Privacy policy

Who we are

Upfix (https://upfix-eosin.vercel.app) is provided by Upfix. We are the controller of the personal data in this policy. Questions? E-mail support@example.com.

What data we process

Account: your e-mail address, name (if you provide it or Google shares it), language preference and sign-in times.

Workspace: the sites you add, tracked keywords, backlink lists with the contact details and notes you enter, audit results and your searches in the tools.

Google Search Console: if you connect it, we store an encrypted refresh token. With it we read clicks, impressions and positions of the properties you choose, when you view them or for the weekly report.

Payments: handled by Stripe. We don't receive full card details, but do receive your billing details, subscription status and invoices.

Technical: server logs (IP address, time, requested page) for security and debugging, and counters of your tool usage for your monthly allowance.

Why (purpose and legal basis)

To provide the service and manage your subscription (performance of the contract).

To secure the service, prevent abuse and fix errors (legitimate interest).

To keep invoices (legal obligation).

We don't use your data for advertising and don't sell it.

Google data (Limited Use)

Upfix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Search Console data to show it to you and your workspace members and in your weekly report. We don't use it for advertising, don't sell it, and don't let humans read it except with your consent, for security, or when required by law.

You can disconnect at any time in Settings or in your Google account (myaccount.google.com/permissions).

Who we share data with (processors)

Hosting and database: Vercel and Neon (servers in the EU).

E-mail: Resend (sign-in links, invitations, weekly reports).

Payments: Stripe.

SEO data: DataForSEO receives the keywords and domains you look up, no personal data about you.

Google: for signing in with Google and Search Console.

We have a data processing agreement with each processor. Transfers outside the EEA use the European Commission's standard contractual clauses.

How long we keep data

As long as your account exists. If you delete your account, we erase your data within 30 days, except invoices (7 years, legal obligation). Sign-in links expire after 20 minutes; sessions after 30 days. We keep up to 26 audits per site.

Cookies

We only use strictly necessary cookies: a session cookie to keep you signed in, a language cookie, and a temporary cookie while connecting Google. No analytics or advertising cookies, so no cookie banner.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You can download your data and delete your account yourself in Settings, or e-mail support@example.com. You can also complain to your data protection authority (in Belgium: dataprotectionauthority.be).

Security

Connections are encrypted (HTTPS). Google tokens and API keys are stored encrypted. Sign-in is passwordless, with one-time links or Google.