Home / Privacy Policy
Legal

Privacy Policy

Last updated: June 2026

1. Controller

The controller responsible for processing your personal data is:

Tartaruga Studio Sàrl
Impasse de la Poste 1A, 1669 Porsel, Switzerland
Email: [email protected]

2. Scope

This policy explains how we handle personal data when you visit our website, when you join our waitlist and when you use our service. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP), as applicable.

3. What data we collect

  • Waitlist sign-up: your email address, an invite code generated for you, the invite code you arrived with (if any), your approximate position in the queue, and the date and time of sign-up.
  • Server and access data: when you visit the site, our hosting provider processes technical data such as your IP address, browser type and the pages requested, to deliver and secure the site.
  • Direct contact: if you email us, we process the information you choose to provide.
  • Account and service data: when you create an account and use the service, we process your name and email, your login details, the websites you migrate and edit, your settings, and your billing details.

4. Purposes and legal bases

  • Operating the waitlist (sending you a confirmation, managing your position and the referral mechanism): performance of pre-contractual / contractual steps at your request, and our legitimate interest in running the waitlist (Art. 6(1)(b) and (f) GDPR).
  • Providing the service (creating your account, migrating and hosting your website, and letting you edit it): performance of our contract with you (Art. 6(1)(b) GDPR).
  • Delivering and securing the website: our legitimate interest in a stable, secure service (Art. 6(1)(f) GDPR).
  • Responding to enquiries: our legitimate interest in communicating with you (Art. 6(1)(f) GDPR).

5. Service providers (processors)

We use carefully selected providers who process data on our behalf under data-processing agreements:

  • Supabase, database hosting for waitlist and account data, in the EU region (Frankfurt, Germany).
  • Cloudflare, website hosting, content delivery and security.
  • Plunk, sending transactional emails (e.g. your waitlist confirmation and account notifications).
  • PostHog, product analytics and optional session replay inside our app, hosted in the EU region. Form inputs are masked by default, so we do not record what you type into fields (see section 7).
  • Stripe, payment processing for migrations and subscriptions, including the billing details you enter at checkout.
  • Anthropic, the AI provider (Claude) behind our editor; it processes the page content and the instructions you give the editor in order to produce the changes you request. Under our agreement this content is not used to train AI models.
  • GitHub, hosting the source code of the website we build and maintain for you.
  • Firecrawl, fetching pages from your existing website during migration when they cannot be reached directly.
  • Trigger.dev, running background jobs such as migrations and AI edits.
  • Google (Google Ireland Limited), web analytics via Google Analytics on our public website; only active if you consent to the "Analytics" category (see section 7).

Where a provider processes data outside Switzerland or the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Personal data in websites we migrate for customers

This policy covers our own website, the waitlist and your use of our service. When we migrate and host a website for a customer, that website may contain personal data of the customer's own visitors and contacts (for example through contact forms). For that data the customer is the controller and ShiftPress acts as a processor: we process it only on the customer's documented instructions and under a separate data-processing agreement (DPA). That agreement, rather than this policy, governs such customer-site data.

7. Cookies and analytics

Our site is built to be data-minimal. We do not set tracking or advertising cookies without your consent. Strictly necessary storage may be used to remember an invite code during your visit.

Google Analytics. With your consent we use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics helps us understand how visitors use our site so we can improve it. It processes cookies and data such as your truncated IP address, browser and device type, the pages you view and your approximate region, and sends them to Google.

This processing only happens if you accept the "Analytics" category in our cookie banner. The legal basis is your consent (Art. 6(1)(a) GDPR). Before you consent, Google Analytics is not loaded and no related cookies are set. You can withdraw your consent at any time with effect for the future by opening the cookie settings at the bottom of the page and turning analytics off.

Google may also process data in the United States. For such transfers we rely on appropriate safeguards, in particular the EU Standard Contractual Clauses. For more on how Google processes data, see Google's Privacy Policy.

Product analytics in the app. Inside our signed-in app we use PostHog to understand how the product is used, for example which features people use and where they get stuck, and optionally to replay sessions so we can reproduce and fix problems. PostHog is hosted in the EU region. Form inputs are masked by default, so we do not capture what you type into fields. The legal basis is our legitimate interest in operating, securing and improving the service (Art. 6(1)(f) GDPR). See PostHog's Privacy Policy.

8. Retention

We keep waitlist data until you ask us to delete it or it is no longer needed. We keep your account and site data for as long as you have an account, and delete or anonymise it after you close your account, except where we must retain certain records (for example invoices) to meet legal obligations. Server logs are kept only as long as needed for security and operation.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. You can withdraw consent at any time. To exercise any of these rights, contact [email protected].

You also have the right to lodge a complaint with a supervisory authority, in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.

10. Data security

We use appropriate technical and organisational measures (including encryption in transit and access controls) to protect your data against unauthorised access, loss or misuse.

11. Changes

We may update this policy as the product evolves. The current version is always available on this page.

12. Contact

For any privacy question, email [email protected].