Terms of Service

These terms are a legal agreement between you and 5448C8 Software LLC. By creating an account, accepting these terms in the Service, or using the Service, you agree to them. If you don’t agree, don’t use the Service.

If you create a workspace, change its plan, or otherwise accept these terms for an organization, such as your employer or your own business, you accept them for that organization and confirm that you have authority to do so. In these terms, “you” means you and, when you act for an organization, that organization. “Your organization” means the organization whose workspace you use or manage.

You must be at least 16 to use the Service. To create a workspace or accept these terms for an organization, you must be at least 18, or the age of majority where you live if that is higher.

The Service is made for businesses and other organizations, not for personal or household use. Our Privacy Policy explains how we handle personal information. Some laws give rights that an agreement can’t take away, and nothing in these terms limits them.

Upstep is used inside workspaces. An organization creates a workspace, adds its people as members, and can invite people at its own customers (“customer contacts”) to see what it shares with them. The organization decides which forms and fields its workspace has, who belongs to it, and what each person can see and do. Its administrators act for it, and we follow their instructions for the workspace.

We call the content in a workspace “Workspace Data”: hours and other entries, projects, customer records, form answers, attachments, reports, and similar content. Workspace Data belongs to the organization, including what its members add, and stays with it when a member leaves.

If you run a workspace

Your organization is responsible for:

• the people it adds or invites, the access it gives them, and how they use the Service;
• Workspace Data, including having the rights, giving the notices, and getting the consents needed to put it in the Service, such as telling employees how their hours are recorded and who can see them;
• checking its records, reports, and calculations, and complying with the laws that apply to it, including employment, wage and hour, tax, and privacy laws; and
• what it shares with customer contacts, and its relationships with its members and customers.

Upstep helps you record and report work. It doesn’t give legal, payroll, tax, or accounting advice. Hours, overtime, and other figures are calculated from the forms and rules your organization sets up, so your organization needs to check them before relying on them, for example to pay people.

If you’re a member or a customer contact

The organization that runs a workspace controls your access to it. Depending on the roles it sets, it can see and manage what you add, change what you can do, or remove you at any time. Questions about Workspace Data, or about your work for or with the organization, should go to the organization.

Workspace addresses and custom domains

Each workspace has an address on upstep.app, and a Pro workspace can also use a custom domain. Your organization must own or control any domain it connects. We may change a workspace’s address if it infringes someone’s rights, misleads people, or impersonates someone, and we’ll tell the workspace’s administrators when we do.

If people disagree about who controls a workspace, we may rely on our records, on instructions from the person we reasonably believe acts for the organization, or on a court order.

• Give us accurate information, and keep it up to date.
• An account is for one person. Don’t share your sign-in details or let anyone else use your account.
• Keep your password, passkeys, and two-factor devices secure. You’re responsible for what happens under your account. If you think someone else has used it, tell us right away at [email protected].
• If your organization uses single sign-on, you sign in to its workspace through its identity provider, and your access depends on it.

We send the emails and messages needed to run your account and the Service, such as verification, security, invitation, and billing messages. You agree to receive them electronically, and that they meet any legal requirement for written notice.

Plans

Each workspace is on the Free plan or the Pro plan, and our pricing page shows each plan’s current features, limits, and price. The Free plan costs nothing, and its monthly limits reset at the start of each billing period. We may change the Free plan’s features or limits, or stop offering it, with at least 30 days’ notice.

Paying for Pro

• Pro is billed monthly, in advance, for each member of the workspace. Customer contacts aren’t counted.
• Billing starts when your organization upgrades, and the subscription renews every month until it downgrades to Free. Your organization authorizes us, through our payment processor Stripe, to charge its payment method for each billing period.
• When members are added or removed, the charge changes in proportion to the time left in the billing period, and the difference is applied to the next invoice.
• Prices don’t include taxes. Your organization is responsible for any taxes on its purchases, other than taxes on our income.
• We may change Pro’s price. We’ll tell the people who manage billing for your workspace at least 30 days ahead, and the new price applies from the first billing period that starts after that.

