Privacy Policy

Most of Upstep is used inside an organization’s workspace. When a business creates a workspace and invites its people, that business (“your organization”) controls the workspace. It decides which forms and fields exist, what gets recorded, who is a member, what each member can see and do, and which of its own customers get access to a customer portal.

We call the content in a workspace “Workspace Data”: hours and other entries, projects, customer records, form answers, attachments, reports, and similar content. For Workspace Data we act as a service provider (a “processor” under the GDPR) to your organization. We process it to provide the Service under our agreement with the organization, and the organization’s own privacy notice governs how it uses that data.

If you are a member or a customer contact of an organization and have a question or request about Workspace Data, please contact that organization. If you contact us instead, we will refer you to it and help it respond.

For your account, billing, our website, and the data we collect to secure, support, and improve the Service, we decide how the data is used (we are the “controller”), and this policy describes our practices.

Information you or your organization give us

• Account details: your name, email address, password, time zone, and profile photo.
• Sign-in and security details: two-factor authentication settings, passkeys (a public key and basic details about the device that holds it), and, if your organization uses single sign-on, the identifier, name, and email address its identity provider sends us.
• Organization details: the organization’s name, workspace address, logo, custom domain, settings, roles, teams, and overtime rules.
• Billing details: card details go directly to our payment processor, Stripe; we never see full card numbers. We give Stripe the organization’s name and the email address of the person who set it up, and we keep the card brand, last four digits, expiration date, and the subscription and payment status.
• Workspace Data: hours entries (dates, start and end times, time zone, and the answers to your organization’s form fields), projects (names, descriptions, statuses, assignees, budgets, and target dates), customer records (names, contact details, addresses, and notes), files attached to entries, and reports, views, and dashboards. Files are stored as uploaded, so a photo can include details its camera added, such as where it was taken.
• Invitations: the email addresses of the teammates and customer contacts you invite.
• Messages and feedback: what you send us, including feedback from inside the app, which reaches us by email with your name, email address, organization, and the page you were on.

Information we collect automatically

• Device and log data: IP address, browser and device type, operating system, app version, the pages and addresses you request, the referring page, and the time of each request. We record the IP address and browser or device for each sign-in. The mobile apps also send a random identifier they create for your device.
• Usage data: the pages and screens you view, the buttons and links you click (including their text), and the features you use.
• Approximate location: our analytics provider estimates your city, region, and country from your IP address, and we use your device’s time zone to show and record times. We don’t collect precise location, and our apps don’t ask for access to your location, contacts, camera, or photo library.
• Diagnostics: error reports, crash reports from the iOS app, and performance data.
• Push notification tokens: if you allow notifications in a mobile app, a token from Apple or Google that lets us send them, along with your notification preferences.
• Cookies and similar technologies: see Cookies and similar technologies.

Information from others

• Your organization can add you as a member, assign your role and teams, log hours on your behalf, and include your name in records and reports.
• Identity providers: if your organization uses single sign-on, its identity provider tells us who you are when you sign in.
• Stripe tells us whether payments succeed and gives us the card summary described above.
• Apple and Google give us crash reports from the mobile apps when your device is set to share diagnostics, and statistics such as how many times the apps have been installed.

We use personal information to:

• Provide the Service. Create and secure accounts, sign you in, run workspaces, calculate hours and overtime, build reports and exports, and send the notifications and scheduled reports your organization sets up.
• Bill for the Service. Process payments, manage subscriptions, and keep billing records.
• Communicate with you. Send verification, password, and security emails, invitations, billing notices, and notices about changes to the Service, send push notifications you allow, and answer your messages.
• Keep the Service secure. Authenticate users, prevent fraud and abuse, limit repeated requests, keep audit records of changes, and investigate incidents.
• Support you. To answer a support request, fix a problem, or investigate abuse, authorized Upstep staff may look at an account or temporarily sign in as a user. Only staff accounts can do this, and we record when it happens.
• Understand and improve the Service. Product analytics, error reports, and performance data help us fix bugs, keep the Service fast, and decide what to build. Feature flags let us roll out changes gradually.
• Meet legal obligations. Comply with law, respond to lawful requests, and enforce our terms.

