection with our sales and subscriptions.

• HubSpot: HubSpot acts as both our website hosting provider and a data processor on our behalf under its Data Processing Agreement. It may enrich contact records with publicly available information (e.g., company name, job title) where you have interacted with our marketing content.

• Stripe: Stripe processes payments and recurring subscription charges as Gumroad’s payment sub-processor and may collect additional fraud-detection data (e.g., device fingerprints, behavioral signals) in its capacity as a data controller for its own fraud prevention purposes.

• Zapier: Zapier serves as our integration and workflow-automation platform, connecting Gumroad with HubSpot. When a purchase, subscription, renewal, cancellation, or refund event occurs in Gumroad, Zapier automatically relays the associated contact and transaction data to HubSpot so that the corresponding CRM record can be created, updated, or enriched. Data received from Gumroad via Zapier includes subscriber/purchaser name, email address, subscription tier, membership status, purchase details and related transaction metadata. Zapier acts as a data processor on our behalf under its Data Processing Addendum.

4. Purposes and Legal Bases for Processing

Under Article 6 of the GDPR, we process your personal data only where we have a valid legal basis. The table below summarizes the purposes for which we process your data and the corresponding legal basis.

Withdrawal of Consent: Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. You may withdraw consent for marketing emails by clicking the “Unsubscribe” link in any email sent through HubSpot, or by contacting us directly.

5. How We Share Your Personal Data

We do not sell your personal data. We share your personal data only in the circumstances described below and only to the extent necessary to fulfill the stated purpose.

5.1 Third-Party Service Providers (Data Processors)

We engage the following third-party service providers, each of which acts as a data processor under an appropriate Data Processing Agreement (DPA):

HubSpot, Inc.

• Role: Website hosting (Content Management System), CRM, email marketing, marketing automation, analytics, form hosting, and asynchronous coaching communication management.

• Data Shared: Contact details (name, email, phone), website activity data, marketing engagement data (email opens, clicks), form submissions, coaching correspondence records, data received from Gumroad via Zapier (name, email, subscription tier, membership status, purchase details), and consent records.

• Data Processing: HubSpot acts as a data processor on our behalf for both website hosting and CRM/marketing functions. For EU accounts, HubSpot Ireland Limited is the processing entity. HubSpot maintains GDPR data privacy settings including consent tracking, legal basis recording, and GDPR-compliant contact deletion.

• Transfers: Data may be transferred to the United States. HubSpot relies on Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework for lawful international data transfers.

Gumroad, Inc.

• Role: E-commerce platform for digital product sales, subscription and membership management (including tier selection and recurring billing), license key delivery, and customer purchase management.

• Data Shared: Subscriber/purchaser name, email address, billing information (processed via Stripe), purchase and subscription history, membership tier and status, product access records, and affiliate tracking cookies. Selected transaction and contact data are transmitted to HubSpot via Zapier as described below.

• Data Processing: Gumroad acts as a data processor for personal data processed in connection with our sales and subscriptions, and as an independent data controller for its own platform operations. Customers must create a Gumroad account to complete purchases or subscriptions, and Gumroad’s own Privacy Policy (gumroad.com/privacy) governs its controller activities.

• Transfers: Gumroad is headquartered in the United States. Data transferred outside the EEA is protected by Standard Contractual Clauses (SCCs).

Zapier, Inc.

• Role: Integration and workflow-automation platform used to connect our Gumroad account with our HubSpot account. Zapier monitors events in Gumroad (such as new purchases, new subscriptions, subscription renewals, cancellations, and refunds) and automatically transmits the associated contact and transaction data to HubSpot so that the corresponding CRM contact records are created, updated or enriched without manual intervention.

• Data Shared: Subscriber/purchaser name, email address, subscription tier, membership status, purchase details, billing cycle, renewal date, and transaction metadata (amount, currency, product identifier, order identifier).

• Data Processing: Zapier acts as a data processor on our behalf under its Data Processing Addendum and Sub-Processor terms. Zapier processes personal data solely in accordance with our documented instructions to facilitate the integration between Gumroad and HubSpot. Zapier does not use your personal data for any independent purpose, and does not sell or share personal data for cross-context behavioral advertising.

