Privacy Policy

Upplai Inc. ("Upplai", "we", "us", or "our") operates our platform at uppl.ai and its subdomains, including you.uppl.ai (the "Platform"), and the Upplai ChatGPT plugin. Upplai is responsible for the personal information described in this policy and, if you are in the European Economic Area (EEA) or the United Kingdom, is its "controller." Our postal address is 28 Geary Street, STE 650 #1987, San Francisco, CA 94108, United States, and you can reach us at team@uppl.ai.

Information you give us or that we receive when you use Upplai:

• Account information: your name and email address from the provider you sign in with (Google, Microsoft, or LinkedIn). We do not receive your password or profile picture.
• Resume content: the full text of your resume, including any contact details, work history, education, skills, and other information you include.
• Profiles and job descriptions: links to social or portfolio profiles you provide (such as GitHub or Behance), and job descriptions or job titles you paste or link to.
• Login and activity data: your IP address, device type, sign-in provider, the invitation code you used to sign up, and a log of the actions you take on the Platform and when.
• Email interactions: whether you open or click links in emails we send you, with the time, IP address, and device type.
• Purchase information: for each purchase, an order reference, the amount, the currency, any promotion code, and any affiliate click reference and consent choice in effect at the time. Card details are handled by Stripe and never reach us.
• Affiliate referral information: if you arrive through a link from one of our affiliate partners, the click reference added to that link by our affiliate network, Awin, and the time of the click.
• Privacy choices: your cookie preferences, your choice about the sale or sharing of your personal information, whether your browser sent a Global Privacy Control (GPC) signal, your broad privacy region (for example, EU/UK or California), and when you made the choice. For signed-in users, we keep a record of these choices.

Information we generate from your inputs: job-fit analyses and job-match scores; ATS analyses, including readability, keyword, and overall scores; tailored resumes; cover letters; recommendations; preference profiles reflecting your design, content, and formatting choices; and the identifiers we use to process these.

Information collected by our partners' technology: Google and Awin run technology on the Platform that collects information directly from your browser, such as your IP address, browser details, and the pages you visit, and, in Awin's case on the purchase confirmation page, characteristics of your device. See "Advertising and affiliate tracking" below.

We use your information to:

• Provide our services, including parsing your resume, analyzing job descriptions, and generating scores, tailored resumes, cover letters, and recommendations
• Personalize your experience, including maintaining your preference profile
• Process payments and maintain your purchase history and credits
• Send transactional and service emails, measure engagement with them, respond to support requests, and ask for feedback
• Improve the Platform and the ChatGPT plugin and analyze how they are used
• Attribute your account to a referral source or campaign through your invitation code
• Credit and pay the affiliate partner who referred you, and measure the effectiveness of our advertising, as described under "Advertising and affiliate tracking"
• Record and honor your privacy choices
• Comply with legal, tax, and accounting obligations, and protect against fraud and misuse

Service providers. We share information with providers that help us operate Upplai and that may use it only to provide services to us:

• Hosting: cloud infrastructure providers that store and process data on our behalf.
• AI processing: OpenAI's API, to parse resumes, analyze job descriptions, and generate tailored resumes, cover letters, and recommendations. OpenAI does not use data submitted through its API to train its models (see openai.com/policies/privacy-policy).
• Document processing: services that extract text from uploaded documents and job description links when our own tools cannot.
• Email: providers of transactional email, marketing automation, and customer engagement tools.
• Analytics: platforms that help us understand how the Platform is used (Google Analytics is covered separately under "Advertising and affiliate tracking").
• Payments: Stripe, which handles all card details. Purchases are available only at you.uppl.ai, not through the ChatGPT plugin.

Advertising and affiliate partners. We share limited information with Google and Awin for advertising measurement and affiliate attribution, as described in the next section. We do not sell your personal information for money. However, some U.S. state privacy laws treat making personal information available to a business that is not acting as a service provider, even without payment, as a "sale" or "sharing" of personal information. You can opt out of this sharing as described under "Your choices."

Legal and safety reasons. We may disclose information when required by law, to enforce our policies, or to protect the rights, property, or safety of Upplai or others.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

We never send your resume, the content you create on Upplai, or your name to Google or Awin, and we never send your email address or other account details to Awin. Google Ads receives a hashed form of your email address only if you allow marketing cookies and have not opted out of sale or sharing, as described below.

We advertise through Google Ads (including on YouTube), use Google Analytics to understand how the Platform is used, and run an affiliate program through Awin, an affiliate network that pays publishers, such as cashback, coupon, and review sites, a commission when a visitor they referred makes a purchase. Google's and Awin's scripts load on every page of the Platform, and Google and Awin may collect information about your online activities over time and across different websites when you use the Platform.

We use Google Ads only to measure whether our ads lead to purchases. We do not use it to show you ads based on your activity on our site.

