Last updated: 2026-09-03.
This Privacy Policy explains what personal information Upivia (“we”) collects, how we use it, and your rights.
1. Information we collect. (a) Account data: email, name, hashed password, organization name. (b) Usage data: requests your agents make, costs, audit logs, IP address, browser metadata. (c) Billing data: handled by Stripe; we store only the last four digits of payment instruments.
2. How we use it. To operate the Service, enforce budgets/policies, bill usage, prevent abuse, communicate with you about your account, and improve the product.
3. Sharing. We share data with subprocessors necessary to operate the Service: Stripe (payments), Resend (transactional email), OpenRouter and other AI providers you enable, plus our hosting provider. We do not sell personal data.
4. Retention. Account data is retained while your account is active. Audit logs are retained per your plan (7 / 30 / 90 days). On account deletion, personal data is purged within 30 days unless retention is required by law.
5. Your rights. You may export or delete your account data from Settings → Data Export and Settings → Danger Zone. Depending on where you live, you may have rights to access, correct, delete, receive, or restrict the use of personal information. U.S. state privacy rights may include California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other applicable state laws. Canadian privacy rights may arise under PIPEDA and applicable provincial laws, including Quebec Law 25 and substantially similar provincial statutes. Email privacy@upivia.com to exercise them.
6. Security. Passwords are bcrypt-hashed. Connected-app tokens are encrypted at rest. API keys are stored as SHA-256 hashes. All traffic is TLS.
7. North American processing and international transfers. Data may be processed in the United States, Canada, and by service providers in other countries. We use contractual, technical, and organizational safeguards appropriate to the transfer. Canadian users acknowledge that information may be accessible to lawful authorities in the country where it is processed.
8. Children. The Service is not directed to children under 16; we do not knowingly collect their data.
9. Changes. We will notify you of material changes at least 14 days before they take effect.
Contact: privacy@upivia.com