Privacy Policy

2. Upwork API Data

When you connect your Upwork account, we access message rooms and conversation history, job posting information, proposal and contract details, and freelancer and client profile information. We use this data to power the AI assistant, analyze conversations, populate the dashboard, and store context for personalized responses.

Messages are processed by third-party AI language models (such as Google Gemini, Anthropic Claude, and OpenAI GPT) to generate responses and score lead priority. We send only the minimum necessary context. All AI provider integrations are configured with training opt-out flags, and we select only providers that contractually commit to not using customer data for model training.

3. Information We Collect

Directly from you: account information (name, email, payment details), profile and knowledge base content you provide to configure the AI assistant, and communications through the Service.

Automatically: usage data, device information (browser, OS, IP address), log data, and cookies as described in our Cookie Policy.

From integrations: Upwork (section 2), Google Calendar (section 1), and Telegram (user ID, username, message content when you connect for notifications).

4. Legal Basis for Processing (GDPR)

For EEA and UK users, we process personal data on the following grounds:

• Contractual necessity (Article 6(1)(b)): providing the Service, managing your account, and processing payments.
• Consent (Article 6(1)(a)): connecting third-party accounts and enabling the AI assistant to send messages on your behalf. You may withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)): improving the Service, preventing fraud, and ensuring security.
• Legal obligation (Article 6(1)(c)): complying with tax and accounting requirements.

5. How We Use Your Information

• Providing, operating, and maintaining the Service
• Powering the AI assistant to respond to client messages
• Analyzing conversations to determine lead priority and recommended actions
• Scheduling meetings based on your calendar availability
• Sending notifications via your connected messaging platform
• Processing payments and managing your subscription
• Improving the Service through aggregated, anonymized analytics
• Communicating about updates, security alerts, and support
• Complying with legal obligations

6. How We Share Your Information

We do not sell your personal data. We share information only as follows:

AI processing providers: conversation data is shared with Google, Anthropic, and OpenAI solely to generate AI responses. All integrations use training opt-out flags and providers contractually commit to not using your data for model training.

Infrastructure providers: we use third-party providers to host and operate the Service under GDPR-compliant data processing agreements. A current list of sub-processors is in our Data Processing Addendum.

Payment processors: payment information is processed by Stripe, Inc. We do not store full card numbers.

Legal requirements: we may disclose information if required by law, regulation, or governmental request.

Business transfers: in the event of a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy. For Google user data, we will obtain your explicit prior consent.

7. Data Retention

• Account data: retained for the duration of your account, plus 30 days after deletion
• Conversation data: retained for the duration of your account
• Google Calendar data: availability is queried in real-time and not stored. Event metadata is retained for the duration of your account.
• Payment records: retained for 7 years to comply with UK tax requirements
• Usage logs: retained for 12 months, then automatically deleted

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

8. Data Security

We implement industry-standard security measures including TLS 1.2 or higher for data in transit, AES-256 encryption at rest, access controls, regular security assessments, OAuth 2.0 for third-party integrations, and automated monitoring.

In the event of a data breach, we will notify you within 48 hours and notify the relevant supervisory authority within 72 hours as required by GDPR Article 33.

9. Your Rights

If you are in the EEA or UK, you have the right to access, rectify, erase, restrict processing of, and port your personal data; to object to processing based on legitimate interests; to withdraw consent; and to lodge a complaint with the UK ICO at ico.org.uk.

US state residents (California CCPA/CPRA, Virginia, Colorado, Connecticut, and others) have the right to know what data we collect, request deletion, and opt out of data sales (we do not sell personal data).

To exercise any right, contact us at [email protected]. We will respond within 30 days.

10. International Data Transfers

Your data may be transferred to countries outside the EEA and UK, including the United States. We ensure appropriate safeguards including Standard Contractual Clauses and data processing agreements with all sub-processors.

11. Children's Privacy

Our Service is not directed to individuals under 18. We do not knowingly collect personal data from children. Contact us at [email protected] if you believe we have collected data from a child.

12. AI and Automated Decision-Making

Our Service uses AI to generate automated responses, analyze conversations, score leads, and suggest actions. These features assist you and do not replace your judgment. You retain full control over whether the AI sends messages automatically or operates in draft mode. Under GDPR Article 22, you have the right not to be subject to solely automated decisions with legal effects.

13. Changes to This Policy

We will notify you via email or prominent notice within the Service of material changes. For changes affecting Google user data, we will prompt you to consent before continuing to use Google-integrated features.

14. Contact