UserGems Privacy Notice

Last modified: November 3, 2026

This Privacy Notice explains how UserGems collects, uses, discloses and otherwise processes information relating to an identified or identifiable natural person ("personal information") in connection with our website and services, and the rights and choices you have. It applies where UserGems decides how and why personal information is processed (as a "data controller" or "business"). It also explains how we collect business contact information that we process on behalf of our customers, and how you can ask us to delete it.

"UserGems", "we", "us" and "our" mean ShelfFlip, Inc. dba UserGems.

Never heard of us? If you have not interacted with UserGems, a UserGems customer may have asked us to collect or verify business contact information about you, such as your current employer and job title, or we may have researched your professional contact information for UserGems' own sales and marketing. Section 2.C explains what we collect and where from. To have it removed, go to usergems.com/privacy-request or email privacy@usergems.com.

We review this notice at least once every 12 months and post any changes on this page. Where appropriate, we give reasonable notice of material changes before they take effect.

Contents

  1. Scope
  2. Personal information we collect and how we collect it
  3. How we use personal information
  4. Who we share personal information with
  5. Processing overview and legal bases
  6. Retention
  7. Security
  8. Your choices and how to be removed
  9. Additional notice for California residents
  10. Data broker registration and DROP
  11. Additional notice for residents of other US states
  12. Additional notice for residents of the EEA, UK and Switzerland
  13. Children
  14. Contact us

1. Scope

UserGems as a data controller. UserGems is the data controller for personal information we collect for our own purposes, such as when you sign up for an account, visit our Website or receive our marketing, and for business contact information we research for our own sales and marketing (see Section 2.C). For these purposes, the data controller is ShelfFlip, Inc. dba UserGems, Attn: Privacy Officer, 2443 Fillmore Street #380-3416, San Francisco, CA 94115, privacy@usergems.com. We do not sell this information.

"Services" means the UserGems platform, including our Data Agents (Signals, Research, and Account & Contact Discovery), Intelligence Agents (Scoring, Personalization, Workflows and Advertising), the Gem-E AI agents, the AI Chrome Extension, and the UserGems MCP, which lets customers access the platform from AI interfaces such as Claude or ChatGPT. "Website" means https://www.usergems.com/, its subsites, and any other site that links to this notice.

UserGems as a data processor. Customers tell us which contacts, companies or types of roles they want us to research, verify or monitor, for example contacts whose job changes they want to track. Acting on their documented instructions, we collect and verify relevant professional information from the sources described in Section 2.C and report it to the requesting customer. For this processing, the customer is the data controller and UserGems is its data processor or "service provider". We do not supply records from an independently maintained contact database, we do not sell this information, and we do not use it for UserGems' own advertising. We process and retain it in line with the customer agreement and data processing agreement. When customers use our Advertising agent, we transfer the audiences they select to the advertising platforms they choose, on their instructions. Content customers put into the Services, including our AI features, is processed on their behalf under our customer agreements and data processing agreement. Because many people we collect information about have never interacted with us, this notice still explains what we collect, where it comes from, and how you can ask us to delete it. For how a customer uses your information, the customer's privacy notice applies.

Third-party services. The Services integrate with third-party services, and the Website may link to third-party websites. This notice does not apply to them. Please review their privacy notices.

2. Personal information we collect and how we collect it

A. Information you provide

  • Account and profile information: email address, name and company name when you register.
  • Payment and transaction information: payments are handled by third-party processors. We receive only the last 4 digits of the card number and transaction details. For custom billing we may also collect the account contact's name, email, job title, company and address.
  • Communications: name, email address, type of inquiry and anything else you choose to share when you contact us, including support and demo requests.
  • Events, surveys, feedback and promotions (including webinars and training): name, email, phone number, company, job title, office address and anything else you provide.
  • Quotes and customer stories: name, title, company, picture, the content of your quote and any additional details you share, such as ROI results.

B. Information collected automatically

We and our providers collect the following when you use the Website or Services or interact with our emails, subject to your consent where the law requires it:

  • Log data: IP address, operating system, browser details, unique identifiers, device type and version, referring URL, date and time of use, time spent, and errors.
  • Analytics data: your path to, through and out of the Website or Services, UTM source, time zone, first and last active times, and usage history. We use Amplitude, a third-party analytics provider, to collect and analyze how people use the Services.
  • Location data: approximate location estimated from your IP address.
  • Live chat: information you choose to provide.
  • Cookies and similar technologies: see our Cookie Notice.

