Privacy Policy
Last updated: 2026-10-15
This policy explains what personal data UpRadar.ai (the “Service”) collects, why, who receives it, how long we keep it, and your rights. It covers our website (upradar.ai), our app (app.upradar.ai), the free audit and our emails.
1. Who we are
The Service is operated by MAYA Tech Services LLC, a Delaware limited liability company, 8 The Green, Ste A, Dover, DE 19901, USA (“UpRadar”, “we”, “us”). Contact for everything, including privacy requests: hello@upradar.ai.
We are the controller of your account, billing, free-audit, email and usage data. For content you enter about your brand or your clients’ brands (such as competitor names and custom prompts), we act as your processor where the law requires it, under our Data Processing Addendum.
UpRadar is offered to businesses in the United States.
2. What we collect
- Account data: your email address and sign-in account ID. Passwords are handled by our sign-in provider (Supabase) and never stored by us.
- What you enter in the Service: brand details, topics, custom prompts, competitor names and domains, and onboarding answers.
- Free audit: the website address you enter, the optional “I’m a…” answer, and the email address you give to unlock the full report.
- Payment data: from Stripe, your customer and subscription IDs, plan, status and payment outcome. We never receive your full card number.
- Automatically: IP address, browser and device information, the link source (UTM tags and referring page), usage of the Service, and error reports.
- From AI engines: the answers AI engines give to questions about your brand, and the sources they cite. These answers can mention people, such as a company’s founders.
- From the website you submit: when you request an audit, our crawler (UpRadarBot) reads public pages of the website you submit to assess how AI engines can cite it; see upradar.ai/bot.
- Messages you send to hello@upradar.ai.
We do not collect your name, phone number, postal address, card details or sensitive personal information.
3. Why we use it
| Purpose | Legal basis (EEA/UK GDPR, Art. 6) |
|---|---|
| Provide your account, audits, reports and weekly digest | Contract |
| Run a free audit you request, email you the report and up to two follow-up emails about it (one-click unsubscribe) | Legitimate interest in providing and following up on what you asked for |
| Prevent abuse and keep the Service secure | Legitimate interest |
| Measure which marketing channels bring visitors | Legitimate interest |
| Product analytics in the app | Consent (cookie banner), which you can withdraw at any time |
| Server events showing that an audit or payment completed (no name or email) | Legitimate interest in knowing the Service works |
| Take payments, handle refunds, keep tax and accounting records | Contract; legal obligation |
| Answer messages and privacy requests; defend legal claims | Contract; legal obligation; legitimate interest |
Where we rely on legitimate interest, you can object (section 7). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal data or share it for advertising.
4. Who receives it
- AI engine providers. To run audits we send questions about your brand, domain, category and tracked competitors, and your custom prompts, to AI engines through their business APIs: OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini) and Perplexity, and, only if you turn them on, Mistral models (served through OpenRouter, Inc. and the hosting providers it routes to), xAI (Grok) and DeepSeek. We also use OpenAI to analyze answers and suggest setup items. We never send your email address, account ID or payment details. Results may differ from what you see in the providers’ consumer apps.
- DeepSeek is customer-directed: we query it only if you turn it on, and you can turn it off at any time. When it is on, it receives the same questions as the other engines you track — including your custom prompts — so that the DeepSeek results in your reports are complete. It processes data in the People’s Republic of China and may use inputs to train its models; we show you a notice before you turn it on. Don’t put personal or confidential information in prompts you want DeepSeek to answer.
- Service providers (sub-processors) that host and operate the Service for us. The current list, with what each one does and where, is at upradar.ai/legal/subprocessors. We give at least 30 days’ notice before adding one.
- Authorities or others when the law requires it, or to protect our rights, our users or the public.
- A buyer or successor in a merger, acquisition or sale of assets; we will tell you before your data becomes subject to a different policy.
We use the providers’ paid business APIs, under which they do not train models on our requests (except DeepSeek, as described above). Mistral requests are routed through OpenRouter, Inc., a US-based API router, under its paid business terms, with routing to endpoints that train on request data disabled in our account.
Please don’t put personal or confidential information in your prompts or brand description — it is sent to the AI engines you track. If you are mentioned in an AI answer we store and want it removed, email us.