Downgrades and refunds

Your organization can downgrade to Free at any time in its billing settings. Pro continues until the end of the current billing period, and then the workspace moves to Free. Payments are non-refundable, except where these terms or the law say otherwise. Credit for members removed during a billing period goes toward future invoices and isn’t paid out.

Failed payments

If a payment fails, we’ll tell the people who manage billing for your workspace and try the payment again. Pro keeps working while we retry. If the payment still doesn’t go through, the workspace moves to the Free plan. Nothing in the workspace is deleted when that happens, but Pro features stop working and the Free plan’s limits apply.

Ownership and how we use it

Your organization keeps all its rights in Workspace Data. It allows us to host, store, copy, process, transmit, and display Workspace Data only as needed to provide, secure, and support the Service for it, and as the law requires. We don’t sell Workspace Data, use it for advertising, or use it to train AI models.

To answer a support request, fix a problem, or investigate abuse, authorized Upstep staff may look at a workspace or temporarily sign in as a user. Only staff accounts can do this, and we record when it happens.

We also collect information about how the Service is used and how it performs, as our Privacy Policy describes. We use it to run, secure, and improve the Service, and share it only as that policy describes. For example, our error monitoring and analytics providers receive it with identifiers such as user IDs, names, and email addresses. We may also share it in aggregated or de-identified form that can’t reasonably be used to identify your organization or any person.

What not to put in the Service

Unless we agree otherwise in writing, don’t use the Service to store payment card numbers, bank account numbers, government identification numbers such as Social Security numbers, passwords for other services, or health information protected by HIPAA. We aren’t a HIPAA business associate, and the Service isn’t designed for this kind of information.

Copies, deletion, and legal requests

• We back up the Service, but we can’t promise Workspace Data will never be lost. Keep your own copies of anything you can’t afford to lose. Your organization can export data with the Service’s export features, where its plan includes them, or ask us for a copy.
• Items deleted in a workspace disappear from view right away, and we keep a copy until the workspace itself is deleted.
• When an organization’s administrators ask us to delete its workspace, we delete its Workspace Data, including files, within 30 days. Copies can remain in backups until those backups expire. We keep what the law requires us to keep, and the records our Privacy Policy describes, such as billing and audit records.
• If a government or anyone else asks us for Workspace Data, we’ll try to send them to your organization. If we must hand it over, we’ll tell your organization first, unless the law forbids it.

This section is our data processing agreement with your organization. It covers personal data in Workspace Data that we process for your organization and that is protected by the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, or US state privacy laws such as the California Consumer Privacy Act (together, “data protection laws”). For that data, your organization is the controller (a “business” under some US state laws), and we are its processor (a “service provider” under some US state laws). If your organization is itself a processor for someone else, it confirms that they have authorized our processing.

