Who controls your data
Upfling is operated by the operator of upfling.host, a sole trader established in the United Kingdom.
We have not appointed a Data Protection Officer. Upfling is a small team operation that does not carry out large-scale monitoring or process special category data as a core activity, so the statutory requirement to appoint one does not apply. Privacy questions go to privacy@upfling.host and are answered by the operator personally.
What we collect
We have kept this list concrete rather than writing the usual catch-all. It is an inventory of what is actually stored.
Account information
Your name, email address and authentication details are held by Clerk, our authentication provider. Our own database stores only the account identifier Clerk gives us, not your email, not your name, not your password. When we need your email address to send you something, we ask Clerk for it at that moment.
Sites and files
- The files you upload, and their names and paths.
- The title, description and subdomain you choose for each site.
- Any custom domain you connect.
- Storage used, and when each site was created and updated.
File paths and site titles are whatever you typed. If you name a file after a person, that name is personal data and we hold it.
IP addresses
We record the IP address of whoever creates a site from the dashboard or the REST API, and we keep it for as long as the site exists. A site created through a connected AI assistant records the assistant as its source instead of an IP address.
Your IP address is also sent to Cloudflare when the anti-bot check runs on our upload and report forms, and to Sentry when the dashboard reports an error (see below).
Content scanning records
Each scan produces a record of what was checked and what was found. It includes file paths and short extracts from your files where something matched (for example, a URL a scanner rule flagged). It does not include a copy of your whole site.
Traffic counts
For each site we keep aggregate traffic counts so you can see how much it is visited. They are totals, not a log: no visitor IP addresses, browsers or pages visited reach us, and nothing is placed on a visitor's device. The counts are not tied to any person. Daily analytics rows older than 91 days are automatically deleted.
API keys
If you create an API key we store its name, its first characters, a hash of the key, and when it was created, last used and revoked. The key itself is shown to you once and never stored. See API keys and AI assistants.
Billing
Payments are handled entirely by Stripe. We never see or store your card details. Our database holds only the link between your Stripe customer record and your account, so we know which subscription belongs to whom. Your name, email and billing address are held by Stripe.
Referral attribution
FirstPromoter stores an attribution identifier in your browser. If you then create an account, we send that identifier and your email address to FirstPromoter so the promoter who referred you can receive credit. The Cookie Notice explains how this tracking operates independently of the analytics consent controls.
What we do not collect
We use product analytics on the Upfling dashboard. Where the law requires consent before information is stored on your device it is obtained first, and until then analytics operates without cookies; elsewhere cookies are set by default. You may run analytics with cookies, without them, or turn it off entirely. The Cookie Notice sets out what each state collects and carries the controls.
This does not extend to:
- The sites you host with us. We add no analytics or tracking code to them. The only addition to a free-plan page is a visible Upfling badge.
- Visitors to your hosted sites. Our hosting servers do not log their IP addresses or browsers, regardless of your own analytics setting. The only trace of a visit is the aggregate traffic count described above.
- Advertising. We do not carry out behavioural advertising and do not sell or share personal data for anyone else's marketing.
We do not ask for or store special category data: health, biometrics, political opinions and so on. Please do not put such data in a site title or a support email.
Why we are allowed to process it
Under UK GDPR Article 6, we rely on:
- Performance of a contract: holding your account, storing and serving your files, taking payment. Without this data there is no service.
- Legitimate interests: recording creator IP addresses, rate limiting, content scanning, moderation records and abuse reports. Our interest is in keeping Upfling from being used for phishing and malware, which also protects every other user and the people who would otherwise be victims. We have weighed this against your privacy and consider it proportionate: the data is narrow, it is not used for anything else, and hosting without it is not realistically operable.
- Legitimate interests: analytics carried out without cookies, where nothing is stored on or read from your device. Our interest is in understanding how the service performs and where it fails. The measurements are aggregate, are not linked to your account, and are not used to make decisions about you. You can object at any time using the "off" control in the Cookie Notice. Analytics that does use cookies rests on your consent instead, not on this basis.
- Legitimate interests: referral attribution and crediting promoters who introduce new customers. FirstPromoter operates independently of the analytics consent controls.
- Legal obligation: keeping financial records, and responding to lawful requests and valid takedown notices.
You can object to processing based on legitimate interests. See your rights below.
How long we keep things
These periods are enforced by scheduled jobs, not by a promise to remember:
- Deleted sites sit in your trash for 14 days, then are permanently deleted. The files are removed from storage and the database records are destroyed. This is a real deletion, not a flag.
- Sites created but never claimed are deleted after 24 hours.
- After you cancel a paid plan, you have 30 days before sites over the free-plan limit are suspended, with a reminder 7 days beforehand. They are suspended, not deleted.
- Account data is held by Clerk for as long as your account exists and is deleted when you delete the account.
- Billing records are kept for six years after the end of the relevant accounting period, as UK tax law requires.
- Revoked API keys stay on record as revoked (name, first characters, dates) so a leaked key can never come back to life. The key itself was never stored.
- Traffic counts are deleted after 91 days.
- Dimension breakdowns (top countries, referrers, devices) are deleted after 91 days.