C. Business contact information processed on behalf of customers

Customers identify the contacts, companies or roles they want us to research, verify or monitor. To carry out their instructions, we collect and update relevant professional information from these sources:

  • Public professional profiles, such as LinkedIn: full name, business title, department, current and past employers, and employment start and end dates for up to the last seven years, and the profile URL. We also record the number of connections, only to detect fake profiles; it is never provided to customers. From these profiles, we collect only information the individual has made publicly visible. We do not collect non-public information, including contact details a person has limited to their own network.
  • Company websites: name, business title, employer and business contact details published by an employer or organization.
  • Web search: to find public professional profiles and to validate information collected for the customer's request.
  • Third-party data providers: information we obtain through the API of data providers such as Five by Five when a customer's request requires it. This includes contact information (name, business title, employer, work email address, phone number and LinkedIn profile URL), online identifiers (IP addresses and device IDs), and signals about professionals: contact-level intent, meaning topics a person appears to be researching online, and website visits linked to a person, including the pages visited and when. We do not contribute data to these providers.

We may infer a person's work email address from their employer's publicly used email format and check that it can receive email. From the information above, we also derive a person's likely seniority and a score of how relevant they are to the requesting customer's offering, and provide these to that customer.

Customer-selected enrichment providers. Customers can choose third-party data providers in their UserGems settings to find or verify work email addresses and phone numbers. When they do, we query those providers on the customer's behalf and deliver the results to that customer only. The provider's own privacy notice governs its data.

UserGems' own marketing. UserGems also uses its own Services for its own sales and marketing, in the same way a customer would. For this, UserGems is the data controller. We research business contact information about professionals at companies we want to reach, using the sources listed above, and use it to contact them and to build advertising audiences, such as names and hashed work email addresses, that we send to LinkedIn. For prospects in the United States, we also use contact-level intent and website-visit signals from data providers such as Five by Five to decide whom to contact or advertise to. We do not use these signals for people in the EEA, UK or Switzerland. We collect this information separately, for UserGems only. It never includes information customers give us or information we collect on customers' behalf.

We do not collect special categories of personal data, such as information about racial or ethnic origin, religion, health or sexual orientation, or other data such as government ID numbers, financial account details or precise geolocation, for this processing. We do not knowingly collect information about anyone under 16.

3. How we use personal information

  • To provide the Services, including researching, verifying and monitoring the contacts customers ask about and reporting employment changes and related signals to them, through the platform, integrations and the UserGems MCP.
  • To provide business contact information to our customers, on their behalf and under their instructions, so they can identify and contact potential business partners.
  • To keep the information about the contacts each customer asks us to track accurate and up to date.
  • To honor deletion and opt-out requests, including maintaining a suppression list so removed information is not collected again.
  • For account and contract management, including customer support.
  • To communicate with you by email, text message, social media or telephone.
  • To market our Services, including contacting and advertising to professionals at companies we want to reach and, for US prospects, prioritizing them based on interest signals.
  • To process payments.
  • To operate, test, secure, monitor and improve the Website and Services.
  • To enforce our Terms, resolve disputes, and protect our rights and those of others.
  • To prevent, investigate or report fraud or unlawful activity.
  • To comply with legal obligations.

We do not use personal information to make decisions that produce legal or similarly significant effects about individuals.

UserGems' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who we share personal information with

  • Customers: we provide business contact information to subscription customers as their service provider, for their use under our contract. We do not sell personal information.
  • Advertising platforms: when customers use our Advertising agent, we send the audiences they choose, such as names and hashed work email addresses, to platforms like LinkedIn, Meta and Google Ads on the customer's instructions. For UserGems' own advertising, we send audiences we build for ourselves (see Section 2.C), such as names and hashed work email addresses, to LinkedIn. These audiences never include information customers give us or information we collect for customers. People on our suppression list are excluded from our own audiences.
  • Data processors and service providers: such as hosting, payment, support and technology providers, bound by confidentiality and data processing terms. Professional advisers such as lawyers and accountants may act as independent data controllers.
  • Corporate transactions: in a merger, acquisition, financing, sale of assets, bankruptcy or similar transaction. We will use reasonable efforts to ensure transferred information is treated consistently with this notice.
  • Legal obligations and rights: to regulators, law enforcement, courts and advisers where we reasonably believe it is necessary to comply with law or legal process, to establish, exercise or defend legal claims, to enforce our agreements, or to protect the rights, property or safety of UserGems or others, including fraud prevention.
  • With your consent or at your direction: for example, publishing your quote on our Website.

5. Processing overview and legal bases

When you subscribe to the Services, we need the items marked * to provide them. If you don't provide them, we can't provide the Services. The last column applies to residents of the EEA, UK and Switzerland.