We don’t sell Workspace Data, use it for advertising, or use it to train AI models.

If you are in the European Economic Area, the United Kingdom, or Switzerland, data protection law requires us to have a legal basis for each way we use personal information as a controller. We rely on:

Where we rely on legitimate interests, we balance them against your rights, and you can object (see Rights in the EEA, UK, and Switzerland). You need to give us account information to use the Service; without it we can’t create an account for you. We don’t make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Inside your organization

• Members of a workspace can usually see its member list: names, email addresses, roles, and teams.
• Depending on the roles your organization sets, other members, managers, and administrators can see the entries you log, including times, hours, and form answers. Some can log entries for you or view the workspace dashboard as you see it.
• Customer contacts can see the entries linked to their customer record, which can include the name of the person who logged each one, the files attached to those entries, and reports shared with them.
• Scheduled reports are emailed to the recipients your organization chooses.

Service providers

We use the companies below to run the Service. They process personal information on our behalf, under contracts that limit how they can use it. We also use ordinary business tools, such as email, to communicate with you and run our business.

Stripe also uses some payment information for its own purposes, such as preventing fraud and meeting legal requirements, under its own privacy policy.

Other sharing

• At your organization’s direction, for example with the single sign-on provider it connects.
• For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, property, or safety of Upstep, our users, or others.
• In a business transfer, such as a merger, acquisition, financing, or sale of assets, where personal information may be transferred as part of the deal and stays subject to this policy.
• With your consent or at your direction.

We may also share aggregated or de-identified information that can’t reasonably be used to identify you.

Cookies are small files a website stores in your browser. We also use your browser’s local storage for similar purposes. Most of ours are needed to sign you in and keep the Service secure; the rest remember your preferences or support analytics. We don’t use advertising cookies, and we don’t let ad networks track you on our sites.

Local storage holds similar preferences, such as table column widths, your recent searches, and the date range you last chose for a report, along with PostHog’s analytics identifiers. Cloudflare may also set cookies it needs to protect the Service against attacks.

You can block or delete cookies and local storage in your browser settings. If you block the sign-in cookies, you won’t be able to sign in. Blocking PostHog’s cookie and storage stops it from recognizing your browser between visits, and doesn’t change how the Service works.

The mobile apps keep your sign-in token in the device’s secure storage, and keep your settings, such as reminders, notifications, and the workspace you last opened, on the device. Your device’s backups can include what the apps keep, except that on Android, backups and transfers to a new phone leave out your sign-in token and the random identifier the app creates for your device.

• Account information is kept while your account exists. When you ask us to delete your account, we delete it within 30 days of confirming the request. Workspace Data you added to an organization’s workspace, such as hours you logged, belongs to that organization and stays with it.
• Workspace Data is kept while the organization’s workspace exists. Items deleted in a workspace disappear from view right away, and we keep a copy until the workspace itself is deleted. Entries a member logged stay with the organization after that member leaves it. When an organization asks us to delete its workspace, we delete its Workspace Data, including files, within 30 days.
• Sign-in records, including the IP address and browser or device for each sign-in, are kept while your account exists.
• Audit records of security events and changes, which can include names, email addresses, and IP addresses, are kept to secure the Service, investigate incidents, and resolve disputes. They can outlast the account or workspace they describe.
• Billing records are kept for as long as tax and accounting laws require, generally up to seven years.
• Analytics and diagnostic data are kept only as long as they are useful for the purposes in this policy, within the limits our analytics and error-monitoring providers set.
• Messages and feedback are kept as long as we need them to respond to you and improve the Service.

Deleted information can remain in backups until those backups expire. We may keep information longer when the law requires it, or to resolve disputes and enforce our agreements.

