Privacy Policy

This Privacy Policy explains how UpstarAI LLC (“we”, “us” or “our”) collects, uses, shares and protects personal data when you use UpstarAI, including https://www.upstarai.com and the dashboard (the “Service”). It is written to meet the requirements of India’s Digital Personal Data Protection Act, 2023 and the rules made under it (the “Act”).

Words such as “Connected Platform”, “Platform Data” and “Workspace” have the meanings given in our Terms of Service.

For account, usage and communications data about the people who use the Service, we decide why and how the data is processed. We are the Data Fiduciary for that data under the Act.

For business information, Platform Data and results in a Workspace, the business that owns the Workspace decides why it uses the Service. We process that data for the business, to provide the Service. The business is responsible for how it uses the data and for any messages it sends to people.

• Account data

  What it includes

  Name, username, email address, password (stored only in hashed form), email verification status and sign-in timestamps.

  Where it comes from

  You, when you register or update your account.

  Why we use it

  Create and secure your account, sign you in and contact you about the Service.

• Organization and team data

  What it includes

  Organization name, your role (owner, admin or member), teammates’ names and email addresses, and invitations you send.

  Where it comes from

  You and the teammates you invite.

  Why we use it

  Provide shared workspaces and control who can see and change what.

• Business profile data

  What it includes

  Business name, description, products or services, ideal customer, brand voice and industry.

  Where it comes from

  You.

  Why we use it

  Tailor lead analysis and suggested messages to your business.

• Connected platform data

  What it includes

  Publicly available social profile data (such as handle, display name, bio, profile and avatar links, verification status and follower counts), content (such as posts, captions, media links and public counts) and interaction data (such as comments, replies and likes). This includes information about people who interact with the profiles you connect.

  Where it comes from

  Connected Platforms and our data collection providers, based on the profiles you choose to connect.

  Why we use it

  Find and understand potential customers and keep your workspace up to date.

• Results and records created in the Service

  What it includes

  People records and notes, relationship stages, intent and lead classifications, scores, explanations, suggested messages, alerts and their status.

  Where it comes from

  Generated by the Service from the data above, and edited by you.

  Why we use it

  Show you who may be ready to buy and what to say to them.

• Usage and technical data

  What it includes

  IP address, browser and device details, pages viewed, timestamps, request and error logs, and diagnostic data.

  Where it comes from

  Your device and our systems, collected automatically.

  Why we use it

  Keep the Service secure, fix problems and monitor performance.

• Communications

  What it includes

  Messages you send us, and service emails we send you such as verification, password reset and invitation emails.

  Where it comes from

  You and us.

  Why we use it

  Respond to you and deliver the Service.

Connected platform data comes from public sources, not from the individuals themselves. It can relate to people other than our users, such as people who comment on or follow a connected profile. We collect only publicly available information and use it to provide the Service to the business that connected the profile.

We do not knowingly ask for sensitive personal data such as health, financial or biometric information, and our Terms prohibit using the Service to target people on sensitive characteristics.

We use personal data to:

• create and run your account, authenticate you and keep it secure;
• collect and refresh Platform Data for the profiles you connect, and analyse it to identify potential customers, score them and explain why;
• raise alerts, show analytics and draft suggested messages;
• send service emails such as verification, password reset and invitations. We do not send marketing email without your consent;
• diagnose problems, monitor performance and improve the Service;
• prevent fraud, abuse and misuse, and enforce our Terms, and meet our legal obligations.

Under the Act we process personal data:

• with your consent, which you give when you create an account or connect a profile and may withdraw at any time (see Your rights);
• for legitimate uses the Act allows, such as when you voluntarily provide data for a purpose you have not objected to, or when we must comply with the law; and
• for personal data that people have made publicly available themselves, in line with how the Act treats such data.

If you withdraw consent, we will stop processing that data for the purpose you withdrew it for, unless the law requires or allows us to continue. This may mean we can no longer provide some or all of the Service.

We use artificial intelligence and automated rules to read text, classify intent, score leads, write explanations and draft suggested messages. To do this we send relevant text and business details to AI model providers who process it for us.

These results are estimates to help a person decide. We do not use them to make decisions that have legal or similarly significant effects on any individual, and a person reviews a suggested message before it is used.

