Privacy policy

The short version

Uplooped is built GDPR-first. Your data, and your users' data, is stored and processed exclusively in the EU. We collect only what the product needs to work, we never sell it, and we delete it when you ask us to.

Who we are

Uplooped ("we", "us") provides feedback boards, roadmaps, and changelogs for software teams. We act as the data controller for account holders and as a data processor for the end-users who post and vote on our customers' feedback portals.

What we collect

• Account data: email address and password (stored hashed).
• Content: posts, comments, votes, and changelog entries you or your users create.
• Guest activity: anonymous voters are identified only by a random browser token. Guests may optionally leave an email address to receive updates; it is used for nothing else.
• Technical logs: standard server logs (IP address, user agent) kept briefly for security and debugging.

We do not use advertising trackers, and we never sell your data.

Analytics

On our public marketing website (uplooped.com) we use Google Analytics to understand aggregate traffic, such as which pages people visit and where they arrive from. It sets cookies and shares some data, including a truncated IP address, with Google as a processor. We deliberately do not load analytics on customer feedback portals (your-name.uplooped.com) or inside the logged-in app, so your users and your team are not tracked this way.

Why we process it (legal bases)

• Contract: running your account, boards, and notifications.
• Legitimate interest: securing the service and preventing abuse.
• Consent: optional emails to guests who explicitly leave their address.

Where your data lives

All production data is hosted on EU infrastructure and never leaves the EU/EEA. Backups are encrypted and stored with EU providers.

Emails we send

Transactional only: status updates on posts you voted for, changelog announcements for features you voted on, and account emails. Every notification links back to the relevant post. We don't send marketing email without separate, explicit opt-in.

Retention & deletion

Content stays as long as your account is active. Delete a post, comment, or board and it is removed immediately. Close your account and all organization data is permanently deleted within 30 days. You can request a full export or erasure of your data at any time.

Your rights

Under the GDPR you can access, rectify, export, restrict, object to, or erase your personal data. Contact us and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority (in Norway: Datatilsynet).

Contact

Privacy questions or requests: privacy@uplooped.com