Legal

Privacy Policy

Version 1.6. Effective October 22, 2026.

This policy explains what personal data we collect when you use our website, create an account, place an order or send us a request, why we use it, how long we keep it and who we share it with. We sell to businesses only. We collect only what we need to sell, deliver and support our products. We do not sell personal data, we do not use it for targeted advertising, and our website uses only strictly necessary cookies. When we work inside your systems to deliver an order, we act on your instructions as your processor under our Data Processing Addendum. You can contact us about your data at any time at hello@upmarklabs.com.

1. Who we are

This website is operated by UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India (“we”, “us”, “our”). Legal form: Sole proprietorship registered in India. Registration: C/1653345, under the Madhya Pradesh Shops and Establishments Act, 1958.

The data controller for the personal data described in this policy is UPMARK (Amit Govil). This means we decide why and how that personal data is used. For questions about this policy or your personal data, email hello@upmarklabs.com. This address is also the contact point for grievances under India’s Digital Personal Data Protection Act, 2023.

This policy applies to personal data we handle through our website, customer accounts, orders, invoices, the Custom AI request form, the “Talk to an expert” discovery form and the emails we exchange with you. It does not apply to personal data we handle inside your systems while delivering an order. That is covered by section 5 and by our Data Processing Addendum.

2. Terms used in this policy

Personal data means any information that relates to an identified or identifiable individual. It includes “personal information” and “digital personal data” as those terms are used in the laws listed in section 9.
Processing means anything done with personal data, such as collecting, storing, using, sharing or deleting it.
Controller means the person or organization that decides why and how personal data is processed. Under India’s DPDP Act the equivalent term is “data fiduciary”.
Processor means a person or organization that processes personal data on behalf of a controller and only on its instructions. Under India’s DPDP Act the equivalent term is “data processor”.
Subprocessor means a third party we engage that processes personal data on our behalf.
Customer means the business that places an order with us. “You” means the individual whose personal data we process, for example a person who places an order or sends a request on behalf of a business.
Website means the website on which this policy is published, including the store, checkout and account area.
DPA means our Data Processing Addendum.
UK/EU GDPR means the General Data Protection Regulation (EU) 2016/679 and, in the United Kingdom, the UK GDPR and the Data Protection Act 2018.
DPDP Act means India’s Digital Personal Data Protection Act, 2023 and the rules made under it.

3. Personal data we collect and where it comes from

Our products are sold to businesses only. Most of the personal data we hold is business contact information about the people who order from us or contact us on behalf of a business.

3.1 Account and order data

When you create an account at checkout and place an order, we collect:

your name, work email address and company name;
your billing address;
your phone number (optional);
a VAT or tax identification number (optional);
a purchase order number (optional);
your account login details;
the contents of your order, its status, invoices and the history of the order; and
a record of the documents you agreed to at checkout (our Terms of Use, this Privacy Policy, the product’s Scope Card and the 72-hour intake rule), including the version accepted, the time of acceptance and the IP address used.

3.2 Payment data

Card and PayPal payments will be processed by PayPal once that option is enabled. We never see or store full card details. We receive confirmation of whether a payment succeeded, the amount and the transaction reference. If you ask to pay by bank transfer, we receive the payment details that appear on our bank records, such as the name and account of the payer. We use these details to match your payment and, if a refund is due, to return funds to the paying account.

3.3 Request data

When you use the Custom AI request form or the “Talk to an expert” discovery form, we collect:

your name, work email address and company name;
your phone or WhatsApp number (optional);
your company website (optional);
your industry;
your message, budget and timeline; and
your IP address, which we keep briefly to limit repeated submissions and to filter spam.

We filter spam with a hidden form field and timing checks. We do not use a third-party CAPTCHA service.

3.4 Intake and delivery data

After you place an order, you complete an intake checklist and give us access to the systems we need to connect. We collect the contact details of the people we work with at your business and the information and files you supply for the project. Some of this information may contain personal data of your own customers or staff. For that personal data we act as your processor. See section 5.