What we commit to

• Instructions. We process the data only on your organization’s documented instructions: these terms, and its use and settings of the Service. If the law requires us to do otherwise, we’ll tell your organization first, unless the law forbids that. We’ll tell your organization if we believe an instruction breaks data protection laws.
• Confidentiality. Everyone we allow to process the data is bound to keep it confidential.
• Security. We keep the safeguards described in How we protect information. We may change them, but not in a way that lowers the overall protection of the data.
• People’s requests. When someone exercises their rights under data protection laws, your organization’s administrators can find, correct, and delete most of their Workspace Data in the Service, and export it where its plan includes exports. For anything those tools don’t cover, such as permanently erasing items deleted in the Service or a copy of the data on a plan without exports, the administrators can write to us at [email protected], and our staff will do it for them, as far as the nature of our processing allows. If someone sends such a request to us, we’ll refer them to your organization.
• Other help. Using the information available to us, we’ll help your organization meet its obligations on security, breach notification, data protection impact assessments, and consulting regulators.
• Breaches. We’ll notify your organization without undue delay after we become aware of a personal data breach affecting the data, with the information we have, and update it as we learn more. Notifying your organization isn’t an admission of fault.
• Return and deletion. Before your organization’s workspace is deleted, it can export the data or ask us for a copy. After that, we delete the data as described in Your data. Copies we must keep by law stay protected by this section.
• Audits. We’ll make available the information reasonably needed to show that we meet this section, for example by answering security questionnaires. If that isn’t enough, or a regulator requires it, your organization may audit our compliance once a year, with at least 30 days’ notice, at its own expense, under a duty of confidentiality, and without access to other customers’ data.
• US state laws. We won’t sell or share the data, as the CCPA defines those terms. We won’t keep, use, or disclose it for any purpose other than providing the Service to your organization, or outside our direct business relationship with it, and won’t combine it with personal data we get from others, except as those laws allow. We’ll meet the obligations those laws place on us, give the data the level of privacy protection they require, and tell your organization if we can no longer do so. Your organization may take reasonable steps to stop and fix any unauthorized use of the data.

Subprocessors

Your organization authorizes us to use the service providers listed in How we share information as subprocessors. We bind each of them by contract to protect the data at least as well as this section requires, and we remain responsible for their work. Before we add or replace a subprocessor, we’ll update that list and email your organization’s administrators at least 14 days ahead, or as soon as we can when an urgent change is needed to keep the Service running or secure. If your organization objects on reasonable data protection grounds and we can’t resolve the objection, it may close its workspace.

International transfers

We store and process data in the United States. For transfers of data protected by the GDPR, unless another transfer mechanism applies, the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 form part of these terms: Module Two, or Module Three where your organization is a processor. Your organization is the data exporter and we are the data importer. In those clauses, the optional Clause 7 and the option in Clause 11(a) don’t apply; Option 2 of Clause 9(a) applies, with the notice period above; the competent supervisory authority is the one Clause 13 sets; and Irish law governs, and Irish courts hear disputes, under Clauses 17 and 18. The parties and the details of the processing below complete Annex I; the safeguards in our Privacy Policy, with the help described under “People’s requests” and “Other help” above, complete Annex II; and the Privacy Policy’s list of service providers completes Annex III.

For data protected by UK law, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those clauses, completed with the same information, and either of us may end it as its Section 19 allows. For data protected by Swiss law, the clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as a competent supervisory authority. If these terms conflict with those clauses, the clauses control.

Parties to the clauses

• Data exporter: your organization, identified by the name of its workspace, at the address it gives us. Its contacts are the workspace’s administrators, at the email addresses on their accounts. It uses the Service to record and report its work, as a controller, or as a processor under Module Three.
• Data importer: 5448C8 Software LLC, PO Box 321, Burlington, NC 27216, USA, reachable at [email protected]. We provide the Service to your organization, as a processor.
• Signature and date: when your organization accepts these terms, both parties are treated as having signed the clauses, including their annexes, on that date.

Details of the processing

• Subject matter and duration: providing the Service to your organization, for as long as we do, until the data is deleted.
• Nature and purpose: hosting, storing, organizing, displaying, sending, and otherwise processing Workspace Data to provide, secure, and support the Service.
• People the data is about: your organization’s members and customer contacts, and others whose information it enters, such as its customers’ staff and people named in entries, records, and files.
• Types of personal data: names, contact details, work records such as hours, times, and form answers, project and customer records, files and their contents, and any other personal data your organization adds.
• Sensitive data: none intended. If your organization adds any, it is responsible for having a lawful basis and for the Service’s safeguards being suitable for it.
• Frequency: continuous, while your organization uses the Service.

