Privacy Policy

Lupley handles two kinds of personal information, and our responsibilities differ for each.

• Lupley account and customer data: information about the companies and people who sign up for Lupley, such as workspace Owners, Admins and Users. For this information Lupley decides how it is used and acts as the organization responsible for it.
• End user information collected by a Lupley customer: feedback, email addresses and newsletter subscriptions that a company collects from its own users through its public Lupley pages. That company decides what to collect, what to publish and how long to keep it. Lupley processes that information on the company's behalf and under its instructions in order to provide the service.

If you submitted feedback or subscribed to a newsletter on a company's Lupley page and want your information corrected or removed, contact that company first, because they control it. You can also contact us at privacy@getlupley.com and we will help route the request.

• Account information: your name and email address, and your password if you do not use Google sign-in.
• Company and workspace information: company or product name, public page address, description, logo, design settings and integration settings.
• Team information: the email addresses you invite, the role assigned to each member and invitation status.
• Feedback information: titles, descriptions, categories, internal notes, statuses and replies created in a workspace.
• End user feedback: what a visitor types into a public feedback form, and their email address when they choose to provide it for updates.
• Newsletter subscriber information: subscriber email addresses, subscription status and unsubscribe records, plus newsletter content and send records.
• Authentication information: sign-in events and session tokens, and, if you use Google sign-in, the basic profile information Google returns such as your name, email address and account identifier.
• Payment information: if you purchase a paid plan, billing details are collected and processed by our payment provider. Lupley does not receive or store full card numbers.
• Support communications: the content of messages you send us, and the email address you send them from.

• Technical and device information such as browser type, operating system, device type, screen size and language.
• IP addresses, used to deliver the service and to detect and prevent abuse.
• Cookies and browser storage, described in the Cookie Policy.
• Usage information such as pages viewed in the dashboard, features used and actions taken, so we can operate, secure and improve the product.
• Error and diagnostic logs generated when something fails, which may include the request path, timestamps and technical details.

• To create and operate your account and workspace, and to authenticate you.
• To provide the features you use: feedback boards, roadmaps, newsletters, design settings, integrations, notifications and team management.
• To publish the content you choose to make public on your board, roadmap or newsletter pages.
• To send service and transactional messages such as invitations, password resets, notifications and important account notices.
• To send the newsletters and replies our customers ask us to deliver on their behalf.
• To provide support and respond to your requests.
• To keep Lupley secure, prevent fraud and abuse, and enforce our Terms and Acceptable Use Policy.
• To fix problems, understand how features are used and improve the product.
• To process payments for paid plans and keep records required for tax and accounting.
• To comply with legal obligations and respond to lawful requests.

We do not sell personal information, and we do not use your workspace content or your end users' feedback for advertising.

For Lupley accounts we rely on your consent when you create an account and provide information, on the necessity of processing to perform our agreement with you, and on our legitimate interests in securing the service, preventing abuse and improving the product, balanced against your privacy. Where the law requires express consent, we ask for it, and you can withdraw consent as described below.

For information a customer collects from its own end users, that customer is responsible for having an appropriate legal basis, for telling its end users what it collects and why, and for obtaining consent where consent is required, including consent for newsletter emails.

We use a small number of providers to run Lupley, and they may process personal information on our behalf under contractual confidentiality and security obligations, only for the purpose of providing their service to us:

• Cloud application hosting and content delivery, to serve the application.
• Managed database, storage and authentication infrastructure, which stores workspace data, uploaded logos and account credentials.
• Google, when a user chooses Google sign-in.
• Email delivery provider, to send transactional email, invitations and newsletters.
• Payment processor, for paid plans, which handles billing information directly.

We do not currently operate third party advertising networks or cross-site tracking on Lupley. If we add analytics or another category of provider, we will update this policy and the Cookie Policy before relying on it.

Beyond the providers above, we share personal information only when you ask us to or direct us to publish it, with other members of your own workspace as part of shared workspace data, when required by law or valid legal process, when necessary to investigate suspected fraud, abuse or a security incident or to protect the rights and safety of people, and in connection with a merger, acquisition or sale of assets, in which case we will give notice and the information stays subject to this policy or an equivalent one.

Lupley is operated from Canada and our providers may store or process information in Canada, the United States and other countries where they or their subprocessors operate. Information stored in or accessible from another country may be subject to the laws of that country, including lawful access requests by courts, law enforcement and national security authorities there. We use providers that apply comparable protection through contractual and technical safeguards.

We keep account and workspace information for as long as the account is active. Feedback, roadmap items, newsletters and subscriber records are kept until the workspace deletes them or the account is deleted, because the workspace controls that content. Invitations are kept as a record of access granted. Security, error and email delivery logs are kept for a limited period for troubleshooting and abuse prevention. Billing records are kept as long as tax and accounting law requires.

Records of acceptance of the Terms and Privacy Policy, including the version and the date, are kept while the account exists and for a reasonable period afterwards as evidence of agreement.

You can delete your account from the dashboard Settings page. Deleting an account removes your workspace records from our live systems, including boards, feedback, roadmap items, newsletters, subscriber lists, notifications and design settings, and public pages stop being served. Copies can persist for a limited period in routine platform backups and system logs until they cycle out, and we may keep limited records where the law requires it or where they are needed to resolve a dispute or prevent abuse. Export anything you want to keep before deleting.

Removing a member from a workspace revokes their access but does not delete their personal Lupley account or the content they created for that workspace.

Lupley uses cookies and browser storage to keep you signed in, protect requests and remember interface preferences. Details, including how to control non-essential storage, are in the Cookie Policy.

Subject to applicable law and reasonable verification, you can:

• Ask what personal information we hold about you and request access to it.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your account and associated information.
• Withdraw consent where processing relies on consent, understanding that some withdrawals mean we can no longer provide the service.
• Ask for an explanation of how your information is used and who it is shared with.
• Object to or ask us to restrict certain processing, and request portability, where local law provides those rights.

Send requests to privacy@getlupley.com. We respond within the time applicable law requires, normally within thirty days, and will tell you if we need more time or cannot fulfil a request, along with the reason.

You can view and update much of your information directly: your profile and company details in Settings, your workspace members in Accounts, feedback and roadmap content in their dashboards, and newsletter subscribers in the Newsletter section. Newsletter recipients can unsubscribe using the link in every newsletter email.

If you are concerned about how we handled your information, contact privacy@getlupley.com and describe the issue. We will investigate and tell you the outcome. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator in your province or country.

We take reasonable safeguards to protect personal information, described on the Security page. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate regulator as required by applicable law, and keep records of breaches as the law requires.

Lupley is a business tool and is not directed to children. We do not knowingly create accounts for anyone under the age of majority in their jurisdiction, and we do not knowingly collect personal information from children through our own service. If you believe a child has provided information to us, contact privacy@getlupley.com and we will delete it. Customers who invite end users to submit feedback are responsible for their own audience.

We may update this policy as the product or the law changes. The last updated date and version appear at the top of this page. Where a change is material we will give notice where appropriate, for example by email or an in app notice.

Privacy questions and requests: privacy@getlupley.com. General support: support@getlupley.com. Legal notices: legal@getlupley.com. Security reports: security@getlupley.com.