We use safeguards designed to protect personal information, including:

• encryption in transit (HTTPS) for the website, the web app, and the mobile apps;
• encryption at rest for our main database and stored files;
• passwords stored only as one-way hashes, and organizations’ single sign-on credentials stored encrypted;
• two-factor authentication, passkeys, and single sign-on for organizations that want them;
• file links that expire, so attachments can’t be opened with an old link;
• roles and permissions that limit what each member can see, and audit records of changes; and
• access to production systems limited to staff who need it.

No method of transmission or storage is completely secure, so we can’t guarantee security. If we learn of a breach that affects your personal information, we will notify you and your organization as the law requires.

We are based in the United States, and we store and process data in the United States. Some of our service providers process data in other countries too. When we transfer personal information out of the EEA, the UK, or Switzerland, we rely on a lawful transfer mechanism, such as the European Commission’s Standard Contractual Clauses (with the UK and Swiss addenda) or a recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

• Your profile. You can update your name, photo, password, time zone, two-factor authentication, and passkeys in your profile, and see which devices are signed in to your account. To change your email address, write to us.
• Your data. You can ask us for a copy of your personal information, or ask us to correct or delete it, by writing to [email protected]. To delete your account, write to us from the email address on the account. We will delete your account and the personal information tied to it within 30 days of confirming the request, except for what we must keep for legal, tax, or security reasons (see How long we keep information). Deleting your account doesn’t delete Workspace Data you added to an organization’s workspace; that stays with the organization. An organization’s administrators can ask us to delete its whole workspace the same way.
• Workspace Data. Your organization controls its workspace, so requests about entries, files, or other content in it are best sent to your organization’s administrators. We will pass along requests we receive and help the organization respond.
• Emails. Most emails we send are needed to run your account, such as verification, password, security, and billing emails, and you can’t opt out of them while you have an account. You can change project reminders in your profile; scheduled reports are set up by your organization. If we send product news, each email will include a way to unsubscribe.
• Push notifications and reminders. You can turn these off on the Account screen of the Upstep mobile app or in your device’s settings.
• Cookies. See Cookies and similar technologies.

If you are in the EEA, the UK, or Switzerland, you have the right to:

• access the personal information we hold about you and get a copy of it;
• have inaccurate information corrected;
• have your information erased;
• restrict how we use your information;
• object to our use of your information based on legitimate interests;
• receive information you gave us in a portable format; and
• withdraw consent at any time, where we rely on consent, without affecting earlier processing.

To use these rights, write to [email protected]. We will respond within one month, and may ask you to confirm your identity first. You also have the right to complain to your local data protection authority, such as the authority in your EU country of residence, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner.

Depending on where you live (for example California, Colorado, Connecticut, Oregon, Texas, or Virginia), you may have the right to:

• know what personal information we collect, use, and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising, and certain profiling. We don’t do any of these;
• limit the use of sensitive personal information. We use it only to provide and secure the Service; and
• not be treated differently for using these rights.

To make a request, write to [email protected]. We will confirm your identity by asking you to respond from, or verify access to, the email address on your account. You can use an authorized agent; we will ask for proof that you gave them permission. If we deny your request, you can appeal by replying to our response. If we deny the appeal, you can contact your state attorney general.

California disclosures

In the past 12 months we have collected the categories of personal information below, for the purposes in How we use information. We have not sold personal information or shared it for cross-context behavioral advertising, and we don’t knowingly sell or share the personal information of anyone under 16.

We collect these categories from the sources in Information we collect, and keep them for the periods in How long we keep information.

We don’t share personal information with third parties for their own direct marketing. We don’t sell or share personal information, so there is no sale or sharing for a Global Privacy Control signal to stop. We don’t track you across other companies’ websites, so we don’t respond differently to Do Not Track signals.

Upstep is a business service and is not meant for children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to [email protected] and we will delete it.

We may update this policy as the Service changes. We will post the new version here and update the date at the top. If a change is significant, we will also tell you by email or in the Service before it takes effect.

Questions, requests, or complaints about this policy or your personal information can go to 5448C8 Software LLC at [email protected].