Processing
Categories of personal information
How we use it
Legal basis (EEA, UK, Switzerland)
Account creation and profile
Email*, password*, name*, company, access tokens for connected tools (e.g. Salesforce, Outreach)
Create and maintain your account
Performance of a contract; or our legitimate interest in serving your employer where the contract is with them
Contract data from your employer
Name*, job title, email*, signature
Create and maintain user accounts
Our legitimate interest in performing the Services for your employer
Payment and transactions
Last 4 card digits*, transaction details; for custom billing, account contact name*, email*, job title*, company, address
Process payments
Performance of a contract
Communications with us
Name*, contact details*, inquiry details*
Respond to your inquiry and provide support
Our legitimate interest in answering requests; or steps prior to a contract
Marketing
Name*, contact details*
Tell you about our products and services
Your consent; or our legitimate interest in marketing similar services to customers
Advertising audiences
Name, hashed work email address, employer
Send audiences to advertising platforms such as LinkedIn, Meta and Google Ads, for our customers' campaigns and for our own
For customers' campaigns: processing on the customer's instructions. For our own campaigns, using business contact information we research for ourselves: our legitimate interest in marketing our Services, or your consent where required
UserGems' own prospect research and outreach
Name, business title, employer, work email address, phone number, LinkedIn profile URL; for US prospects only, also IP addresses, device IDs, contact-level intent and website visits
Find and verify professionals at companies we want to reach; for US prospects, prioritize them based on interest signals; contact them and build our own LinkedIn audiences
Our legitimate interest in marketing our Services. Where email or other marketing rules require consent, we ask for it. We do not use intent or website-visit signals about people in the EEA, UK or Switzerland.
Customer-directed research and monitoring: public professional profiles
Name, business title, department, current and past employers with dates (up to seven years), profile URL, publicly visible business contact details, number of connections (used only to detect fake profiles, never provided to customers)
Research, verify and monitor the contacts a customer asks about, and report results to that customer, including through the UserGems MCP
Processing on the customer's documented instructions as its data processor; the customer determines the legal basis
Customer-directed research and monitoring: company websites, web search and third-party data providers
Name, business title, employer, business contact details, LinkedIn URL, IP addresses and device IDs, employment history, contact-level intent and website visit signals (pages visited and timestamps)
Same as above; validate information from other sources
Processing on the customer's documented instructions as its data processor; the customer determines the legal basis
Combination and validation of the above
All of the above
Combine and validate information for each contact a customer asks about; derive seniority and relevance scores for that customer
Processing on the customer's documented instructions as its data processor; the customer determines the legal basis
Suppression list
Minimum identifiers needed to recognize you, such as a hashed email address
Make sure removed information is not collected or provided again
Compliance with a legal obligation; our legitimate interest in honoring your request
Log data (Services and Website)
IP address*, operating system*, browser details*, referring URL, usage times, errors, approximate location
Provide the Services and Website; find errors; prevent fraud and abuse
Our legitimate interest in providing a functioning, secure service
Analytics (Services)
Path through the Services, UTM source, time zone, activity and usage history
Improve the Services; prevent abuse
Our legitimate interest in improving the Services
Events, surveys, feedback and promotions
Name*, contact details, company, job title, office address, anything you provide
Run events and promotions; improve our offering
Your consent
Demo requests and video demos
Name, email, anything you provide
Show you a relevant product demonstration
Your consent (demo call); our legitimate interest (video demo)
Quotes and customer stories
Name, title, company, picture, quote, additional details you share
Publish customer experiences on our Website
Your consent
Live chat
Name, email, anything you provide
Offer direct contact with our team
Our legitimate interest in offering a contact channel
Podcast player
Browser plug-ins and versions, log data
Let you listen to our podcast on the Website
Our legitimate interest in offering this feature
Court orders and authority requests
Name; other content case by case
Comply with the request
Compliance with a legal obligation
Litigation and enforcement of rights
Name; other content case by case
Defend or enforce our rights
Our legitimate interest in defending or enforcing our rights

6. Retention

We keep personal information only as long as needed for the purposes above, unless we must keep it longer to comply with law, resolve disputes or enforce our agreements. We may keep de-identified, aggregated data for internal analysis.