3.5 Communications

We keep the emails we exchange with you, including order emails, intake reminders, request confirmations, support questions and refund requests.

3.6 Technical data

Our website uses only strictly necessary cookies and browser local storage, as described in our Cookie Policy. These keep you logged in, keep your cart and checkout session working and remember your product compare list in your own browser. If you accept analytics cookies in our cookie banner, Google Analytics also records how you use the website: pages viewed, the device and browser type, your approximate location (country or city), how you arrived, and whether you sent a form or placed an order, with the order number and value. It does not record your name or email address, and it does not store your IP address. If you reject or make no choice, none of this is collected. We do not use advertising or cross-site tracking cookies.

3.7 Where the data comes from

From you, when you create an account, place an order, fill in a form, complete intake or email us.
From a colleague, when someone at your business names you as a contact for an order or project.
From our payment provider and bank, which tell us whether a payment was made.
From your device, which sends your IP address and cookies to our website when you use it.

3.8 Data we do not want

Please do not send us sensitive personal data, such as health information or government identity numbers, in forms or emails unless an order requires it and we have agreed in writing how it will be handled. Never send passwords, API keys or other secrets by plain email. We will never ask you to.

3.9 Referral partners, resellers and referred clients

If you apply to our referral partner or reseller programme, we collect the details in the application form. If we invite you to continue, we also collect your legal name, business details, address, phone number, website, a copy of a photo ID, an optional proof of business, your payout details (partners) and a record of the agreement you sign (the name you typed, the date and time, and your IP address). We use them to verify who you are before we work with you, to prevent fraud, to run the programme and to pay you, under our agreement with you and our legitimate interest in knowing who we work with.

ID and business documents are stored in a private area of our server that is not reachable from the web, and only our administrators can open them. We delete the documents 90 days after we approve or decline your application, and keep only the record that the check was done.

A referral partner may register your business with us before you buy, giving your company name, your name and your work email, and confirming that you know they are doing so. We keep this for 90 days, only to decide which partner referred you, and then delete it unless you became our client through that partner.

If you buy after arriving through a referral partner’s link or entering their code, we record which partner referred you. We tell that partner the date and value of your referred orders and a masked version of your email address (for example j***@example.com), so they can see the commission they earned. We do not share your name, full email address, order details or intake information with the partner.

3.10 The portal

Our portal at upmarklabs.com/portal keeps, for each account: login details, team members the account owner invites (their name and work email), messages to our team, a record of which system access you gave us for an order and whether you removed it, and a short-lived login code we email if two-step login is on (the code is stored only as a scrambled value and expires after 10 minutes). If you trust a device, a cookie on that device remembers it for 30 days. You can download a copy of your account data from Account settings at any time.

Resellers can keep a list of their own clients in the portal and can share a private link that shows one order’s progress, files and intake form to their client. For that data the reseller is the controller and we act as their processor under our Data Processing Addendum. Anyone holding a share link can open it until the reseller turns it off.

4. How we use personal data and our lawful bases

The UK/EU GDPR requires us to have a lawful basis for each use of personal data. The table below lists each purpose and the basis we rely on.

Purpose	Personal data used	Lawful basis (UK/EU GDPR)
Create and manage your account	Account data	Performance of a contract where you contract in your own name. Otherwise our legitimate interest in providing the account to the business you represent.
Process orders, take payment, issue invoices and handle refunds	Account and order data, payment data	Performance of a contract, or our legitimate interest in dealing with the business you represent. Legal obligation for tax and accounting records.
Record which documents you agreed to, when, and from which IP address	Agreement records	Legitimate interest in proving the terms of each order and in establishing, exercising or defending legal claims.
Run intake, deliver the order, provide revisions, acceptance and post-launch support	Account and order data, intake contact details, communications	Performance of a contract, or our legitimate interest in delivering the order to the business you represent.
Send service emails, such as order updates, intake reminders and request confirmations	Name, work email, order or request details	Performance of a contract, or our legitimate interest in keeping customers and enquirers informed.
Reply to Custom AI and “Talk to an expert” requests and prepare quotes	Request data	Steps taken at your request before entering into a contract, or our legitimate interest in responding to business enquiries.
Prevent spam and abuse of our forms through rate limiting	IP address, form timing	Legitimate interest in keeping our website secure and usable.
Keep the website working and secure, including login and cart cookies	Strictly necessary cookies, IP address	Legitimate interest in providing a secure website. These cookies are strictly necessary, so consent is not required for them.
Measure how the website is used, with Google Analytics, to improve it	Analytics data described in section 3.6	Consent, given in our cookie banner. You can withdraw it at any time with the “Cookie settings” link at the bottom of every page.
Handle disputes, chargebacks and legal claims	Account and order data, agreement records, communications	Legitimate interest in establishing, exercising or defending legal claims. Legal obligation where applicable.
Comply with the law, including tax law and lawful requests from authorities	Any data we hold, as required	Legal obligation.