• Transfers: Zapier is headquartered in the United States (Zapier, Inc., San Francisco, California). International transfers from the EEA, United Kingdom and Switzerland are protected by Standard Contractual Clauses (SCCs) incorporated into Zapier’s Data Processing Addendum and, where applicable, Zapier’s certification under the EU-U.S. Data Privacy Framework, together with supplementary technical and organisational measures including encryption in transit and access controls.
  

Stripe, Inc.

• Role: Payment processing (as Gumroad’s payment sub-processor), recurring subscription billing, and fraud prevention.

• Data Shared: Payment card details, billing address, transaction amounts, recurring billing data, device information, and behavioral signals for fraud detection.

• Data Processing: Stripe acts as a data processor for payment processing on behalf of Gumroad and the merchant. For fraud prevention and financial compliance, Stripe acts as an independent data controller. Stripe’s Data Processing Agreement incorporates Standard Contractual Clauses and Stripe participates in the EU-U.S. Data Privacy Framework.

• Transfers: Stripe may transfer data globally. Within the EEA, Stripe Payments Europe Limited (Ireland) acts as the processing entity. International transfers rely on the Data Privacy Framework, SCCs, and supplementary security measures.

Google LLC (Google Workspace)

• Role: Business email (Gmail), document storage (Google Drive), and internal collaboration for service delivery, including storage of asynchronous coaching correspondence and shared materials.

• Data Shared: Email correspondence, asynchronous coaching messages and notes, files shared during coaching engagements, calendar data, and internal administrative records.

• Data Processing: Google acts as a data processor under the Google Workspace Cloud Data Processing Addendum (CDPA). Google processes Customer Data solely in accordance with the customer’s instructions and does not use Customer Data for advertising or to serve ads.

• Transfers: Google maintains data centers globally. International transfers are governed by the Cloud Data Processing Addendum incorporating SCCs, and Google has certified under the EU-U.S. Data Privacy Framework.

5.2 Other Disclosures

• Legal Compliance: We may disclose your data where required by law, regulation, legal process, or enforceable governmental request.

• Protection of Rights: We may disclose data to protect the safety and security of our users or protect our legal rights.

• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you and provide choices before your data is transferred to a new entity and becomes subject to a different privacy policy.

6. International Data Transfers

Our service providers—HubSpot, Gumroad, Stripe, Zapier, and Google—are headquartered in the United States. Personal data of individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland may therefore be transferred to the United States or other jurisdictions that may not offer an equivalent level of data protection.

To ensure your data is protected in accordance with Chapter V of the GDPR (Articles 44–49), we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): Adopted by the European Commission, incorporated into the DPAs with each of our processors.

• EU-U.S. Data Privacy Framework: Where applicable, our processors have certified under the Data Privacy Framework, providing an adequacy-based transfer mechanism.

• Supplementary Measures: Encryption in transit and at rest, access controls, and contractual restrictions on data use.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements, in accordance with the GDPR’s storage limitation principle (Article 5(1)(e)) and the CCPA/CPRA requirement to disclose retention periods (Cal. Civ. Code § 1798.100(a)(3)). The following retention periods apply:

• Membership & Coaching Records: Retained for the duration of the coaching relationship plus six (6) years thereafter, unless you request earlier deletion.

• Purchase & Transaction Records: Retained for the period required by applicable law. Under Hungarian tax and accounting legislation, invoices and related transaction records must be retained for eight (8) years from the end of the calendar year following the date of invoice issuance, as maintained in Gumroad and Stripe.

• Email & Coaching Correspondence: Retained in Google Workspace and HubSpot for the duration of the membership relationship plus six (6) years thereafter, unless you request earlier deletion.

• Marketing Data: Retained until you unsubscribe or withdraw consent. HubSpot consent records and timestamps are preserved for accountability purposes.

• Website Analytics Data: HubSpot tracking data is retained in accordance with HubSpot’s data retention policies and our own settings within the platform.
  

