This Privacy Notice for CLEEVIO s.r.o.
This Privacy Notice for CLEEVIO s.r.o. (doing business as Uprate HQ) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), for example when you:
- Visit our website at http://www.upratehq.com, or any website of ours that links to this Privacy Notice
- Sign up for and use the Uprate app, including its API, SDK, MCP server, command-line tools, hosted feedback pages and public roadmaps
- Engage with us in other related ways, including any sales, marketing, or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. Contact us at [email protected].
Summary of key points
- What personal information do we process? Information you provide, information we receive from the app stores and from Google, data that users of your apps send through Uprate, and information about how you use the Services.
- Do we process sensitive personal information? We do not process sensitive personal information.
- Do we receive information from third parties? Yes. We import reviews of your apps from the App Store and Google Play, receive your Google profile when you sign in with Google, and receive feedback and details that users of your apps send through the Uprate SDK, hosted feedback pages and public roadmaps.
- What is our role? We are the controller for your account data. For data about users of your apps, such as reviews and feedback, we act as your processor.
- How do we process your information? To provide, improve, and administer our Services, communicate with you, prevent fraud, and comply with law.
- How do we keep your information safe? We use organizational and technical safeguards designed to protect personal information.
- What are your rights? Depending on where you live, privacy laws may give you rights over your personal information.
Table of contents
- What information do we collect?
- Are we the controller or the processor?
- How do we process your information?
- What legal bases do we rely on to process your personal information?
- When and with whom do we share your personal information?
- Do we use cookies and other tracking technologies?
- Do we offer artificial intelligence-based products?
- How long do we keep your information?
- How do we keep your information safe?
- Do we collect information from minors?
- What are your privacy rights?
- Controls for do-not-track features
- Do United States residents have specific privacy rights?
- Do we make updates to this notice?
- How can you contact us about this notice?
- How can you review, update, or delete the data we collect from you?
1. What information do we collect?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide when you register for the Services, express interest in our products or Services, participate in activities on the Services, or otherwise contact us.
Personal Information Provided by You. The personal information we collect may include:
- Names
- Email addresses
- Passwords, which we store only as a one-way hash
- Contact or authentication data
- App Store Connect and Google Play credentials you upload, which we store encrypted
- Content you create in the Services, such as reply drafts, templates, chat messages and files you add to an app's knowledge base
Payments are handled by Stripe. We store your subscription status and links to your invoices, not your card details.
Information we receive from third parties
- App store reviews. When you add an app, we import its reviews through the App Store Connect API and the Google Play Developer API, and collect public reviews through Apify. A review includes the reviewer's public name or nickname, the title and text, the star rating, the date, the country or language and, for Google Play, the app version and device that the store reports.
- Google sign-in. If you sign in with Google, we receive your name, email address, Google account ID and profile picture.
- Connected store accounts. From App Store Connect and Google Play we receive the data the features you use need, such as app metadata, sales and analytics reports, and the status of your submissions.
Data about users of your apps
If you add the Uprate SDK or a hosted feedback page to your app, or publish a public roadmap, people who use your app can send data to Uprate:
- The user ID your app assigns to them, or a random ID when your app does not pass one
- Email address and name, if your app or the person provides them
- Platform, app version, device model, operating system version, locale and timezone
- Feedback messages, ratings, feature requests, roadmap votes and signals about when your app asked for a store review
- Any additional metadata your app attaches to feedback
- The email address of a person who confirms their vote on a public roadmap
Information collected automatically
- Product analytics. In the logged-in app we record which pages you open and which navigation and feature buttons you click, with your user ID, a session ID, the type of device (desktop or mobile) and the screen size range. We collect this ourselves and store it on our own servers. See section 6.
- Error reports. When something fails, the website and the app send an error report to Sentry. See section 6.
- Records of your consent. When you accept our Terms, we record the time, the version of the Terms, your IP address and your browser's user agent.
- Audit logs. When you connect or use a store account, we log the action with your IP address and browser information so we can investigate problems.
- Website analytics. On upratehq.com, only after you accept it. See section 6.
Sensitive Information. We do not process sensitive information.
2. Are we the controller or the processor?
In Short: We are the controller for your account. For the users of your apps, you are the controller and we process their data on your behalf.
CLEEVIO s.r.o. is the controller for data about you and your team as customers of Uprate: your account, billing, product analytics, error reports, audit logs and website analytics.
For data about the users of your apps, including store reviews and the feedback, votes and details they send through the SDK, hosted feedback pages and public roadmaps, you are the controller and we are your processor. We process that data only to provide the Services you configure, for example to show it to you, draft replies and post the replies you approve or automate. A data processing agreement is available on request at [email protected].
If you use an app that collects feedback through Uprate, please contact the developer of that app about your data first. We will help them handle your request. To report data about a child, you can also contact us directly, as described in section 10.
3. How do we process your information?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
4. What legal bases do we rely on to process your personal information?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason under applicable law, such as consent, contractual necessity, legal obligations, vital interests, or legitimate business interests.
5. When and with whom do we share your personal information?
In Short: We may share information in specific situations and with specific third parties, including business transfers, service providers, and when required by law.
