Privacy policy
Last updated 7 September 2026. The controller is Cameron Shields, trading as ShareShift, United Kingdom.
The short version
We hold the minimum needed to sell and license software: who you are, what you bought, and which machines run it. We never hold the content you migrate. We do not sell or share personal data for advertising.
What we collect and why
| Data | Source | Purpose and legal basis | Kept |
|---|---|---|---|
| Name, email, sign-in identifier | You, via sign-in | Run your account and portal (contract) | Life of the account plus 6 years for tax records |
| Billing address, VAT number, payment status | Stripe checkout | Take payment, issue invoices, tax (contract, legal obligation). Card numbers are held by Stripe, never by us | 6 years |
| Licence key (hashed), plan, expiry, audit trail of licence actions | Our licence server | Enforce the licence, investigate disputes (contract, legitimate interest) | Life of the account plus 2 years |
| Worker machine name, OS, app version, destination tenant id, aggregate migration counters, heartbeat times | The ShareShift worker | Count licensed workers and show you usage in the portal (contract) | 90 days after the lease ends |
| Support emails and attached log bundles | You | Resolve your request (contract). Log bundles contain local run logs; do not attach content | 2 years |
| Website server logs (IP, user agent, pages) | Hosting provider | Security and error diagnosis (legitimate interest) | 30 days |
What we do not collect
The files, folders, list items, versions, permissions, user identities and messages you migrate. They move directly between your Microsoft 365 tenants and never reach us. See the security page.
Who we share it with
Stripe (payments and tax, USA and Ireland), Auth0 by Okta (sign-in), Resend (transactional email), Vercel (website hosting) and Microsoft Azure UK South (licence server). Each acts as our processor under its own terms. We disclose data to authorities only where the law requires.
Transfers
Some of these providers process data in the United States under the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.
Your rights
You can access, correct, export or delete your account data, or object to processing, by emailing shareshift@cameronshields.co.uk. Deleting an account revokes its licences. You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with our response.
Cookies
The site uses a sign-in session cookie, a cookie that remembers your chosen currency, and nothing for advertising or cross-site tracking.