• Zapier Task History: Zapier temporarily stores logs of each automation task (including the data transmitted between Gumroad and HubSpot) for the period set out in Zapier’s documentation (typically one to three months depending on plan) for error diagnosis and audit purposes, after which task data is automatically purged.

When data is no longer required, it is securely deleted or anonymized. Where Gumroad, Zapier or HubSpot retain data under their own data controller activities, their respective retention policies apply.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include:

• Encryption of data in transit (TLS/SSL) across all platforms including our website, HubSpot, Gumroad, Stripe, Zapier, and Google Workspace.

• Encryption of data at rest within Google Workspace, Zapier and Stripe’s infrastructure.

• Stripe’s PCI-DSS Level 1 compliance for all payment card data, ensuring the highest standard of payment security.

• Role-based access controls within HubSpot, Zapier and Google Workspace, limiting data access to authorized personnel.

• Multi-factor authentication (MFA) on all administrator accounts.

• Regular review of access permissions, Zap configurations and security configurations.

Despite these measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but will notify you and any applicable regulator of a data breach in accordance with Article 33 of the GDPR (within 72 hours of becoming aware of a breach likely to result in a risk to your rights and freedoms).

9. Your Rights Under the GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR (Articles 15–22):

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.

• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete data.

• Right to Erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.

• Right to Restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.

• Right to Data Portability (Art. 20): You may request your data in a structured, commonly used, and machine-readable format.

• Right to Object (Art. 21): You may object to processing based on legitimate interests, including direct marketing.

• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time.

• Right Not to Be Subject to Automated Decision-Making (Art. 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

How to Exercise Your Rights: Submit a request by emailing richard@upliftcrew.com. We will respond within one month of receipt. In complex cases, we may extend this by a further two months, in which case we will inform you of the extension and the reasons for it within the initial one-month period.

Where we use HubSpot as our CRM, we can process your data access, portability, or deletion request using HubSpot’s GDPR-compliant deletion function, which permanently purges the contact record and anonymizes associated activity data. For Gumroad-related data, we will coordinate with Gumroad to fulfil your request. For data processed through Zapier, we will coordinate with Zapier to purge task history and ensure no residual data remains in Zapier’s logs. For Stripe data, you may also contact Stripe directly at dpo@stripe.com.

Right to Lodge a Complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

10. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. In compliance with the ePrivacy Directive and the GDPR, we obtain your consent before placing non-essential cookies on your device.

10.1 Types of Cookies We Use

10.2 Managing Cookies

You can manage your cookie preferences through our cookie consent banner displayed upon first visit. You may also configure your browser to reject cookies or alert you when cookies are being set. Note that blocking essential cookies may impair website functionality. HubSpot’s cookie consent banner, where implemented, respects your opt-in or opt-out choices and suppresses HubSpot tracking for visitors who decline analytics cookies.

10.3 Third-Party Collection of Personal Information

In accordance with CalOPPA (§ 22575(b)(6)), we disclose that third parties—including HubSpot, Gumroad, Zapier, and Stripe—may collect personally identifiable information about your online activities over time and across different websites when you use our website or Services, as described in Sections 3.2 and 3.3 above.

11. Your Rights Under the California Consumer Privacy Act (CCPA)

This section applies to California residents and supplements the rest of this Privacy Policy, in compliance with the California Consumer Privacy Act of 2018 (Cal. Civ. Code §§ 1798.100–1798.199), as amended by the California Privacy Rights Act (CPRA).

11.1 Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information:

• Identifiers: Name, email address, IP address, Gumroad account identifier.

• Financial Information: Payment card details (processed by Stripe via Gumroad), billing address, purchase history.

• Internet/Electronic Activity: Browsing history on our website, search activity, interactions with HubSpot emails and forms, cookie data.

• Commercial Information: Records of digital products purchased, membership subscriptions, coaching interactions, transaction histories.

• Sensitive Personal Information — Health-Related Information: Health and wellness information voluntarily shared in the context of asynchronous coaching services (collected only with your consent). You have the right to limit our use of this sensitive personal information to that which is necessary to perform our Services.

