Cookie Policy

Last updated: 2026-10-11

Effective: 2026-10-13

This Cookie Policy explains how Unshift LLC ("Unshift", "we", "us", "our") uses cookies and similar technologies on the marketing website at https://unshift.ai and the Unshift Studio at https://studio.unshift.ai (together, the "Services"). It supplements our Privacy Policy.

This policy applies to the Services. It does not apply to websites you build and publish using Unshift; those sites' cookie behavior is under your control and is your responsibility as operator. Nor does it apply to partner deployments, where a software platform offers Unshift's website builder to its own customers under its brand and on its own domain (see Terms of Service §1.1); the partner is responsible for the cookie notice its users see there.

1. What cookies and similar technologies are

A cookie is a small text file placed on your device when you visit a website. Cookies let a site remember information between requests. We also use similar technologies such as:

• Local storage and session storage: browser-side key-value stores that persist small amounts of data.
• Pixels and web beacons: tiny requests embedded in pages or emails that fire on load, used for measurement.
• SDKs in our own code: scripts bundled with our pages that report errors or page views to the providers named below.

For simplicity, this policy refers to all of them as "cookies".

2. Categories of cookies we use

We categorize cookies consistent with the ePrivacy Directive and UK PECR. We set only strictly necessary cookies by default. Analytics and session replay cookies are set only after you opt in to each category separately in the cookie banner. We do not currently use marketing or advertising cookies.

2.1 Strictly necessary (always on)

These cookies are required for the Services to function. They do not track you across sites and do not require consent.

We use Sentry for error monitoring and crash diagnostics on the marketing site and the Studio. We treat it as a strictly-necessary security and reliability function: it loads without a separate consent prompt. Sentry processes diagnostic data such as error stack traces, browser metadata and, when you are signed in to the Studio, your user ID and email address; IP addresses are scrubbed after collection. Error monitoring stores nothing in your browser, is not used for analytics or advertising, and does not track you across sites. The replay Sentry can attach to an error report is session replay (§2.3) and needs your consent.

2.2 Analytics (consent required)

Set only if you accept analytics cookies in the banner. You can change your choice at any time via "Cookie settings" in the footer.

Google Analytics is loaded in the Studio only if you accept the "Product analytics" category, and never while your browser sends Global Privacy Control; it then reports the Studio pages you visit, with sign-in codes and other credentials removed from their addresses.

2.3 Session replay (separate consent required)

Session replay lets Sentry attach an anonymized, video-like reconstruction of the moments before an error in the Studio to that error report, so we can diagnose the bug. Because a replay captures materially more than an error report, we treat it as a separate consent category and it is off unless you explicitly enable it via the Session replay toggle in the cookie banner. Turning it off stops any recording in progress. The marketing site does not record sessions.

With session replay on, Sentry keeps the last moments of your Studio session in your browser and uploads them only when an error occurs, attached to that error report. On-screen text and form inputs are masked at the moment of recording, and images and media are blocked. Network request and response bodies are never captured.

2.4 Marketing and advertising

We do not currently run marketing or advertising cookies, remarketing pixels, or cross-site tracking. We will not enable them without updating this policy and the cookie banner to request consent.

2.5 Functional (case-by-case, consent where required)

We may occasionally embed content from third parties (for example, a YouTube video in a blog post, a Stripe Checkout session during billing). These embeds set their own cookies governed by the provider's cookie notice. We ask for consent before loading embeds that set non-necessary cookies in EEA/UK sessions.

3. How to manage cookies

3.1 Our banner

On your first visit, we display a cookie banner offering Accept All, Reject All, and Customize. Customize lets you toggle analytics (called Product analytics in the Studio) and Session replay independently. Your choice is stored for 12 months. You can revisit the banner any time by clicking Cookie settings in the footer.

Wherever you are, analytics and session replay stay off until you enable them in the banner. This is stricter than what some jurisdictions require, but it keeps our behavior consistent.

3.2 Browser controls

Most browsers let you block or delete cookies. Blocking strictly necessary cookies will break the Services. Helpful resources:

• Chrome: https://support.google.com/chrome/answer/95647
• Firefox: https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer
• Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471
• Edge: https://support.microsoft.com/microsoft-edge

3.3 Global Privacy Control and Do Not Track

We honor the Global Privacy Control (GPC) signal where technically feasible; we treat it as an opt-out of analytics, session replay and, if we ever enable them, marketing cookies. We do not act on the older "Do Not Track" signal, because it has no consistent meaning across browsers.

3.4 Opting out at the vendor level

• Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

4. Log files and server-side analytics

Our servers and hosting providers (Vercel and Cloudflare) collect access logs (IP address, user agent, URL, response code, timestamp) independent of cookies. These logs are used for security, fraud prevention, abuse response, and basic aggregate analytics. We retain logs for up to 12 months. Server-side logs do not require cookie consent because they are necessary for the operation and security of the Services and do not involve storage on your device.

5. Do we combine cookie data with other data?

For logged-in users who have accepted analytics cookies, we may associate analytics events with your user ID to understand product usage. We do not cross-reference analytics data with public ad networks or data brokers.

For logged-out visitors, analytics data is associated with a pseudonymous client ID only.

6. Changes to this policy

We may update this Cookie Policy to reflect changes in the cookies we use. The updated version is posted here with a new "Effective" date. Material changes that introduce new cookie categories (for example, marketing cookies) trigger a refreshed consent request.

7. Contact

• Privacy inquiries: privacy@unshift.ai
• General support: support@unshift.ai
• Postal address: Unshift LLC, 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801, United States