What continues regardless of your choices. Some tracking is controlled by Google or Awin, or by our agreement with Awin, and continues even if you decline cookies, opt out, or your browser sends a GPC signal:

• Google's cookieless signals. If you decline analytics or marketing cookies, Google's tags set no corresponding cookies and do not receive your hashed email address, but under Google's consent mode they still send signals without cookies. These include your IP address, browser details, and the page address and, on the purchase confirmation page, the order reference and amount. Google uses them for aggregated measurement and to estimate conversions.
• Awin's device recognition. On the purchase confirmation page, Awin's script reads technical characteristics of your browser and device, such as screen size and browser settings, to recognize your device ("device fingerprinting"), and may load technology from Awin's partners to do so. Awin uses this to attribute purchases to the referring publisher, including when a visit starts on one device and ends on another.
• Cashback and rewards references. If you arrive from a cashback, loyalty, or rewards site, Awin's script stores the click reference in a cookie (and copies in your browser's storage) for up to one year, and sends it with the purchase reports sent from your browser, marked to show whether you consented, so that your reward can be credited.
• Purchase reports. Every purchase is reported to Awin. A purchase without a click reference is not attributed to any publisher.

Awin's role. Awin may connect your visit to Upplai with your earlier visit to a publisher's website and with activity on your other devices. Awin is not our service provider for affiliate tracking: it decides for itself how it uses the information it receives and is responsible for its own compliance with privacy law. In the EEA and UK, Upplai and Awin are joint controllers of this processing (see "Additional information for users in the EEA and the UK"). Awin's practices, including how long it keeps information, are described at https://www.awin.com/us/privacy, and you can contact Awin at global-privacy@awin.com.

Google's role. Google's practices are described at https://policies.google.com/privacy and, for information from sites that use Google's services, at https://policies.google.com/technologies/partner-sites.

Cookies are small files stored by your browser that let a site recognize it. We use:

• Strictly necessary cookies, which keep you signed in (login cookies last 90 days and are removed when you log out), test whether your browser accepts cookies, and remember your privacy choices (for 180 days). They also include two cashback and rewards cookies, which we consider necessary to credit a reward you chose to earn by following a cashback, loyalty, or rewards site's link: one set by Upplai, which lasts 30 days and is not set if your browser sends a GPC signal; and one set by Awin's script, described under "Advertising and affiliate tracking." Neither is used for advertising.
• Analytics cookies, set by Google Analytics.
• Marketing cookies, set by Google Ads, Awin, or Upplai, which link purchases to ads and affiliate partners. Affiliate click cookies set by Upplai last 30 days.

Default settings depend on where you are, which we estimate from your IP address; if we cannot tell, we apply the EEA settings.

• EEA, UK, and other regions that require prior consent: analytics and marketing cookies are off unless you accept them.
• California: analytics and marketing cookies are on, but we treat you as having opted out of sale or sharing until you choose otherwise. This means our systems do not store or report a standard click reference to Awin for you, and Google Ads does not receive your hashed email address or use your information for ad personalization. Google's advertising cookies may still measure whether our ads led to a purchase unless you turn marketing cookies off.
• Elsewhere: analytics and marketing cookies are on, and you can turn them off at any time.

You can change your settings at any time from "Cookie Preferences" in our website footer, "Cookie Settings" on our app login page, or "Cookie Settings" in your account menu.

Opting out of sale or sharing. Wherever you live, you can opt out of the sharing described under "Advertising and affiliate tracking":

• Use the "Do Not Sell or Share My Personal Information" link in our website footer, or select that option in "Cookie Preferences" or "Cookie Settings." Turning off marketing cookies also opts you out.
• Email team@uppl.ai with the subject line "Privacy Request."

When you opt out, we delete the affiliate click cookies Upplai set on your device (other than the cashback and rewards cookies), stop reporting a standard click reference to Awin, and stop sending Google Ads your hashed email address or allowing ad personalization. If you leave marketing cookies on, Google's advertising cookies may still measure whether our ads led to a purchase; turning marketing cookies off stops this. Opting out does not stop the tracking listed under "What continues regardless of your choices."

Global Privacy Control. We treat a GPC signal from your browser as a request to opt out of sale or sharing, and it overrides our default settings. When we detect it, we turn marketing cookies off, and our systems do not set, store, or report any affiliate click reference for you, including our own cashback and rewards cookie. GPC does not stop the tracking listed under "What continues regardless of your choices."

Do Not Track. We do not respond to the older Do Not Track browser signal, because there is no common standard for interpreting it. Please use GPC or our cookie settings instead.

We will not discriminate against you for exercising any of these choices.

• Resume content, generated content, job descriptions, analyses, recommendations, and preference profiles on the Platform: for as long as your account is active.
• Analysis results and job descriptions processed through the ChatGPT plugin: 15 days, then permanently deleted.
• Purchase records (order reference, amount, currency, and promotion code): for as long as your account is active, so that you can view your purchase history and use the credits you purchased, and for seven (7) years after your account is closed, as needed for tax and accounting purposes, then deleted.
• Affiliate click references and consent choices stored with a purchase: twelve (12) months after the purchase, to allow time for commissions to be validated, then deleted.
• Records of your privacy choices: three (3) years after the choice is replaced or your account is deleted, so that we can show that we honored your choices, then deleted.
• Cookies: for the periods described under "Cookies."
• All other account data (including account information, login and activity data, and email interaction data): for as long as your account is active, then deleted within 30 days after your account is closed, except as described above.

