Privacy Policy

Draft — last updated 6 August 2026. Not yet finalised.

Note to self (Benji): [TODO] Build an actual "delete my account and data" flow before this goes live — right now this policy promises deletion on request, but there's no button for it yet, so requests would have to be handled manually via email.

1. Who we are

Upo is operated by Reeksy Websites (ABN 80 653 802 927), Sydney, Australia. This policy explains what data Upo collects, why, and how it's handled.

2. Information we collect

Account information: your email address, a securely hashed password (we never store your actual password), and business name if you provide one.
Content you create: calendar events, clients, notes, to-dos, meetings, invoices, expenses, drafts, dashboard layout, and your chat history with Upo.
Voice input: if you use voice, your speech is transcribed by your browser (or, where enabled, sent to ElevenLabs for voice output). We don't currently store raw audio recordings.
Marketing preference: whether you opted in to receive product emails.

3. How we use it

We use your data to operate Upo for you — storing your business information, answering your questions, and carrying out actions you ask the AI assistant to perform (creating events, adding clients, and so on). We do not sell your data.

4. AI processing and third parties

To answer you or take an action, relevant parts of your conversation and account data are sent to Anthropic (which provides the Claude AI model powering Upo) for processing. If you use voice output, text is sent to ElevenLabs to generate speech. Your data is stored using Cloudflare (D1 database and Pages hosting). These providers process data on our behalf under their own data-handling terms; we choose providers with reasonable security practices, but you should know your data leaves our direct control to make Upo work.

5. Data storage and security

Passwords are hashed (never stored in plain text) before being saved. Login sessions use secure, HttpOnly cookies. Your account data is stored in a database scoped to your account only — other users cannot see it.

6. Data retention and deletion

[TODO] There's no self-serve deletion button yet. For now, email us and we'll delete your account and associated data manually.

We keep your data for as long as your account is active. You can request deletion of your account and all associated data at any time by contacting us.

7. Marketing communications

We'll only send you marketing emails if you opted in at signup. You can unsubscribe at any time via the link in those emails, or by contacting us directly.

8. Cookies and local storage

Upo uses a session cookie to keep you logged in, and your browser's local storage as a temporary offline cache of your data. Neither is used for advertising or tracking across other websites.

9. Children's privacy

Upo is not intended for anyone under 18. We don't knowingly collect data from children.

10. Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Contact us to make any of these requests.

11. International data transfers

Because we rely on providers like Anthropic and Cloudflare, your data may be processed on servers outside Australia, including in the United States.

12. Changes to this policy

We'll update this policy as Upo develops and will flag material changes in-app.

13. Contact

Questions or requests about your data: benjirmedia@gmail.com