Privacy policy

This explains what UP collects, why, and the choices you have. The controller is [UP operator: legal name, address]. Contact: [privacy email]. [Data protection officer / EU and UK representative, if required.]

What we collect

• Account: email, optional name, country and language, a scrambled (scrypt) form of your password, your settings, your plan.
• Chats: what you ask and UP’s answers, saved to your account so you can see them again.
• Answer records: which tools ran, whether checks passed, timings, and your feedback. Emails and long numbers (like card numbers) are removed before they are stored.
• Payments: handled by Stripe or Apple. We receive whether your subscription is active and when it renews, never your card number.
• Technical: one essential sign-in cookie (“up_session”) and basic logs needed to run and protect the service. No advertising or tracking cookies.

Why we use it (legal bases)

• To provide UP and your account: contract.
• To keep UP safe and secure, prevent abuse and fix faults: legitimate interests.
• To improve UP’s own models from your rated answers and tool records: your choice, through the “help UP learn” setting (consent). You can turn it off at any time; it then stops for new chats.
• To meet legal duties such as tax records for payments: legal obligation.

Health and crisis conversations

When UP’s safety screen sees that someone may be at risk (for example thoughts of suicide, abuse, or a medical emergency) it responds with safety information. The words of those conversations are never used to train models; only that the safety layer ran is recorded.

Who we share with

Service providers that run UP for us under contract (hosting, GPU compute, email, payments: [list providers and locations before launch]). We do not sell personal data. We share data with authorities only when the law requires it.

International transfers

Where data leaves the UK or EU, we use adequacy decisions or standard contractual clauses. [Confirm hosting regions before launch.]

How long we keep it

• Account and chats: until you delete them or the account.
• Answer records used for training: up to [24] months, without your email.
• Payment records: as long as tax law requires (often 6 years).
• Security logs: up to [90] days.

Your rights

You can see, correct, download and delete your data. Download and delete are on your account page (in the app). You can also object, restrict processing and withdraw consent. You can complain to your data protection authority (in the UK, the ICO). Residents of California and other US states have similar rights to know, delete and opt out of sale (we do not sell data).

Children

UP is for people aged 13 and over (16 where a country requires it, unless a parent agrees). If you think a child has given us data, contact us and we will delete it.

Changes

We will show the date of the current version and tell you about material changes.