Privacy Policy

We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679). Below: what data, why, and on what legal basis.

1. Data we collect

• Email address, to create an account and sign in via magic link.
• Profile content, the text, .mhtml, or .pdf you submit for analysis. Processed to generate the audit report and then deleted.
• Teaser profile text, the text you paste into the free instant score teaser without an account. Linked to a hashed IP address to prevent duplicate free runs and enforce daily limits, and automatically deleted after 30 days.
• Payment data, processed exclusively by Stripe. We receive only a transaction confirmation; we never see or store card details.
• Usage data, credit balance and generated reports (stored so you can access report history).
• Technical logs, standard server logs needed to operate and secure the Service.

2. Legal basis and purposes

• Contract performance and pre-contractual steps taken at your request (Art. 6(1)(b) GDPR), account, credits, the free teaser score you can run without an account, audit generation, payment processing.
• Legitimate interest (Art. 6(1)(f) GDPR), fraud prevention, service security.
• Consent (Art. 6(1)(a) GDPR), product analytics (PostHog), processed only after you opt in via the cookie banner.
• Legal obligation (Art. 6(1)(c) GDPR), tax record keeping.

3. Content you submit for the audit

Your profile text or file is passed to Anthropic's AI model to generate the report. Do not upload other people's personal data without a legal basis, and do not include unnecessary sensitive information. Public profile content is enough for the audit.

4. Cookies and analytics

We use strictly necessary cookies for sign-in and session handling; these do not require consent. With your consent, we use PostHog for product analytics through a first-party proxy (/ub-relay); analytics do not run until you accept them in the cookie banner. You can change your choice anytime via "Cookie settings" in the footer. We do not set third-party advertising or tracking cookies.

5. Data retention

Profile content submitted for analysis is deleted after the report is generated. Account data (email, balance, report history) is retained until account deletion. Payment records required for tax purposes are retained for 5 years, counted from the end of the calendar year in which the payment was made, in line with Polish tax law.

6. Data processors

• Supabase, authentication and database (EU region).
• Stripe, payment processing.
• Resend, sending sign-in emails.
• Anthropic, AI model used to generate audit reports.
• PostHog, product analytics (EU), used only with your consent.
• Vercel, hosting infrastructure.

We do not sell or share personal data with advertisers or other third parties.

Some processors may store or process data outside the European Economic Area. Where this happens, the transfer is based on Standard Contractual Clauses approved by the European Commission or another mechanism permitted under Chapter V of the GDPR.

7. Your rights

Under GDPR you have the right to access, rectify, erase, restrict processing of, and port your data, as well as to object to processing. To exercise these rights, contact: support@up-bro.com.

8. Complaints

You may lodge a complaint with the Polish supervisory authority (UODO, uodo.gov.pl) or the supervisory authority in your country of residence.

9. Changes to this policy

We may update this Privacy Policy. The current version is always available on this page with the date of the last update.