We do not sell personal data. We share it only as described here, and only as much as is needed:

• Your organization. Workspace Data is visible to members of your organization according to their roles.
• Service providers. We use the kinds of providers below to run the Service. They may process personal data only on our instructions and under duties of confidentiality and security.
• Legal and safety. We may disclose data to comply with law or a valid legal request, to protect rights, safety and security, or to investigate misuse.
• Business changes. If we are involved in a merger, acquisition or sale of assets, data may be transferred as part of it, and we will make sure this policy keeps applying or give you notice of changes.

• Data collection providers

  What they do

  Collect publicly available social profile, content and interaction data for the profiles you connect.

  Data involved

  The profile identifiers you connect (for example handles).

• AI model providers

  What they do

  Analyse text, classify intent, score leads and draft suggested messages.

  Data involved

  Text of public content and interactions, and business details you provide such as your description, ideal customer and brand voice.

• Email delivery providers

  What they do

  Send verification, password reset, invitation and service emails.

  Data involved

  Recipient email address and the content of the email.

• Cloud hosting and database providers

  What they do

  Host the Service and store its data.

  Data involved

  All data stored in the Service.

• Background job providers

  What they do

  Run scheduled and asynchronous tasks such as data refreshes and scoring.

  Data involved

  Identifiers and task data needed to run each job.

• Error monitoring, performance and logging providers

  What they do

  Detect and fix errors, and monitor performance and reliability.

  Data involved

  Technical and diagnostic data such as browser details, page addresses, error details and logs. Error monitoring may also record session replays, which show page layout and how you navigated and clicked. On-screen text, form fields and media are masked, and request bodies, cookies, URL query strings and user identifiers are not collected.

Our service providers may process data in India or in other countries. We transfer personal data outside India only as the Act permits, which currently allows transfers to any country or territory except those the Government of India restricts by notification.

We keep personal data only as long as needed for the purposes in this policy, and then delete or anonymise it.

• Account and workspace data

  How long

  Kept while your account is active. After a verified deletion request it is removed from our live systems within 30 days.

• Backups

  How long

  Deleted data can remain in encrypted backups until they are overwritten, which happens within 90 days.

• Connected platform data

  How long

  Stored separately from your workspace records and kept for as long as it remains necessary to provide the Service. It is not removed when you delete a workspace or an account.

• Logs, error reports and session replays

  How long

  Kept for a limited period needed for security and troubleshooting, then deleted or anonymised.

• Verification and password reset links

  How long

  Single-use and short-lived. We store only a hashed form of each link’s token.

• Records the law requires us to keep

  How long

  Kept for as long as the law requires, and used only for that purpose.

See Data Deletion for how to have your data deleted.

We use reasonable security safeguards, including hashed passwords, signed HttpOnly session cookies, protection against forged requests, encryption of sensitive tokens, role-based access within organizations, and encryption in transit. No system is completely secure, so please use a strong, unique password and keep it private.

If a personal data breach affects you, we will notify you and the Data Protection Board of India as the Act requires.

Under the Act, you have the right to:

• Know what personal data of yours we process, the processing activities and who we have shared it with, as the Act provides;
• Correct, complete and update your personal data;
• Erase your personal data, unless we need to keep it for a purpose the law allows;
• Withdraw consent at any time, as easily as you gave it;
• Seek grievance redressal from us, and later from the Data Protection Board of India if you are not satisfied; and
• Nominate another person to exercise these rights if you die or become unable to.

To use a right, email privacy@upstarai.com from the email address registered on your account. We may ask you to verify your identity first. We will respond within 30 days. You can correct most account details yourself in the Service.

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We use only the cookies needed to keep you signed in and secure. Details are in our Cookie Policy.

We also use error monitoring, performance and logging tools. These collect technical data and, in some cases, session replays, which show the layout of the pages you viewed and how you navigated and clicked. On-screen text, form fields and media are masked in replays, and we configure these tools not to collect request bodies, cookies, URL query strings or user identifiers. We use them only to find and fix problems.

We may update this policy as the Service or the law changes. For a material change we will give you at least 14 days’ notice by email or in the Service. The version and date at the top of this page and the revision history below show what changed and when.

For privacy questions, to use your rights, or to raise a grievance, contact Privacy Team:

privacy@upstarai.com
UpstarAI LLC, Indore, Madhya Pradesh, India