You agree not to do any of the following, or help or allow anyone else to:

• break the law, or infringe anyone’s rights, including their privacy and intellectual property rights;
• store or share content that is illegal, harassing, defamatory, hateful, or deceptive, or that exploits children;
• upload viruses or other malicious code;
• send spam through invitations, scheduled reports, or other email the Service sends, or email people who haven’t agreed to hear from your organization;
• get into accounts, workspaces, or data you aren’t allowed to, or get around access controls or plan limits, for example by splitting one organization across several Free workspaces;
• probe, scan, or test the Service’s security without our written permission, or disrupt or overload it;
• scrape the Service or access it by automated means, other than through features we provide for that;
• copy, modify, or reverse engineer the Service, except where the law allows it despite this rule;
• resell or rent access to the Service, or use it to build a competing product;
• impersonate anyone, or misrepresent your connection to a person or organization; or
• run anything where a failure of the Service could cause death, injury, or environmental damage.

We may remove content, or limit or suspend access, to enforce these rules. If you find a security problem, please report it to [email protected].

The Service works with services we don’t control, such as Stripe for payments, your organization’s identity provider for single sign-on, domain providers for custom domains, and Apple and Google for the mobile apps and push notifications. Their own terms and privacy policies apply to your use of them, and we aren’t responsible for them.

We give you a personal, non-exclusive, non-transferable, revocable license to install and use the Upstep apps on devices you own or control, to use the Service under these terms. The terms of the app store you got an app from also apply.

Apps from Apple’s App Store

• These terms are between you and us, not Apple. We, not Apple, are responsible for the app and its content.
• Your license to the app covers Apple-branded products you own or control, as the Usage Rules in Apple’s Media Services Terms and Conditions allow.
• Apple has no obligation to provide maintenance or support for the app.
• If the app fails to meet a warranty that applies to it, you may tell Apple, and Apple will refund the price you paid for the app, if any. To the fullest extent the law allows, Apple has no other warranty obligation for the app.
• We, not Apple, are responsible for handling any claims about the app, including product liability claims, claims that it fails to meet a legal or regulatory requirement, claims under consumer protection or privacy laws, and claims that it infringes someone’s intellectual property rights.
• You confirm that you aren’t in a country subject to a US government embargo or designated by the US government as a “terrorist supporting” country, and that you aren’t on any US government list of prohibited or restricted parties.
• You must follow any third-party terms that apply when you use the app, such as your wireless carrier’s.
• Apple and its subsidiaries are third-party beneficiaries of these terms as they relate to the app, and may enforce them against you.

We and our licensors own the Service, including its software and design, and the Upstep name and logos. Workspace Data isn’t ours. While you follow these terms, we give your organization and its users a limited, non-exclusive, non-transferable right to use the Service for the organization’s business. We keep all rights we don’t expressly grant.

Some software in the Service is open source, and its own license applies to it.

If you send us feedback or ideas, we may use them for any purpose without paying or crediting you.

We change the Service regularly, and may add, change, or remove features at any time. Some features are labeled beta or preview, or reach some workspaces before others. They come as is, and may change or stop.

If we decide to stop offering the Service entirely, we’ll give at least 30 days’ notice so your organization can export its data, and we’ll refund what it paid for any time after the Service ends.

We provide support by email at [email protected], and Pro workspaces get priority. We don’t promise specific response times or availability.

Leaving

Your organization can stop using the Service at any time. To close a workspace, an administrator can write to us at [email protected] from the email address on their account. Closing a workspace ends its subscription right away, without a refund or credit for the rest of the billing period. To delete your own account, write to us the same way, as our Privacy Policy describes.

Suspension or termination by us

We may suspend or end your access, or a workspace, if:

• you or your organization break these terms, including the acceptable use rules;
• we need to, to comply with the law or a legal order; or
• continuing would create a security risk, or could harm the Service, its users, us, or anyone else.

Where it’s practical and lawful, we’ll tell you first and give you a chance to fix the problem, and we’ll restore access once it’s fixed.