• Geolocation Data: Approximate location derived from IP address.

11.2 Use and Disclosure of Personal Information

We use the categories of personal information listed above for the business purposes described in Section 4 of this Privacy Policy. We disclose personal information to the categories of service providers listed in Section 5.

We do not sell your personal information. We have not sold personal information in the preceding twelve (12) months and do not intend to do so. For the avoidance of doubt, sharing data with our service providers (HubSpot, Gumroad, Stripe, Zapier, Google) for the purposes described in this Privacy Policy does not constitute a “sale” under the CCPA.

We do not share your personal information for cross-context behavioral advertising. We do not participate in data-sharing arrangements for the purpose of cross-context behavioral advertising as defined by the CPRA.

11.3 Your California Privacy Rights

As a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know / Access: You may request that we disclose the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we have shared your data.

• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, completing a transaction).

• Right to Correct: You may request correction of inaccurate personal information.

• Right to Opt-Out of Sale/Sharing: Although we do not sell or share personal information, you may exercise this right at any time if our practices change.

• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information (such as health-related data) to that which is necessary to perform our Services.

• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge different prices, or provide a different level of quality.

11.4 How to Submit a Request

You may submit a verifiable consumer request by emailing richard@upliftcrew.com. You may authorize an agent to submit a request on your behalf, provided we can verify the agent’s authority. We will verify your identity before fulfilling any request and will respond within 45 days. If additional time is required, we will inform you of the extension (up to an additional 45 days) and the reason.

11.5 Financial Incentives

We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.

12. Compliance with CalOPPA (California Online Privacy Protection Act)

In accordance with CalOPPA (Cal. Bus. & Prof. Code §§ 22575–22579), we make the following disclosures:

12.1 Conspicuous Posting

This Privacy Policy is conspicuously accessible from our website homepage via a link titled "Privacy Policy." The link is located in the footer of every page.

12.2 Personally Identifiable Information Collected

A detailed description of the categories of personally identifiable information collected is provided in Section 3 above. This includes first and last name, email address, physical address (where provided), telephone number, and any other identifiers that permit contact with you.

12.3 Third Parties with Whom Data is Shared

The categories of third parties with whom we may share your personally identifiable information are described in Section 5. These include HubSpot (website hosting, CRM, and marketing), Gumroad (e-commerce and subscription management), Stripe (payments), Zapier (automated integration between Gumroad and HubSpot), and Google Workspace (communications and collaboration).

12.4 How You Can Review and Request Changes

You may review, update, or request deletion of your personal information by contacting us at richard@upliftcrew.com. For Gumroad account data, you may access and update your information directly through your Gumroad account settings.

12.5 How We Notify You of Changes

We will notify you of material changes to this Privacy Policy by updating the "Last Updated" date at the top of this page. For significant changes, we may also notify you by email (through HubSpot) or by posting a prominent notice on our website. We encourage you to review this Privacy Policy periodically.

12.6 Effective Date

This Privacy Policy is effective as of April 9, 2026.

12.7 Do Not Track ("DNT") Signals

CalOPPA requires us to disclose how we respond to Do Not Track signals. Do Not Track is a deprecated, non-standard HTTP header that was never universally adopted by the advertising or technology industry. Our website does not currently respond to DNT browser signals, as there is no accepted standard for how to interpret or honor them, and major browsers have begun removing DNT support entirely.

Global Privacy Control (GPC): Global Privacy Control is a newer browser-level signal that carries legal weight under the California Consumer Privacy Act (CCPA/CPRA). Unlike DNT, GPC is recognized as a valid opt-out-of-sale/sharing request under California law. When we detect a GPC signal from your browser, we will treat it as a valid request to opt out of the sale or sharing of your personal information, to the extent applicable under the CCPA/CPRA. You can learn more about GPC and enable it in your browser at globalprivacycontrol.org.

13. Children’s Privacy

Our Services are not directed at individuals under the age of 16 (or under 13 in jurisdictions where that is the applicable threshold). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at richard@upliftcrew.com.

