Legal

Privacy Policy

Last updated: 5 June 2026

1. Who we are

UpResponse Ltd ("UpResponse", "we", "us", "our") operates the website at upresponse.io and the helpdesk platform accessible at app.upresponse.io. We are registered in the United Kingdom.

If you have any questions about this policy or how we handle your data, contact us at hello@upresponse.io.

2. What data we collect

We collect data in two ways — data you give us directly, and data we collect automatically.

Data you provide:

  • Name and email address when you register or are invited to the platform
  • Your organisation's name and contact details
  • Support ticket content — titles, descriptions, comments and attachments you submit
  • Messages sent via WhatsApp integration (if enabled by your organisation)
  • Knowledge base articles your organisation creates

Data we collect automatically:

  • IP address and browser/device information when you access the platform
  • Log data including pages visited, timestamps, and API requests
  • Cookies required for authentication and session management

3. How we use your data

We use your data to:

  • Provide, operate and improve the UpResponse platform
  • Send transactional emails — invite notifications, password resets, and ticket updates
  • Generate AI-assisted responses to support tickets using your organisation's knowledge base
  • Monitor platform performance, security, and resolve technical issues
  • Comply with legal obligations

We do not sell your data to third parties. We do not use your data for advertising.

4. AI processing

UpResponse uses AI to suggest responses to support tickets. Ticket content (title, description, and category) is sent to our AI provider to generate a suggested response. This content may include personal information submitted in the ticket.

Our current AI provider is Groq (Groq, Inc.). By using UpResponse you agree that ticket content may be processed by Groq in accordance with their privacy policy.

AI-suggested responses are reviewed by your IT team before being sent to users. No automated decisions with legal effects are made solely by AI.

5. Data storage and security

Your data is stored in MongoDB Atlas, a cloud database service operated by MongoDB, Inc. Data is encrypted at rest and in transit.

The platform is hosted on Railway (Railway Corp) and Cloudflare Pages (Cloudflare, Inc.).

Transactional emails are sent via Resend (Resend, Inc.).

We implement industry-standard security practices including HTTPS, JWT-based authentication, bcrypt password hashing, and rate limiting. No system is completely secure — if you believe your account has been compromised, contact us immediately at hello@upresponse.io.

6. Data retention

We retain your data for as long as your account is active or as needed to provide services. If you close your account or request deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons.

Support ticket data may be retained for up to 2 years to allow organisations to maintain their support history.

7. Your rights

If you are based in the UK or European Economic Area, you have the following rights under GDPR/UK GDPR:

  • Access — request a copy of the personal data we hold about you
  • Rectification — ask us to correct inaccurate data
  • Erasure — ask us to delete your personal data
  • Restriction — ask us to limit how we process your data
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interests

To exercise any of these rights, email us at hello@upresponse.io. We will respond within 30 days.

8. Cookies

We use cookies only for authentication and session management. We do not use tracking, analytics, or advertising cookies. No cookie consent banner is required as we only use strictly necessary cookies.

9. Third-party services

We use the following third-party services to operate the platform:

  • MongoDB Atlas — database hosting
  • Railway — backend application hosting
  • Cloudflare — CDN, DNS, and frontend hosting
  • Resend — transactional email delivery
  • Groq — AI response generation
  • WhatsApp Business API (if enabled) — ticket submission via WhatsApp

Each of these providers has its own privacy policy. We only share the minimum data necessary for each service to function.

10. Children

UpResponse is a business tool intended for use by organisations and their employees. We do not knowingly collect data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes we will notify users via email. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions, requests, or complaints, contact us at:

UpResponse Ltd
hello@upresponse.io