Privacy Policy

Uponco provides software that lets businesses publish their services and locations and accept online and onsite appointments from their customers. For personal data that businesses collect about their own customers through the Service, the business acts as the data controller and Uponco acts as a data processor. For account and platform data described below, Uponco is the data controller.

For any privacy questions or to exercise your rights, contact us at support@uponco.com.

We collect the following categories of personal data:

• Account data. Name, email address, password (stored hashed) and profile details you provide when registering.
• Business data. Company name, branding, locations, services, working hours and team members you configure.
• Booking data. Customer names, contact details, appointment times, service selections and notes submitted through booking pages.
• Technical data. IP address, device and browser information, and log data generated when you use the Service.
• Third-party sign-in. If you sign in with a third-party provider, we receive basic profile information such as your name and email.
• Usage and analytics data. Anonymous, aggregated product-analytics events such as pages viewed and features used, together with the country a visit comes from. This data is not linked to your account or to your identity. See Cookies and analytics.

We process personal data to:

• Provide, operate and maintain the Service;
• Create and manage accounts, teams and business profiles;
• Enable appointment booking and send related confirmations, reminders and generated meeting links;
• Respond to support requests and communicate with you;
• Secure the Service, prevent abuse and comply with legal obligations;
• Improve and develop new features.

Under the GDPR, we rely on the following legal bases for processing:

• Performance of a contract — to provide the Service you or your business sign up for;
• Legitimate interests — to secure, maintain and improve the Service, balanced against your rights;
• Consent — where required, for example for certain communications (which you may withdraw at any time);
• Legal obligation — to comply with applicable law.

The Service does not currently process payments. In the future, Uponco intends to offer subscription-based paid plans. When payment features are introduced, billing will be handled by a third-party payment processor, and this Privacy Policy will be updated to describe how payment-related data is processed. We do not store full card details on our own servers.

We do not sell your personal data. We share it only with:

• The business you book with (and its authorised team members) when you submit a booking;
• Service providers who process data on our behalf, under appropriate data-processing agreements. These currently cover hosting, email delivery, product analytics (PostHog) and Google services described below;
• Google. If a business connects its Google account, we create a Google Meet link for its online bookings using the Google Meet scope; we do not create calendar events, add anything to the business's Google Calendar, or send the appointment details to Google. When a business searches for an address while setting up a location, the text typed into the address field is sent to the Google Places API to return suggestions. If you sign in with Google, Google processes that sign-in;
• Authorities or third parties where required by law or to protect our rights and the safety of users.

Uponco's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Uponco only accesses the Google Meet scope (meetings.space.created) to create a Google Meet link on a connected account; we do not use this data for advertising, do not sell it, and do not transfer it to others except as needed to provide or improve this feature, to comply with the law, or as part of a merger or acquisition.

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or transfers to countries with an adequacy decision.

We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes. Account and business data is kept while your account is active; you may request deletion as described below. Booking data is stored by us on behalf of the business you booked with and is kept for as long as that business keeps its account and its own retention settings require, so requests to delete a booking are decided by that business. We may keep limited records longer where the law requires it.

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact support@uponco.com. If your data was submitted to a business through a booking, please also contact that business directly.

We use appropriate technical and organisational measures — including encryption in transit, hashed passwords and access controls — to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use strictly necessary cookies to keep you signed in and to operate the Service securely. These are set without consent because the Service cannot work without them.

We also use a product-analytics service, PostHog, to understand how the Service is used and to improve it. PostHog processes data on our behalf as a processor, on servers located in the European Union. It records anonymous events such as page views and the pages and features that are used. On public booking pages it also records which business the page belongs to.

Our analytics is deliberately anonymous. It does not set any cookie or store an identifier on your device, and it is not linked to your account, so we cannot recognise you or tell when the same person returns. Because no analytics cookie is used and no personal data is stored, no cookie consent banner is required. We derive the country a visit comes from the network connection to produce country-level statistics, and the underlying IP address is discarded and not stored.

We do not use cookies for advertising and we do not run advertising or cross-site tracking networks.

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email, and the “Last updated” date above will reflect the latest revision.

If you have questions about this Privacy Policy or how we handle your data, contact us at support@uponco.com.