14. Data Processing Workflows

To provide transparency about how your data flows through our systems, this section describes the key data processing workflows:

14.1 Digital Product Purchase Workflow 

• You browse our HubSpot-hosted website and view product listings. HubSpot tracking code records page views and session data (with your consent via cookie banner).

• You click to purchase and are directed to Gumroad’s checkout, where you create or log in to a Gumroad account.

• Gumroad passes payment details to Stripe for processing. Stripe returns a payment confirmation to Gumroad.

• Gumroad records the transaction, delivers the digital product, and shares transaction details with us.

• Zapier detects the new purchase event in Gumroad and automatically transmits the associated contact details (name, email) and purchase information (product, amount, transaction identifier) to HubSpot.

• We store your contact details and purchase record in HubSpot CRM for order fulfillment, support, and (with your consent) marketing communications.

14.2 Membership Subscription Workflow

• You are directed to Gumroad where you select your membership subscription tier.

• You create or log in to your Gumroad account and complete payment via Stripe.

• Gumroad processes recurring subscription billing through Stripe and shares your contact details, subscription tier, membership status, and transaction data with us.

• Zapier detects the new subscription event (as well as subsequent renewals, cancellations, and refunds) in Gumroad and automatically transmits the relevant contact and subscription data to HubSpot.

• Your contact record is created or updated in HubSpot CRM via the Zapier integration, with consent and legal basis tracked.

• Upon successful subscription, you gain access to exclusive membership content and asynchronous one-on-one coaching.

14.3 Asynchronous Coaching Workflow

• As an active member, you communicate with your coach via email, messaging platforms, or HubSpot-hosted forms on our website.

• Your coaching messages, questions, and any attachments are stored in HubSpot CRM and Google Workspace (Gmail, Google Drive).

• Follow-up communications and coaching responses are sent via Gmail or HubSpot email.

• Health and wellness data shared during coaching exchanges is stored with encryption and access restricted to authorized coaching personnel only.
  

14.4 Marketing & Communications Workflow

• You opt in to marketing communications via a HubSpot form on our website (with explicit consent or legitimate interest recorded).

• HubSpot stores your contact record, subscription preferences, and consent timestamp.

• Marketing emails are sent through HubSpot.

• Open and click tracking is recorded for engagement analytics.

• You may unsubscribe at any time via the link in any email, which updates your HubSpot subscription preferences.

14.5 Gumroad ↔ HubSpot Integration Workflow (via Zapier)

• Zapier is permanently connected to our Gumroad and HubSpot accounts via OAuth-authenticated API connections, configured by us in the Zapier administrator console.

• When a triggering event occurs in Gumroad (new sale, new subscriber, updated subscription, cancelled subscription, refund), Zapier receives the event payload via the Gumroad API.

• Zapier applies any filters or formatting rules defined by us (for example, standardising country codes or mapping Gumroad product identifiers to HubSpot deal properties) and then calls the HubSpot API to create, update or enrich the corresponding contact, deal or custom-object record.

• Each integration run is recorded in Zapier’s task history for monitoring and troubleshooting, and is purged in accordance with Zapier’s retention rules (see Section 7).

• No data is transferred to Zapier for any purpose other than this integration. Zapier is contractually prohibited from using your personal data for its own commercial purposes.
  

15. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Changes become effective when posted on our website with an updated “Last Updated” date. Material changes will be communicated via email (through HubSpot) or via a prominent website notice. Continued use of our Services after such changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Welkin Kft. t/a Uplift Crew
Attn: Privacy / Data Protection
Attila utca 12 18, 1047 Budapest, Hungary
Email: richard@upliftcrew.com

For Stripe-related privacy inquiries, you may contact Stripe’s DPO at dpo@stripe.com. For Gumroad-related inquiries, email support@gumroad.com. For Zapier-related privacy inquiries, you may contact Zapier’s privacy team at privacy@zapier.com. For Google Workspace data processing inquiries, visit Google’s Cloud Data Protection Team at support.google.com.