Privacy Policy

Last updated: 30 March 2026

1. Introduction

ChatShift is a Chrome browser extension developed and operated by N90 Labs Ltd, a company registered in England and Wales ("we", "us", "our"). ChatShift allows you to export and manage your AI conversation history from services including ChatGPT, Claude, Gemini, and Microsoft Copilot.

N90 Labs Ltd is the data controller for the personal data described in this policy. This means we are the organisation legally responsible for deciding how and for what purposes your personal data is used.

This privacy policy explains what data we collect, how we use it, who we share it with, and what rights you have. It applies to users of ChatShift worldwide.

We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where you are located in the European Economic Area, the EU GDPR also applies. If you are located elsewhere, we comply with applicable local data protection laws.

We take your privacy seriously. Please read this policy carefully. If you have any questions, contact us at support@chatshift.ai.

2. What data ChatShift accesses on your device

ChatShift keeps your conversation data on your device. We do not collect, store, or transmit your AI conversations to our servers.

To perform its core function of exporting your AI conversations, ChatShift accesses the following data locally on your device:

• Session tokens (temporary): Used temporarily to authenticate API requests to your AI accounts (OpenAI, Anthropic, Google, Microsoft) on your behalf. These tokens are never stored permanently or sent anywhere other than to the respective service provider.
• Conversation data (local IndexedDB): Your conversation history (messages, titles, timestamps) is downloaded from your AI accounts and stored locally in your browser's built-in storage (IndexedDB). This data never passes through our servers.
• Downloaded files (local): When you save your history to your computer, ChatShift generates an HTML file with embedded JSON data saved directly to your Downloads folder. Nothing is uploaded anywhere.

3. What personal data we collect

We do not collect any conversation content. The only personal data we hold on our servers is:

• Email address: Collected when you create an account, used for authentication and essential service communications.
• Payment status: Whether you are on the free or paid tier.
• Stripe customer ID: If you have purchased the paid tier, we store a reference to your Stripe customer ID to verify your payment status.
• Authentication tokens: Stored locally in your browser to keep you signed in. These are not shared with third parties.

If you sign in with Google, we receive your email address and basic profile information from Google. We do not access any other Google data beyond what is needed for authentication.

We do not collect any special category personal data (such as data about health, race, religion, or political opinions).

4. How and why we use your personal data

Under data protection law, we can only use your personal data if we have a lawful basis for doing so. The table below explains what we use your data for and the lawful basis we rely on in each case.

Purpose	Lawful basis
To create and manage your account	Performance of a contract with you
To authenticate you when you use the extension	Performance of a contract with you
To process payments and manage billing via Stripe	Performance of a contract with you
To send essential service communications	Performance of a contract with you; Legal obligation
To respond to your support enquiries	Performance of a contract with you; Legitimate interests
To detect and prevent fraud or misuse	Legitimate interests
To comply with legal and regulatory obligations	Legal obligation
To send you marketing communications (only with consent)	Consent

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You can ask us for details of this assessment by contacting us at support@chatshift.ai.

5. Where your data is stored and international transfers

Your conversation data is stored locally on your device and never leaves it.

Your account data (email address, payment status) is stored securely in our database hosted by Supabase in the EU region (London, United Kingdom).

Payments are processed by Stripe. When you make a payment, your payment details (card number, billing address) are handled entirely by Stripe. We never see or store your full card details. Stripe may process your payment data in the United States or other countries. See Stripe's privacy policy for details.

Where your personal data is transferred outside the United Kingdom or the European Economic Area, we ensure appropriate safeguards are in place as required by applicable data protection law, including the International Data Transfer Agreement (IDTA) and Standard Contractual Clauses (SCCs).

6. Who we share your personal data with

We only share your personal data with the following third parties, and only to the extent necessary to provide our service:

• Supabase: Provides authentication and hosts our database. Hosted in the EU.
• Stripe: Processes payments for the paid tier.
• Google: If you choose to sign in with Google, Google's OAuth service is used for authentication only.
• AI platforms (OpenAI, Anthropic, Google, Microsoft): ChatShift reads your conversations from these services using your existing browser session. This is your own data being accessed by you -- we do not receive or store this data.

We never sell your personal data. We do not share your data with advertisers, data brokers, or any other third parties for their own marketing purposes.

7. Marketing

We may from time to time wish to send you updates about ChatShift. We will only send you marketing communications if you have given your prior consent. You can opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at support@chatshift.ai.

8. Chrome extension permissions

ChatShift requests the following Chrome permissions to function correctly:

• storage: To save your preferences and authentication state locally in your browser.
• activeTab: To interact with the currently open AI service tab.
• tabs: To detect when you are on a supported AI service page.
• identity: To support Google sign-in for authentication.
• downloads: To save exported conversation files to your computer.
• Host access: To chatgpt.com, chat.openai.com, claude.ai, gemini.google.com, and copilot.microsoft.com -- required to read your conversation data from these services.

9. Chrome Web Store Limited Use compliance

ChatShift's use of information received from Chrome APIs adheres to the Chrome Web Store's Limited Use requirements, including the following:

• We only request permissions that are necessary for ChatShift's core functionality.
• We do not transfer data obtained through Chrome APIs to third parties except as necessary to provide the service, comply with applicable laws, or as part of a merger or acquisition with adequate notice to users.
• We do not use data obtained through Chrome APIs for serving advertisements or for purposes unrelated to the extension's single purpose.
• We do not allow humans to read user data unless the user provides affirmative consent, it is necessary for security purposes, or it is required by law.

10. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected.

Data type	Retention period
Conversation data (local)	Until you clear your browser storage or uninstall the extension
Account data	1 year from last use, then deleted
Payment records	6 years (HMRC requirements)
Support correspondence	2 years from last contact
Marketing suppression list	Ongoing (to honour your opt-out preference)

11. Data security

We take appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS) and at rest
• Strict access controls limiting who can access personal data
• Use of reputable, certified third-party infrastructure providers

12. Your rights

Under applicable data protection law, you may have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate personal data.
• Erasure: Ask us to delete your personal data.
• Restriction: Ask us to restrict how we use your personal data.
• Portability: Request your personal data in a structured, machine-readable format.
• Objection: Object to our processing of your personal data where we rely on legitimate interests.
• Withdraw consent: Where we rely on consent, you can withdraw it at any time.
• Automated decisions: We do not make any automated decisions about you that produce legal or similarly significant effects.

To exercise any of these rights, contact us at hello@n90.ai. We will respond within one month (or sooner if required by law).

California residents: If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). We do not sell personal information. To exercise your rights, contact us using the details above.

13. Children's privacy

ChatShift is not directed at children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child below the applicable age, we will take steps to delete that data as soon as possible.

14. How to complain

If you have any concerns about how we handle your personal data, please contact us first at support@chatshift.ai. We will do our best to resolve any issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority if you are located outside the UK.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be reflected in the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

16. Contact us

Data controller: N90 Labs Ltd
Email: hello@n90.ai
Website: chatshift.ai

© 2026 N90 Labs Ltd. All rights reserved.