Privacy policy
Last updated 25 September 2026
Template document: the operator of this service must complete the bracketed details and have it reviewed by a qualified lawyer for their jurisdiction before accepting customers.
This policy explains what personal data Upspace Connect processes, why, and your rights. The controller for account data is [legal entity name], [address]. Contact our privacy team at support@example.com.
Two kinds of data
- Account data — about you and your team as our customers. We are the controller.
- Customer conversation data — messages, contacts and consent records of the people your business talks to on WhatsApp. Your business is the controller; we process it on your instructions as a processor.
What we collect
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (stored only as a hash), business details | Create and secure your account | Contract |
| Billing status, plan, invoices (card details are held by Paddle, never by us) | Charge for the service, keep accounting records | Contract, legal obligation |
| Sign-in IP address, device and browser, security logs | Prevent fraud and abuse, investigate incidents | Legitimate interests |
| WhatsApp messages, media, contacts, tags, notes, consent and opt-out records | Provide the inbox, automations, API and analytics you use | On your business's instructions |
| Service emails (verification codes, billing and connection alerts) | Operate the account | Contract |
Service providers
We share data only with providers that help run the service, under contracts that protect it:
- Meta Platforms (WhatsApp Business Platform) — sending and receiving WhatsApp messages you choose to exchange;
- Paddle — payments, taxes and invoicing, as merchant of record;
- Neon — database hosting; Cloudflare — application hosting, file storage and network security;
- Resend — delivery of service emails;
- Anthropic — only if your workspace turns on AI assistance: conversation text is sent to generate reply suggestions and summaries.
Some providers process data outside your country. Where required, transfers rely on appropriate safeguards such as standard contractual clauses. [List regions.]
Security
Connections are encrypted in transit. WhatsApp access tokens and other credentials are encrypted at rest; passwords, verification codes and API keys are stored only as hashes. Access within workspaces is controlled by roles, and security-relevant actions are recorded in an audit log.
Retention
Account data is kept while your account is open and for [period] afterwards for legal and accounting purposes. Conversation data is kept until your business deletes it or closes its workspace, then deleted within [30] days, except backups, which expire on a rolling [35]-day cycle. Security logs are kept for [12] months.
Your rights
Depending on where you live (including under the Mauritius Data Protection Act 2017 and the GDPR), you can ask to access, correct, delete or export your personal data, object to or restrict processing, and complain to your data protection authority. If you are a customer of a business that uses Upspace Connect, contact that business first; we will help them respond.
Cookies
We use only cookies needed to run the service: your session, security tokens, your selected workspace and your plan choice during sign-up. We do not use advertising or third-party tracking cookies.
Changes
We will post changes here and, for material changes, notify account owners by email before they take effect.