Privacy Policy

Last updated: 18 July 2026

This Privacy Notice is issued by Upplio AI ("Upplio", "we", "us"), the seller and operator of the Upplio AI Career Copilot. Upplio AI is the data controller for personal data collected through the Service. We treat your career data as personal and confidential. We do not sell your data and we do not train third-party foundation models on your resume, LinkedIn, or interview content.

1. What we collect

• Account info: email, name, profile photo (when you sign in with Google).
• Career content you upload or paste: resumes, job descriptions, LinkedIn text, STAR stories.
• Usage analytics: pages visited, features used, scores generated — to improve the product.
• Payment info: collected and processed by Razorpay, our payment processor. Upplio never stores full card numbers or bank details.
• Support communications: messages you send us and metadata associated with them.
• Device and log data: IP address, browser, device identifiers, timestamps — used for security and diagnostics.

2. How we use it and legal basis

• Performance of contract: running the features you asked for (scoring, rewriting, matching, mock interviews) and providing your account.
• Legal obligation: tax, accounting and regulatory record-keeping for purchases.
• Legitimate interests: product security, fraud prevention, aggregate quality improvement (never tied to your identity), and transactional emails (sign-in, receipts, account alerts).
• Consent: optional marketing communications and non-essential analytics cookies — you can withdraw consent at any time.

3. Who we share data with

We share personal data only with the following categories of recipients:

• Razorpay Software Private Limited — our payment processor. Razorpay processes card transactions, fraud checks, and refund transmissions on our behalf, and is an independent controller for those activities. See Razorpay's Privacy Policy.
• Cloud and infrastructure providers (hosting, database, storage) acting as processors on our documented instructions.
• AI model providers (e.g. Google Gemini via the Lovable AI Gateway) that process your inputs solely to return your result — see Section 4.
• Analytics and support tooling providers acting as processors.
• Professional advisers and authorities where required by law.

4. AI processing

When you use AI features, the content you submit is sent to our AI providers (e.g. Google Gemini via the Lovable AI Gateway) solely to generate your result. We have contractual commitments with our providers that prohibit them from training their foundation models on your content. See our AI Disclosure for the full breakdown.

5. Storage, retention & security

All career content — resumes, cover letters, STAR stories, interview transcripts, support messages, and feedback — is encrypted at the application layer using AES-256-GCM before being written to our database, on top of the disk-level encryption provided by our managed database host. A database dump or backup export cannot be read without our runtime encryption key.

Automated retention schedule (enforced daily by a scheduled job):

• Free accounts inactive for 12 months are permanently deleted, after a 30-day email warning.
• Sign-in metadata (email address, user agent, referrer) is stripped from access logs after 30 days.
• Support messages and product feedback are deleted after 24 months.
• Payment records are retained for 7 years to meet Indian tax and accounting law, with personal identifiers stripped after 24 months (only transaction IDs and amounts remain).
• Analytics events are deleted after 14 months (Google's default).

You can export or permanently delete everything Upplio holds about you at any time from Settings → Security. Deletion is immediate and irreversible.

6. International transfers

Some of our providers process data outside your country of residence. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

7. Your rights

Subject to applicable law (including India's DPDP Act 2023 and the EU/UK GDPR), you have the right to access, correct, delete, restrict or object to processing of your personal data, to withdraw consent, to data portability, and to lodge a complaint with your supervisory authority. To exercise any of these rights, email customerservice@upplioai.com. We respond within 30 days.

8. Cookies

We use first-party cookies for authentication and a small set of privacy-respecting analytics cookies. No third-party advertising trackers. See our Cookie Policy.

9. Contact

Upplio AI · Email customerservice@upplioai.com for any privacy question or request. For unresolved complaints, see our Grievance Officer page.