UpperCloud — Privacy Policy

Last updated: [EFFECTIVE DATE]

This Privacy Policy explains how UpperCloud ("we," "us"), 2384 Anita Ave, Sacramento, CA 95822, handles information for our website-subscription service and customer portal (the "Service"). It covers our customers and portal users. (Each customer's published website has its own visitor-facing privacy notice; this policy is about the portal and account relationship.)

1. Information we collect

• Business information — your business name, address, phone, website, and publicly available listing details used to build and personalize your Site.
• Account & contact data — owner name and email address; magic-link login records.
• Payment data — handled by Stripe. We receive limited billing details (e.g., subscription status, last four digits, billing email); we do not store full card numbers.
• Change-request & chat data — the messages you send the in-portal assistant and the text/image changes you request, including images you upload.
• Technical/usage data — IP address, device/browser, and basic event logs needed to operate and secure the Service.

2. How we use it

To create, publish, host, and maintain your Site; to apply requested changes; to authenticate you; to process subscriptions and send transactional email (login links, receipts, "your changes are live"); to provide support; to prevent abuse and secure the Service; and to comply with law. We send cold outreach only to businesses identified from public listings, always with a working unsubscribe and our physical address, and we honor opt-outs.

3. How we share it (service providers)

We share information only with vendors that help us run the Service, under contracts limiting their use to that purpose:

• Vercel — hosting, database (Postgres), and file storage (Blob).
• Stripe — payments and subscription billing.
• Mailjet — sending email.
• Google — business listing/photos data and the operator's spreadsheet system of record.
• Anthropic — powers the in-portal assistant; chat messages are processed to generate replies. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may disclose information to comply with law or protect rights, and as part of a business transfer.

4. Cookies

We use a small number of strictly necessary cookies (e.g., your login session). We do not use advertising cookies. Where required, the published customer Sites present their own cookie choices.

5. Data retention

We keep account, subscription, and Site data while your subscription is active and as needed for legal, accounting, and security purposes. After cancellation, Site content is available for export for 30 days, after which we may delete it. Chat and change-request logs are retained for a reasonable period to support the Service and then deleted or de-identified.

6. Security

We use reasonable technical and organizational measures (encryption in transit, access controls, server-side-only access to the database, signed sessions). No method is perfectly secure; we cannot guarantee absolute security.

7. Your rights & choices ("Your Privacy Choices")

Notice at collection. We collect the account and business details you provide, basic technical and usage data needed to run and secure the Service, and analytics on your published Site that are cookieless (no cross-site tracking, no advertising identifiers). We use this to operate, improve, and secure the Service. We do not sell or share your personal information (as those terms are defined under the CCPA/CPRA), and we do not use it for cross-context behavioral advertising.

Depending on where you live (including under the California Consumer Privacy Act / CPRA), you may have rights to know/access, delete, correct, and opt out of sale or sharing of your personal information, and not to be discriminated against for exercising them. Because we do not sell or share it, there is nothing to opt out of in that respect — but you can still request access, correction, or deletion. To exercise any right: if you have an account, open a request under Support in your dashboard; or email build@uppercloud.com. We will verify your request and respond within the timeframes required by law. You can unsubscribe from outreach via the link in any such email.

8. Children

The Service is for businesses and is not directed to children under 16; we do not knowingly collect their information.

9. Changes

We may update this policy; material changes take effect on posting or notice. The "Last updated" date reflects the current version.

10. Contact

UpperCloud — 2384 Anita Ave, Sacramento, CA 95822 — build@uppercloud.com