Privacy Policy

Upperdoc is a business software service operated from Ireland. For the account, website, trial, billing, and support information described below, Upperdoc acts as the data controller.

If a business customer uses Upperdoc to collect documents containing personal information, that customer normally decides why the information is collected and acts as controller. Upperdoc processes that information to provide the service on the customer's behalf.

Privacy questions and requests can be sent to support@upperdoc.io.

• Account and business information: name, work email address, firm name, authentication information, account role, and settings.
• Customer content: client names and contact details, document requests, messages, deadlines, uploaded files, and related activity.
• Booking and communications: meeting details submitted through Calendly, support messages, feedback, and transactional email delivery information.
• Billing information: plan, subscription status, invoices, and payment status. Stripe processes payment card details; Upperdoc does not receive complete card numbers.
• Technical and security information: device and browser information, timestamps, IP-derived security information, audit events, error details, and service logs.

We use information to:

• create accounts, workspaces, document requests, and secure upload links;
• authenticate users and protect the service against misuse;
• deliver requested emails, reminders, bookings, support, and billing;
• operate, troubleshoot, and improve the early-access service;
• comply with legal obligations and establish or defend legal claims.

Our legal bases are performance of a contract, steps requested before entering a contract, our legitimate interests in operating and securing Upperdoc, compliance with legal obligations, and consent where the law specifically requires it.

We use service providers to operate Upperdoc, including Supabase for authentication, database and storage; Vercel for hosting; Cloudflare Turnstile for bot and abuse protection; Resend for transactional email; Calendly for meeting bookings; Stripe for subscriptions and payment processing; and PostHog and Plausible for optional product analytics once analytics have been accepted. These providers process information under their own contractual and privacy terms.

During the current early-access release, production document content is processed only by the service providers listed above. We will update this notice if that processing model changes.

We may disclose information when legally required, to protect users and the service, or as part of a business reorganisation subject to appropriate safeguards. We do not sell personal information.

Some providers may process information outside Ireland or the European Economic Area. Where required, we use provider contractual commitments, adequacy decisions, standard contractual clauses, or another lawful transfer mechanism.

We retain account and customer content while a workspace is active and for a limited period afterwards when reasonably needed to complete deletion, provide support, secure the service, resolve disputes, or comply with law. Backup copies are removed through normal backup rotation.

Billing, security, and transactional records are retained according to the purpose for which they were created and applicable legal requirements. You may request workspace or account deletion by emailing support. We may retain information that must be kept by law or is needed to establish or defend legal claims.

Upperdoc uses strictly necessary browser storage and cookies for authentication, security, bot protection, and interface preferences. Cloudflare Turnstile may process technical information needed to distinguish people from automated abuse. Optional product analytics, including PostHog product analytics and session recording, stay switched off until a user accepts analytics in the consent banner shown in the Upperdoc app. Declining keeps them off, and clearing browser storage brings the banner back so the choice can be changed.

We use access controls, private storage, encryption in transit, authentication, and operational monitoring designed to protect information. No online service can guarantee absolute security. If we identify a personal-data breach, we will investigate it, reduce the risk, document our assessment, and make legally required notifications.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send requests to support@upperdoc.io. We may need to verify your identity. You may also complain to the Irish Data Protection Commission at dataprotection.ie.

Upperdoc is a business service and is not directed to children. Users must be at least 18 and authorised to act for their organisation.

We may update this notice as Upperdoc develops. The date at the top identifies the current version. We will provide reasonable notice of material changes, including by email or within the service where appropriate.