Category
Retention period
Account, contract and payment data
Duration of the contract, plus the applicable statute of limitations or legal retention period
Business contact information processed for customers
In line with the customer's documented instructions and the applicable customer agreement and data processing agreement. When the processing ends, we delete or return the information as those agreements and applicable law provide. Backup copies are deleted on our backup deletion schedule. You can also ask us to remove it sooner (Section 8).
Suppression list
As long as needed to keep honoring your request
Communications and support
Up to 3 years after the last interaction
Marketing data, including business contact information we research for our own marketing
Until you unsubscribe, object or withdraw consent. Otherwise, until 24 months after we last verified both that the information is up to date and that we still have a reason to market to you
Log and analytics data
Up to 3 years
Data under legal hold
Until the claim or threat of claim is resolved

7. Security

We maintain administrative, technical and physical safeguards designed to protect the security, confidentiality and integrity of personal information, and we have completed a SOC 2 Type II examination. Information you enter on our Website is encrypted in transit using TLS. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your choices and how to be removed

Remove your information from UserGems. Anyone, wherever they live, can ask us to remove their information from UserGems:

You don't need an account. When we process a removal request, we (1) add minimum identifiers to our suppression list, so we stop researching, enriching and delivering information about you for every customer, including through the UserGems MCP, and exclude you from UserGems' own marketing; (2) delete the information about you that we hold in UserGems, subject to legal retention requirements; and (3) remove you from advertising audiences UserGems has already uploaded for its own marketing. Information we already delivered to a customer is in that customer's own systems, and we cannot delete it there. Where the law requires, we notify relevant recipients of your request, and for information we process on a customer's behalf, we help that customer handle the request under our data processing agreement. You may also contact the customer directly. We complete opt-out requests within 15 business days and other requests within 45 days, or sooner where the law requires.

Other rights. You can also ask to access, correct or receive a copy of your personal information using the same routes. Region-specific rights are described in Sections 9 to 12. We may ask for information to verify your identity, except for opt-out requests, which need no verification.

Email communications. Use the unsubscribe link in any marketing email. You can't unsubscribe from service-related messages such as account verification, transaction confirmations and legal notices.

Account information. If you have an account, you can update some details in your profile settings.

9. Additional notice for California residents

This section supplements the rest of this notice for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). Terms have the meanings given in the CCPA.

A. Categories collected and sources in the last 12 months

Category
Examples
Sources
Provided to customers?
Identifiers
Name, work email address, phone number, LinkedIn profile URL, IP addresses, device IDs
You; public professional profiles; company websites; web search; third-party data providers; your device
Yes (except IP addresses and device IDs)
Professional or employment information
Employer, business title, department, employment history
You; public professional profiles; company websites; web search; third-party data providers
Yes
Inferences
Likely seniority; relevance scores for a customer's offering
Derived from the above
Yes
Commercial information
Services purchased or considered
You
No
Internet or network activity
Log and analytics data
Your browser or device
No
Internet or network activity (signals)
Contact-level intent topics; website visits linked to a person, including page URLs and timestamps
Third-party data providers
Yes
Approximate geolocation
Location estimated from IP address
Your browser or device
No

Account login credentials. We collect your email address and password for your UserGems account, and access tokens for tools you connect. The CCPA classifies this kind of login information as "sensitive personal information", and it is the only information in that CCPA category that we collect. We use it only to authenticate you, secure your account and run the integrations you set up, so the right to limit its use does not apply. This is a California term and is separate from the special categories of personal data under Article 9 GDPR, which we do not collect.

B. Disclosure for business purposes. In the last 12 months we disclosed, for a business purpose: all categories above to our service providers (hosting, support and technology providers) and professional advisers; identifiers and internet or network activity to analytics providers such as Amplitude; and the categories marked "Yes" above to the customers that requested them. For UserGems' own marketing, we shared names and hashed work email addresses with LinkedIn (see C below).

C. Sale and sharing. We do not sell personal information, and we have not sold personal information in the last 12 months. We collect and provide the categories marked above on the instructions of the customer that requested them. We "share" personal information with advertising platforms for cross-context behavioral advertising: identifiers and internet activity collected by cookies on our Website, and audiences of business contacts UserGems researches for its own advertising (see Section 2.C). When customers use our Advertising agent, we send their chosen audiences to advertising platforms on their instructions. We do not knowingly share personal information of consumers under 16. If we decide to sell personal information in the future, we will update this notice before we start, and you will be able to opt out.

D. Your rights. Subject to legal exceptions, you have the right to:

  • Know what personal information we collected, used and disclosed about you, and the specific pieces we hold.
  • Delete personal information we hold about you.
  • Correct inaccurate personal information.
  • Receive a portable copy of your personal information.
  • Opt out of sharing for cross-context behavioral advertising, and of any future sale of your personal information.
  • Not be discriminated against for exercising these rights.

E. How to exercise your rights. Use usergems.com/privacy-request, email privacy@usergems.com with the subject "Privacy Request", or call 415 917 7944. To opt out of sharing, you can also use the Do Not Sell or Share My Personal Information link in our Website footer, which goes to the same request page.