Moderation and security records are kept indefinitely. That covers enforcement actions, content scan results, abuse reports and the IP block list. A block list that forgets is not a block list, and a repeat-infringer policy needs history to work against. Entries stay on the block list even after a block is lifted, marked as lifted. We rely on legitimate interests for this, and we intend to introduce a defined limit as the service matures; until we do, this page says "indefinitely" because that is the truth.
Visitors to email-gated sites
When a site owner turns on email capture, we collect the address a visitor enters, the first and latest visit times, visit count, country code and first page opened. The address is not verified.
The site owner receives this list and is its controller. Upfling processes it for the owner and keeps each address until the owner deletes that row or their full list, an administrator purges the list for abuse, or the site is permanently deleted.
To ask for removal, email privacy@upfling.host with the site address. We will remove the row and tell the site owner.
API keys and AI assistants you connect
Besides the dashboard, you can use Upfling through our REST API with an API key, or by connecting an AI assistant such as Claude or ChatGPT to your account. Both reach the same sites with the same rights you have.
API keys
A key is shown to you once when you create it. We keep its name, its first characters, a hash, and when it was created, last used and revoked; we cannot recover the key from what we hold. Revoke a key from the API keys page and every client using it is refused within seconds. Keep keys secret: anyone holding one can publish and delete sites as you.
Connecting an assistant
When you add Upfling in an assistant, the assistant registers itself with Clerk, you sign in, and you approve what it may do (read your sites, or read and change them). Clerk then issues the assistant an access token that is valid for one day and that the assistant can renew until you remove Upfling in the assistant's own settings. We store no token. Every request an assistant makes is checked against your account at that moment, so a suspended account is refused immediately, whatever token the assistant still holds.
What the assistant receives is what you ask it for. If you ask it to read a page, the file content goes to the company running the assistant (Anthropic for Claude, OpenAI for ChatGPT, or whoever runs the client you chose), together with the site's title, address, status and your plan and storage figures where a request returns them. That transfer happens on your instruction and is governed by that company's privacy terms, not this policy. Upfling sends nothing to those companies on its own, and they are not our processors, which is why they do not appear in the table above.
We record nothing about assistant use beyond the changes it makes to your sites, the last-used time on an API key, and the error reports described below.
Error monitoring
We use Sentry to find out when something in the software breaks. It deserves its own section because of what it collects.
On the dashboard at upfling.host (that is, the pages you sign in to and use), error reports include your IP address and the headers of the request that failed, alongside the error itself and your account identifier. We have this switched on deliberately: without the request context, a large share of reports are not diagnosable, and we are a small team operation that cannot reproduce every fault by hand. The legal basis is legitimate interests in keeping the service working.
On the API and assistant servers (api.upfling.host and mcp.upfling.host) request context is switched off: an error report carries the error and, where the request was signed in, your account identifier, but no IP address and no headers. Hosted sites are the same.
If you would rather your IP address were not sent to Sentry from the dashboard, tell us at privacy@upfling.host and we will treat it as an objection under Article 21.
Live chat
We use tawk.to to provide a live chat widget at upfling.host. It does not load on sites hosted with us. The widget loads on every page, for every visitor, regardless of consent state or region. It is not gated on consent because it exists to offer help, and the operator has decided it should always be available.
tawk.to sets cookies on your device (__tawkuuid, TawkConnectionTime, and session identifiers) and processes your IP address, browser and device information, and anything you type into the chat. These cookies are set unconditionally, including for visitors in the EEA and UK who have not given consent. The legal basis is legitimate interests in providing support to every visitor.
tawk.to is listed in the sub-processor table below. Processing takes place in the United States under a data processing addendum.
Sending data outside the UK
All of the providers above are headquartered in the United States, and Cloudflare processes data across a global network by design. Personal data therefore leaves the UK.
Those transfers are made under the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, as set out in each provider's data processing agreement linked in the table above. You can ask us for details of the safeguards that apply.
Your rights
Under UK data protection law you have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have data deleted, where we have no overriding reason to keep it.
- Portability: receive data you gave us in a machine-readable form.
- Restriction: have us pause processing while a dispute about accuracy or legitimate interests is resolved.
- Objection: object to processing we base on legitimate interests, including the Sentry processing described above.
Email privacy@upfling.host from the address on your account, or tell us how else to verify it is you. We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
Requests are handled by hand. We do not yet have a self-service export button. That does not change the deadline.
Some data survives an erasure request. We keep records of enforcement action, abuse reports and blocked IP addresses on the basis of legitimate interests, because deleting them on request would let anyone erase the evidence of their own abuse. We also keep billing records for as long as tax law requires. We will tell you if we rely on either of these.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.
Deleting your data yourself
You do not need to ask us for most of this:
- A single site: delete it from your dashboard. It goes to the trash and is permanently destroyed after 14 days.
- Your whole account: delete by contacting us at privacy@upfling.host. This removes your identity data from Clerk.
- Billing details: managed through the Stripe customer portal, linked from your billing page.
- API keys and assistants: revoke a key on the API keys page; disconnect an assistant in that assistant's settings.
Deleting your account does not automatically delete sites you still have published. Delete the sites first if that is what you want.
Children
Upfling is not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, email privacy@upfling.host and we will delete it.
Changes to this policy
When this policy changes, the "last updated" date at the top changes with it. If a change materially affects how we use your personal data (a new provider receiving it, a new purpose, a longer retention period), we will email account holders before it takes effect.
Questions about this document? Email legal@upfling.host.