4.1 Legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. Our interests are running and protecting our business, dealing with the businesses that buy from us, and keeping records of what was agreed. Because our customers are businesses, we often rely on legitimate interests for the people who act on their behalf. You can object to processing based on legitimate interests. See section 9.

4.2 India: consent and legitimate uses

Under the DPDP Act, we process digital personal data on the basis of the consent you give when you submit a form or place an order, or for a legitimate use permitted by the DPDP Act, such as where you have voluntarily provided the data for a specified purpose, or where processing is needed to comply with law. You may withdraw consent at any time. Withdrawal does not affect processing that took place before it, and we may still keep data where the law requires us to.

4.3 Data you must provide

We need your name, work email, company and billing address to create an account and process an order, and we need intake information to deliver it. If you do not provide this data, we cannot accept or deliver the order. Fields marked optional can be left blank.

4.4 Marketing

We do not currently send marketing email. The emails we send relate to your account, orders and requests. If we start sending marketing email, we will do so only where the law allows, and every message will include a simple way to opt out.

4.5 Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our spam checks may block a form submission that looks automated. If this happens, email hello@upmarklabs.com and we will deal with your request directly.

5. When we act as a processor

To deliver an order, we work in your own accounts and systems, such as your CRM, helpdesk, online store, telephony, WhatsApp and AI model provider accounts. These systems may contain personal data of your customers, staff or other individuals. For that personal data:

the customer is the controller and we are its processor;
we process it only to deliver the order, on the customer’s documented instructions;
our Data Processing Addendum applies and forms part of the contract; and
access uses accounts and API keys the customer creates, can limit and can revoke at any time.

AI model usage runs in the customer’s own provider accounts. We do not process customer data through AI provider accounts of our own. The customer’s own providers (for example its AI model, telephony or WhatsApp providers) are contracted by the customer and are not our subprocessors.

If you are an individual whose data is held by one of our customers, please contact that customer first. If you contact us, we will pass your request to the customer and help it respond.

6. How long we keep personal data

We keep personal data only for as long as we need it for the purposes in section 4, then we delete it or make it anonymous. The periods below apply to data for which we are controller.

Category	Retention period
Orders, invoices, payment records and the agreement records attached to orders	As long as tax and accounting law requires, and at least 8 years from the end of the financial year in which the order was placed.
Partner and reseller ID and business documents	90 days after we approve or decline the application, then deleted. The record that we checked them is kept with the account data.
Partner and reseller profiles, agreement records and commission or payout records	While you are in the programme, plus 8 years for payout and tax records and 2 years for the rest.
Account data	While the account is active, plus 2 years after it closes or was last used.
Requests that do not become orders (Custom AI and “Talk to an expert”)	24 months from our last contact about the request.
Requests that become orders	Kept with the order record, as above.
Communications about an order	Kept with the order record, as above.
Email delivery log (recipient, subject, time and result, never the message)	30 days, then deleted.
IP addresses used for rate limiting and spam control	A few hours, then deleted.
Cookies and local storage	As set out in our Cookie Policy.
Data we process as a processor during delivery	As set out in the Data Processing Addendum. Our access to customer systems is removed at the end of the engagement or support period on request.

