UpAction Privacy Policy
This policy explains what data the UpAction app (an action and progress tracker) and the upaction.pro site collect, why, who processes it and how you can control it.
1. Who is responsible for the data
Data controller: FOP Mazepa N.V. (sole proprietor), tax ID 3188510120, Oplitsko village, Lviv region, Ukraine, my.uplevel.pro@gmail.com.
Send every question about your data to this address.
2. What we collect
Profile: Telegram ID, first name, username, language and time zone (taken from Telegram when you sign in through the bot or the mini app).
E-mail: if you sign in or link an address we keep it and the one-time sign-in codes. Signing up without Telegram works by e-mail only.
Your content: the actions you create, their check-ins, skip reasons and notes you type, experience and achievements, reminder settings. This is your data: enter only what you want to, and avoid unnecessary health details.
Subscription and payments: plan, dates, status, order numbers, amounts. Card data is processed by the payment provider WayForPay; we neither see nor store it.
Consent to marketing e-mails: the date and the text version, if you gave it (a separate consent, off by default).
Push notifications: the technical subscription key of your browser, if you turned them on.
Technical data: IP address and device type in server logs, error reports that do not contain your entries.
3. Why we use it
To run the app: sign-in, your actions and progress, reminders in Telegram, e-mail or push.
To set up and serve the subscription: payment, charge reminders, confirmations, refunds.
To contact you about the service; marketing e-mails only with your separate consent, which you can withdraw at any time.
To protect the service and find errors.
We do not sell data, show ads or pass you to advertising networks.
Legal bases: performance of a contract (account, subscription, payment), your consent (marketing e-mails, push notifications) and legitimate interest (security of the service, finding errors).
4. Specialists and your data
If you joined a specialist through their invite link, the specialist sees the data tied to your work together: the actions they assigned to you and your progress on them. You can end the connection in the app; your other entries are not shared with the specialist. If the specialist's workspace is connected to their CRM through an API key, only summary figures of your activity are passed there (last active date, streak, active days, completion rate, status), not your notes or individual check-ins.
The specialist is responsible for the lawfulness of processing their clients' data. The terms for specialists are a separate document.
5. Who receives the data
Only services UpAction cannot work without: Telegram (sign-in and reminders), WayForPay (payments), Brevo (transactional e-mails), Railway (hosting of the app), Supabase (database), Upstash (cache and request counters), Sentry (technical error diagnostics, set up without personal data), the push services of your browser.
We may disclose data where the law requires it. The application server (Railway) and the database (Supabase) are located in the EU, the cache (Upstash) in the USA; the cache holds no entries of yours, only temporary summaries and counters. Telegram, WayForPay and Brevo process data in their own jurisdictions under their own policies.
7. How long we keep data
Check-ins are deleted automatically after 365 days, the notification log after 90 days, technical retry keys after 7 days.
Your profile and actions are kept while you use the account. Payment records are kept as long as accounting and law require.
8. Your rights
You can ask for a copy of your data, have it corrected, delete the account or restrict processing, and withdraw your consent to marketing e-mails (in the subscription settings or by e-mail).
Write to my.uplevel.pro@gmail.com from the address or Telegram account linked to the profile. We delete the account and data within 30 days, except records the law requires us to keep (for example payments).
If you are in the EU or EEA you have rights under the GDPR, including a complaint to a supervisory authority. In Ukraine: the Ombudsman of the Verkhovna Rada.
9. Children and sensitive data
The app is not meant for children under 16. It is not a medical service; do not enter diagnoses or treatment details unless you need them yourself.
10. Changes and contact
The current version is always on this page. We will tell you about material changes in the app or by e-mail. Contact: my.uplevel.pro@gmail.com.