We honor Global Privacy Control signals as a request to opt out of sharing, and of any future sale. We apply the opt-out to the browser or device that sends the signal and to any profiles associated with that browser or device, including pseudonymous profiles. Where we know who you are, we also apply it to your account and other linked personal information. See globalprivacycontrol.org.

For requests to know, delete or correct, we verify your identity by matching information you give us with information we hold, which may include your name and work email address. Opt-out requests need no verification. If we can't verify a request or find your information, or if an exception applies, we will tell you why.

F. Authorized agents. You may use an authorized agent. The agent must provide your signed permission or a valid power of attorney. We may confirm directly with you that you gave permission.

G. Shine the Light. California residents with an established business relationship with us may ask how we disclose their information to third parties for those parties' direct marketing purposes (Cal. Civ. Code 1798.83).

H. Request metrics. Our metrics for requests received in the previous calendar year are available on our Privacy Request Metrics page.

10. Data broker registration and DROP

UserGems is registered as a data broker with the California Privacy Protection Agency. In our registration, we stated that we do not currently sell personal information.

California residents can ask every registered data broker, including UserGems, to delete their information in a single request through the Delete Request and Opt-out Platform (DROP) at privacy.ca.gov. We retrieve and process DROP requests at least every 45 days. After processing, we add minimum identifiers to our suppression list so the information is not collected again.

11. Additional notice for residents of other US states

Nevada. We do not sell covered information as defined by Nevada law. You can still send an opt-out request to privacy@usergems.com, and we will honor it if that changes.

Other states. Where the law of your state gives you privacy rights, including rights to access, correct, delete or opt out, you can exercise them through the routes in Section 8. If we deny your request, you may appeal by replying to our decision or emailing privacy@usergems.com with the subject "Appeal". If you are not satisfied with the outcome, you may contact your state attorney general.

12. Additional notice for residents of the EEA, UK and Switzerland

A. Contact details. Our data protection officer is reachable at the address in Section 1 or at privacy@usergems.com. Our representative in the EU and UK under Article 27 GDPR is Mr. Stephan Kletzl, Irrsdorfer Bachstrasse 48, 5204 Strasswalchen, Austria, privacy@usergems.com.

B. Legal bases. For processing we carry out for our own purposes, we rely on the legal bases listed in Section 5: performance of a contract, our legitimate interests, your consent, and compliance with legal obligations. Where we rely on legitimate interests, we have balanced them against your rights and freedoms, and you can ask us for more information about that assessment. For processing we carry out on a customer's behalf, the customer is the controller and determines the legal basis.

C. Information we did not collect from you. If a customer asked us to collect or verify your business contact information, that customer is the controller and is responsible for informing you under Article 14 GDPR. We help customers meet that obligation, and this notice describes how we carry out that processing. For business contact information we obtain for UserGems' own sales and marketing (see Section 2.C), UserGems is the controller. We give you the information required by Article 14 GDPR within a reasonable period and no later than one month after obtaining it, and in any case before we first contact you or add you to an advertising audience. We do not use intent or website-visit signals about people in the EEA, UK or Switzerland.

D. Your right to object. You can object at any time to processing based on our legitimate interests, including our own marketing and advertising. If you object, we will stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, and we will stop. For information we process on a customer's behalf, you can object to that customer, or ask us for removal through the routes in Section 8, which stops our processing of your information for every customer.

E. Other rights. You have the right to access, rectify, erase, restrict and port your personal data, and to withdraw consent at any time without affecting earlier processing. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

F. International transfers. We are based in the United States, and personal data is processed there. For transfers from the EEA we rely on the European Commission's Standard Contractual Clauses. For the UK we rely on the UK International Data Transfer Addendum, and for Switzerland on the Standard Contractual Clauses as recognized by the Swiss Federal Data Protection and Information Commissioner. Contact us for a copy of the relevant safeguards.

G. Complaints. You can complain to your local data protection authority (EEA list), the UK Information Commissioner's Office (ico.org.uk) or the Swiss FDPIC (edoeb.admin.ch). We'd appreciate the chance to address your concern first at privacy@usergems.com.

To exercise any right, use the routes in Section 8. We may ask for proof of identity.

13. Children

Our Website and Services are for business use and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact privacy@usergems.com and we will delete it.

14. Contact us

Questions or concerns about this notice or our privacy practices: privacy@usergems.com, or by mail to ShelfFlip, Inc. dba UserGems, Attn: Privacy Officer, 2443 Fillmore Street #380-3416, San Francisco, CA 94115.