Google and Awin keep the information they receive for the periods described in their own privacy policies.

If you have an account on the Platform, you can sign in at any time to view and edit your personal information, resume content, and preferences. Through the ChatGPT plugin, you can view analysis results only when the analysis is performed, and you cannot retrieve past results or edit or delete data.

To delete your account and associated data, email team@uppl.ai. We will delete your account and data within 30 days of receiving your request and confirm when done, except for information we must keep for the purposes and periods described above. Unused credits are forfeited when your account is deleted, as described in our Terms of Service.

We scan the Platform regularly for vulnerabilities and malware, encrypt information in transit using SSL/TLS, and restrict access to personal information to a limited number of people who are required to keep it confidential. We do not support password-based login: all sign-ins go through Google, Microsoft, or LinkedIn, which reduces the risk of credential-based attacks. No method of transmission or storage is completely secure, but we work to protect your information.

If a data breach affects your personal information, we will notify you by email or in-app notification where required by law, or where we otherwise determine that notice is appropriate, without undue delay and within any time period required by law.

This section applies if you are in the EEA or the UK and supplements the rest of this policy. Upplai Inc. is the controller of your personal information; you can contact us at team@uppl.ai.

Why we use your information (legal bases).

• To provide the services you request (your account, analyses, generated documents, and purchases), because it is necessary to perform our contract with you. If you do not provide your account information and content, we cannot provide these services.
• To send service emails and measure whether they are opened and clicked, provide support, keep our services secure, prevent fraud, and improve our services, based on our legitimate interests in running a safe and reliable service.
• For analytics and marketing cookies, and sending your hashed email address to Google Ads, based on your consent, which you can withdraw at any time in "Cookie Preferences" or "Cookie Settings." Withdrawal does not affect earlier processing.
• For Google's cookieless signals, based on our legitimate interest in measuring the effectiveness of our advertising in aggregate.
• For affiliate attribution with Awin, based on our and Awin's legitimate interests in operating a performance-based affiliate program, attributing sales accurately, and preventing fraud. Cookies and similar technologies for this purpose are used only with your consent, with three exceptions: Awin's script, which loads on every page whatever your choices and receives your IP address, browser details, and the page address; the cashback and rewards cookies, which we consider strictly necessary to provide the reward you requested; and Awin's device recognition on the purchase confirmation page, which Awin performs regardless of your choices and for which, like the loading of Awin's script, we and Awin rely on these legitimate interests.
• For marketing emails, based on your consent where the law requires it, and otherwise on our legitimate interests.
• To keep records of purchases and privacy choices, to comply with legal obligations and based on our legitimate interest in showing that we honored your choices.

Joint controllership with Awin. For affiliate tracking, cross-device tracking, and reporting, Upplai and Awin are joint controllers. Each of us is responsible for our own compliance; Upplai provides this notice and asks for your consent to cookies and similar technologies where required; Awin provides its own notice (linked above); and you can exercise your rights with either of us. The party that first receives your request is primarily responsible for responding, and we will cooperate with each other as needed.

International transfers. We process your information in the United States, and some of our service providers may process it in the United States or other countries. Where required, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses (with the UK addendum) or the EU-U.S. Data Privacy Framework and its UK extension. You can ask us for more information.

Your rights. You have the right to access, correct, delete, or receive a portable copy of your personal information; to restrict or object to our use of it, including objecting at any time to direct marketing; and to withdraw consent. These rights are subject to exceptions under the law. To exercise them, email team@uppl.ai with the subject line "Privacy Request." We may need to verify your identity, and we will respond within one month, or tell you if we need longer as the law allows. For information Awin holds, you may also contact Awin directly.

Complaints. Please contact us first at team@uppl.ai with the subject line "Privacy Complaint." We will acknowledge your complaint within 30 days and respond without undue delay. You may also complain to a data protection authority: in the EEA, the authority where you live or work or where the issue arose; in the UK, the Information Commissioner's Office (ico.org.uk).

Automated decision-making. Our job-fit, ATS, and keyword scores are generated automatically to help you improve your resume. We do not use them, or any other automated processing, to make decisions that have legal or similarly significant effects on you.

Upplai is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, please contact us at team@uppl.ai and we will delete it.

You can unsubscribe from marketing emails at any time using the link at the bottom of each email, or by emailing team@uppl.ai. We will still send you transactional and service emails about your account and purchases.

The Platform may link to third-party websites and services, which have their own privacy policies. We are not responsible for their content or practices.

We will post any changes on this page and update the "Last Updated" date above. If we make material changes, we will make reasonable efforts to notify you, for example by email or a notice on the Platform. You can view the Platform without creating an account, and you can update your personal information by signing in or by emailing us.