When a workspace ends

Its users lose access to it, but keep their Upstep accounts and any other workspaces they belong to. Amounts already owed stay due, and we delete its Workspace Data as described in Your data. The parts of these terms that by their nature should last, including those on payment, Workspace Data, intellectual property, disclaimers, limitation of liability, indemnification, and disputes, continue after these terms end.

The Service is provided “as is” and “as available.” To the fullest extent the law allows, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and any warranties arising from course of dealing or usage of trade. We don’t warrant that the Service will be uninterrupted, secure, or error-free, that it will meet your needs, that its calculations and reports will be accurate, or that Workspace Data won’t be lost or damaged.

Some places don’t allow these disclaimers, so some of them may not apply to you.

To the fullest extent the law allows, Upstep, its affiliates, and their owners, officers, employees, agents, suppliers, and licensors (the “Upstep parties”) won’t be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, or data, or the cost of substitute services, arising out of or relating to these terms or the Service, however caused and under any theory of liability, even if we were told they might happen.

To the fullest extent the law allows, the Upstep parties’ total liability for all claims arising out of or relating to these terms or the Service is limited to the amount your organization paid us for the Service in the 12 months before the event that gave rise to the liability.

These limits apply even if a remedy fails of its essential purpose, and they are an essential part of the agreement between us. Some places don’t allow these limits, so some of them may not apply to you.

Your organization will defend the Upstep parties against any third-party claim, and pay the resulting losses, damages, settlements, and costs, including reasonable attorneys’ fees, to the extent the claim arises from Workspace Data, from use of the Service by your organization or its users in breach of these terms or the law, or from a dispute between your organization and its members, customers, or customer contacts. We’ll tell your organization about the claim, let it control the defense, and cooperate at its expense. It may not settle a claim in a way that admits fault for us or requires us to do anything, without our consent.

North Carolina law governs these terms and any dispute arising out of or relating to them or the Service, without regard to conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods doesn’t apply.

Before either of us starts a lawsuit, we’ll both try to resolve the dispute informally for 30 days, starting when one of us gives the other written notice of it. You can reach us at [email protected]. A dispute that isn’t resolved must be brought only in the state or federal courts located in North Carolina, and both of us consent to those courts’ jurisdiction. Either of us may still ask any court for an injunction to protect intellectual property or to stop misuse of the Service.

We may update these terms. We’ll post the new version here and update the date at the top. If a change is significant, we’ll also tell you by email or in the Service at least 30 days before it takes effect, unless it must take effect sooner to comply with the law or applies only to new features. If you keep using the Service after a change takes effect, the updated terms apply to you. If you don’t agree to them, stop using the Service before the change takes effect.

• Entire agreement. These terms, with our Privacy Policy and the plan details shown when your organization upgrades, are the whole agreement between you and us about the Service. Terms in a purchase order or similar document don’t apply.
• Assignment. You can’t transfer these terms without our written consent. We may transfer them to an affiliate, or as part of a merger, acquisition, or sale of assets.
• Events beyond our control. We aren’t liable for delays or failures caused by events beyond our reasonable control, such as natural disasters, outages at internet, hosting, or other providers, attacks, labor disputes, war, or government action.
• Severability and waiver. If part of these terms can’t be enforced, it will be enforced as far as the law allows, and the rest stays in effect. If we don’t enforce a right, we haven’t waived it.
• Notices. We may send notices to the email address on your account, to your organization’s administrators, or in the Service. Send legal notices to us at [email protected].
• Export controls. Don’t use or export the Service in violation of US export control or sanctions laws.
• Relationship. We are independent contractors. These terms give no rights to anyone else, except Apple as described in Mobile apps, and the Upstep parties in the limitation of liability and indemnification sections.
• Interpretation. “Including” means “including but not limited to.” Headings and the summary at the top don’t change what these terms say. If a translation conflicts with this English version, this version controls.

Questions about these terms can go to 5448C8 Software LLC at [email protected].