Privacy Policy

1. Who is responsible

For our marketing site and account administration, Uktupus is the controller of personal data we collect. For Customer Data your company stores in Uktupus (partners, employees, invoices, and similar business records), your company is typically the controller and we act as a processor on your instructions. Contact: hello@uktupus.com.

2. Data we collect

• Account data — name, email, password hashes, company affiliation, roles, and preferences
• Customer Data — business information you or your company enter into Uktupus (which may include personal data about employees, customers, or suppliers)
• Usage and device data — IP address, browser/app type, approximate location, logs, and product analytics needed to operate and secure the Service
• Communications — messages you send us (for example support or “Book a demo” requests)
• Billing data — where applicable, billing contacts and payment status (card details are handled by our payment processors)

3. How we use data

• Provide, secure, and improve the Service
• Authenticate users and enforce company permissions
• Communicate about the Service, security, and (where allowed) product updates
• Process subscriptions and prevent fraud or abuse
• Comply with legal obligations and resolve disputes

We do not sell personal data. We do not use Customer Data to train public AI models.

4. Legal bases (EEA/UK and similar)

Where GDPR or similar laws apply, we rely on: performance of a contract; legitimate interests (security, product improvement, B2B communications that do not override your rights); consent where required; and legal obligation.

5. Sharing

We share personal data with subprocessors who help us host, send email, process payments, monitor uptime, or provide support — under contracts that require appropriate protection. We may disclose data if required by law or to protect rights, safety, and the integrity of the Service. Company admins can see membership and activity within their workspace.

6. International transfers

Data may be processed in countries other than where you live. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers.

7. Retention

We keep account and Customer Data for as long as your company uses the Service and for a reasonable period afterward for backups, legal claims, and compliance — then delete or anonymize it. You may request deletion subject to legal retention duties and your company’s controller instructions.

8. Security

We use industry-standard measures including encryption in transit, access controls, company-scoped tenancy, and monitoring. No method of transmission or storage is fully secure; please use strong passwords and protect your credentials.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing or withdraw consent. For data your company holds in Uktupus, contact your company admin first. You can also email hello@uktupus.com. You may lodge a complaint with your local supervisory authority.

10. Cookies and similar tech

We use essential cookies and local storage for authentication and security. We may use limited analytics to understand product usage. You can control cookies through your browser settings; disabling essential cookies may break sign-in.

11. Children

The Service is built for business use and is not directed to children under 16. We do not knowingly collect personal data from children.

12. Changes

We may update this Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be communicated in-product or by email where appropriate.