We may keep data for longer if we need it to establish, exercise or defend a legal claim, or if the law requires it. In that case we keep only what is needed and only for as long as needed.

We share personal data only where needed for the purposes in section 4. We require the recipients who act on our behalf to protect it and to use it only to provide their service to us.

Subprocessors and service providers. PayPal for card and PayPal payments, once enabled. Contabo GmbH for website and database hosting on servers in Germany. Our transactional email provider for sending service emails. Google, for website analytics, only for visitors who accept analytics cookies. The banks we use, when you pay by bank transfer on request. The current list, with the purpose and location of each, is on our Subprocessors page.
Subcontractors. We may use vetted subcontractors to help deliver an order. They work under confidentiality obligations and we remain responsible for them.
Professional advisers. Accountants, auditors and lawyers, where needed for their advice, under a duty of confidentiality.
Authorities. Tax authorities, courts, regulators and law enforcement, where the law requires it or where needed to establish, exercise or defend legal claims.
A buyer or successor of the business. If the business or its assets are transferred, personal data may transfer to the new owner, who must use it in line with this policy.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising or targeted advertising.

8. International transfers

We are based in India and serve business customers worldwide. Our website and database are hosted by Contabo GmbH on servers in Germany. Personal data is accessed from India by us and may be processed in other countries by our subprocessors, such as PayPal, which operates globally, and Google, which processes analytics data in the United States and other countries.

Where the UK/EU GDPR applies and we transfer personal data to a country that does not have an adequacy decision, we rely on an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, or, where those do not apply, on a permitted exception, such as the transfer being necessary to perform a contract with you or at your request. You can ask for more information about the safeguards we use by emailing hello@upmarklabs.com.

Under the DPDP Act, we transfer personal data outside India only to countries that are not restricted by the Government of India.

9. Your rights

Your rights depend on where you live and which laws apply. We will honor the rights below wherever the law gives them to you.

9.1 UK and EU (UK/EU GDPR)

Access: to get a copy of your personal data and information about how we use it.
Rectification: to have inaccurate data corrected and incomplete data completed.
Erasure: to have your data deleted in certain cases, for example when we no longer need it.
Restriction: to ask us to limit how we use your data in certain cases.
Portability: to receive data you gave us in a structured, commonly used, machine-readable format, or to have it sent to another organization, where processing is based on consent or contract and carried out by automated means.
Objection: to object to processing based on legitimate interests. You can always object to direct marketing.
Withdraw consent: where we rely on consent, at any time, without affecting earlier processing.
Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not make such decisions.

9.2 India (DPDP Act)

to obtain a summary of the personal data we process about you and the processing activities;
to know the identity of the other data fiduciaries and data processors with whom we have shared your data, and the categories of data shared;
to have your data corrected, completed, updated or erased;
to withdraw consent, as easily as you gave it;
to have your grievances addressed by us, at hello@upmarklabs.com; and
to nominate another individual to exercise your rights if you die or become incapable.

9.3 United States, including California

Depending on the state where you live, US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, may give you the right:

to know the categories and specific pieces of personal information we collect, use and disclose;
to delete personal information;
to correct inaccurate personal information;
to receive a portable copy of your personal information;
to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We do not sell or share personal information, do not engage in targeted advertising and do not carry out such profiling, so there is nothing to opt out of;
to limit the use of sensitive personal information. We use sensitive personal information only to provide our services, as the law allows (for example, account login details to let you sign in);
to appeal our decision on your request, where your state law provides it. To appeal, reply to our decision or email hello@upmarklabs.com with “Appeal” in the subject line; and
not to be discriminated against for exercising your rights.