5. International transfers
We are based in the United States and process data there; some providers process data elsewhere, including the EU. For personal data from the EEA, the UK or Switzerland, our providers rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where certified, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum). DeepSeek processes data in China, which has no EU or UK adequacy decision, and offers no data-processing agreement; it receives data only if you turn it on.
6. How long we keep data
| Data | How long |
|---|---|
| Account data, what you enter, audit history and AI answers | Until you delete your account |
| Free-audit results not linked to an account | 90 days |
| Email given to unlock a free report (no account) | 24 months after our last email to you |
| IP addresses stored with audit records | 30 days |
| Audit event records (domain audited, link source) | 13 months |
| Billing records (plan, dates, payment references) | 7 years, for tax and accounting |
| Unsubscribe list | As long as needed to honor your opt-out |
| Analytics and error data | Per our analytics and error-monitoring providers’ retention settings |
We may keep data longer only where the law requires it or to resolve a dispute. You can delete your account in Settings at any time; we then delete your content right away, except the billing record (without your name or email), the records Stripe must keep, and the unsubscribe list. Copies in our providers’ backups are deleted on their regular cycle.
7. Your rights
EEA, UK and Switzerland. You can access, correct, erase or port your data, restrict or object to our processing (including at any time to direct marketing), and withdraw consent at any time. You can also complain to your data protection authority (in the UK, the ICO).
United States. Wherever you live in the US, you can ask us to tell you what personal information we hold and give you a copy, correct it, delete it, or give it to you in a portable format. We do not sell or share personal information (including for cross-context behavioral advertising), we do not use sensitive personal information, and we will not treat you differently for using your rights. An authorized agent may make a request for you with your signed permission.
How to exercise them. Email hello@upradar.ai from the address on your account (or the one you used for a free report). If you write from another address, we’ll confirm with the address we hold. We respond within 30 days, and may extend once for complex requests where the law allows, telling you why. If we decline, you can appeal by replying with “Appeal” in the subject; we answer within 60 days. If you are still not satisfied, you may contact your state attorney general or your data protection authority.
8. Cookies and analytics
- Strictly necessary. Sign-in cookies (Supabase) and a few settings stored in your browser, such as your cookie choice. No consent needed.
- Bot protection. The free-audit form uses Cloudflare Turnstile, which receives your IP address and browser signals.
- Product analytics. PostHog, hosted in the EU, without analytics cookies. In the app it runs only after you accept analytics in the banner and links events to your account ID, never your name or email.
- Fonts. The app loads fonts from Google Fonts, so your browser sends your IP address to Google.
- Advertising. We use no advertising cookies, pixels or retargeting today. If we add them to our marketing website, visitors in the EEA, the UK and Switzerland will see a banner and no advertising tags will load until they accept; elsewhere you can opt out through the “Your Privacy Choices” link in our footer. We honor Global Privacy Control signals as an opt-out. We will not use advertising tools in the app, and we will update this policy before any advertising tags go live.
9. Free audit links
Anyone who has the link to a free audit report can open it, so share it only with people you trust. The report page is not indexed by search engines, and the link expires after 30 days. Deep-audit reports in your account are visible only to you.
10. How we protect your data
All traffic to upradar.ai and app.upradar.ai is encrypted in transit (HTTPS). Sign-in runs through Supabase Auth, so we never store your password, and API keys we issue are stored only in hashed form.
Access to production data is limited to the people who build UpRadar and only as their work requires. We use established infrastructure providers and collect as little data as we need.
If a security incident affects your personal data, we will notify you, and the authorities where the law requires it, without undue delay and within 72 hours of becoming aware of it where the law requires. To report a vulnerability, email hello@upradar.ai with “Security” in the subject.
11. Children
UpRadar is a business service for adults. You must be at least 18 to use it, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, email us and we will delete it.
12. Changes
For material changes, we will email account holders at least 15 days before the change takes effect, unless the law requires a change sooner. The date at the top shows the latest version.
13. Contact
hello@upradar.ai · MAYA Tech Services LLC, 8 The Green, Ste A, Dover, DE 19901, USA.