California disclosures. In the past 12 months we have collected the following categories of personal information, from the sources in section 3.7, for the purposes in section 4: identifiers (such as name, email address and IP address); customer records (such as billing address, phone number and tax ID); commercial information (such as orders and payment status); professional information (such as company name and industry); internet or other electronic network activity (strictly necessary cookies and IP addresses used for security); and sensitive personal information limited to account login details and, for referral partner and reseller applicants only, a copy of a government photo ID used to verify identity. We disclose these categories for business purposes to the recipients in section 7. We have not sold or shared personal information in the past 12 months, and we have no actual knowledge of selling or sharing personal information of anyone under 16. We keep each category for the periods in section 6.

9.4 How to exercise your rights

Email hello@upmarklabs.com from the email address linked to your account or request, and say which right you want to exercise. Account holders can also update some details in the account area.
We may ask for information to verify your identity before we act. We use this information only for verification. If we cannot verify your identity, we will tell you.
In California and some other states, you may use an authorized agent. We may ask the agent for proof of authority and may ask you to verify your identity directly.
We do not charge a fee, unless a request is clearly unfounded or excessive, where the law allows a reasonable fee or a refusal.

Response times. We confirm receipt and respond within the time the applicable law sets:

UK/EU GDPR: within one month of receiving the request. For complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month.
US state laws: within 45 days. Where the law allows, we may extend this by a further 45 days, and we will tell you within the first 45 days.
DPDP Act: within the period set by the DPDP Act and its rules.

Some rights have limits. For example, we cannot delete order and invoice records that tax law requires us to keep. If we cannot fully meet a request, we will explain why.

10. Security

We use measures suited to the data we hold. Our website uses HTTPS. Admin access is limited to named staff with individual accounts. Access to customer systems uses accounts and keys that the customer creates, can limit to the least privilege needed and can revoke at any time. We never request or send secrets by plain email. We use customer data only to deliver the order. No method of storing or sending data is fully secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where the law requires. More detail is on our Security page. Report vulnerabilities to hello@upmarklabs.com.

11. Children

Our website and products are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, email hello@upmarklabs.com and we will delete it.

12. Cookies and similar technologies

We use strictly necessary cookies and local storage: login cookies, cart and session cookies, and local storage for the product compare list and your cookie choice. Google Analytics cookies are set only if you accept them in our cookie banner, where rejecting is as easy as accepting, and you can change your choice at any time with the “Cookie settings” link at the bottom of every page. We do not use advertising cookies. Our Cookie Policy lists each cookie and its purpose.

13. Third-party services and links

Our website may link to other websites, and our products connect to third-party platforms that you choose and contract with directly. Those providers handle personal data under their own privacy policies. We are not responsible for their practices. Please read their policies.

14. Changes to this policy

We may update this policy when our practices or the law change. The version number and effective date are shown on this page. When we publish a new version, it applies from its effective date. If a change is material, we will tell account holders by email before it takes effect. The version you accepted when placing an order is stored with that order.

15. Contact us

For any question, request or complaint about your personal data, email hello@upmarklabs.com. You can also write to UPMARK at 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India. For questions about orders, email hello@upmarklabs.com. For security issues, email hello@upmarklabs.com.

16. Your right to complain

If you are not happy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to a supervisory authority, in particular:

in the United Kingdom, the Information Commissioner’s Office (ICO);
in the European Economic Area, the data protection authority in the country where you live, work or where the issue arose;
in India, the Data Protection Board of India, after first using our grievance process at hello@upmarklabs.com; and
in the United States, your state attorney general or, in California, the California Privacy Protection Agency.

Version history

Version	Date	Change
1.6	October 22, 2026	Added website analytics with Google Analytics, only with your consent in the cookie banner.
1.5	October 20, 2026	Added the portal: team members, access records, two-step login codes, trusted devices, data download, and reseller client lists and share links.
1.4	October 19, 2026	Added how referral partners can register a business before it buys, and how long we keep that. Added the 30-day email delivery log.
1.3	October 19, 2026	Added identity checks for referral partner and reseller applicants, and the 90-day deletion of their documents.
1.2	October 16, 2026	Clarified that the website is operated by UPMARK, a sole proprietorship of Amit Govil.
1.1	October 14, 2026	Added how referral partner and referred-client data is used.
1.0	October 13, 2026	First published version.