The service providers that process data for Uprate, such as our hosting, AI, email, payment and error monitoring providers, are listed on our Subprocessors page. When you connect Slack, Telegram, Microsoft Teams or GitHub, Uprate exchanges data with that service for the features you turn on. Review replies and store changes you approve or automate are published on the App Store or Google Play.
6. Do we use cookies and other tracking technologies?
In Short: We use cookies and similar browser storage. Most of them keep you signed in and the app working. Website analytics runs only after you accept it.
Website analytics
On upratehq.com we use Google Tag Manager and Google Analytics to see how the site is used — which pages people read, how they arrived — as aggregate statistics. Besides Google's cookies, the only analytics cookie is uprate_acquisition, which is also set only after you accept. Every other cookie in the table below is needed for the site or the app to work.
These load only after you accept them. If you decline, or simply ignore the banner, the scripts are never requested and no analytics cookie is set. We keep your answer in your browser for six months and then ask again. When the site also records your answer on our server, an acceptance lasts 30 days; after that, analytics stays off until you accept again. To change your answer, use the Cookie settings link in the footer; withdrawing consent deletes the analytics cookies already stored.
If you accepted analytics and later sign up, we link the page and campaign that brought you to your account and may report the sign-up to Google Analytics as a conversion. In the app, you can withdraw this under Marketing analytics in your account settings.
Product analytics in the app
In the logged-in app we measure page views and clicks ourselves, as described in section 1. This uses no third-party service and no cookie; a session ID is kept in your browser's session storage. We keep these events for 180 days. You can turn product analytics off in your account settings.
Error reports
When an error happens, the website and the app send a report to Sentry with the error, the page or request where it happened, and browser and device details. In the app, the report also contains your user ID and team ID. We configure Sentry not to send names, email addresses or form contents.
Cookies and browser storage we use
| Name | Purpose | Lifetime | When it is set |
|---|---|---|---|
| uprate_session (cookie) | Keeps you signed in during a visit | Until you sign out or the session expires | When you open the app |
| XSRF-TOKEN (cookie) | Protects forms against cross-site request forgery | Same as the session | When you open the app |
| remember_web_… (cookie) | Keeps you signed in on this browser | Up to 400 days, or until you sign out or change your password | When you choose "Remember me" or sign in with Google |
| vite-ui-theme, landing-theme (cookie and local storage) | Remembers the light or dark theme | 1 year | When the app or the pitch page loads |
| sidebar_state (cookie) | Remembers whether the sidebar is collapsed | Until you close the browser | When you use the app |
| drawer_state_… (cookie) | Remembers whether a side panel is open | Until you close the browser | When you open or close the panel |
| uprate-cookie-consent, uprate-analytics-revoke-pending (local storage) | Your answer to the cookie banner | 6 months | When you answer the banner on upratehq.com |
| uprate_analytics_preference (cookie) | A random token that links your browser to the analytics answer stored on our server | 30 days | When upratehq.com first checks your answer, if server-side consent is enabled |
| uprate_acquisition (cookie) | Links the page and campaign that brought you to a later sign-up | 30 days | Only after you accept analytics |
| _ga, _ga_…, _gid (cookies set by Google) | Google Analytics statistics | Set by Google: up to 2 years for _ga, 24 hours for _gid | Only after you accept analytics |
| Stripe cookies, such as __stripe_mid and __stripe_sid | Fraud prevention during payment | Set by Stripe | When the payment step of sign-up loads |
| roadmap_voter_… (cookie) | Remembers your votes on an app's public roadmap | 1 year | When you vote or confirm your email on a public roadmap |
| uprate-feedback:… (cookie and local storage) | A random ID that groups messages from the same person when the app does not pass a user ID | 1 year | When you send feedback through a hosted feedback page |
| uprate_product_session_v1 (session storage) | Groups product analytics events into one session | Until you close the tab, or 30 minutes without activity | When you use the app with product analytics on |
| uprate-theme (session storage) | The theme you picked on upratehq.com | Until you close the tab | When you switch the theme on upratehq.com |
| uprate-setup-draft-…, uprate-setup-checkout-… (session storage) | Restores your sign-up progress after the payment page | Until you close the tab | During sign-up |
| Interface state, with names starting uprate:, uprate-ai. and similar (local and session storage) | A copy of reply and form text you are still typing, so it survives a reload, the open AI chat, notices you dismissed and view preferences. The browser copy is not sent to us, but reply drafts are also saved to your account on our server. | Session storage until you close the tab; local storage until you clear it | While you use the app |
7. Do we offer artificial intelligence-based products?
In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.
8. How long do we keep your information?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
- Account data: for as long as your account exists.
- Reviews and data about users of your apps: for as long as the app exists in Uprate, or until you delete it. You can delete a user of your app together with all of their feedback.
- Product analytics events: 180 days.
- IP address and browser information in audit logs: removed after 90 days.
- Waitlist entries: deleted after 12 months, unless the person has since created an Uprate account.
- The page and campaign that brought you to our website: unlinked from your browser after 30 days. If you signed up, the copy kept with your account and the sign-up record are deleted 180 days after sign-up; only anonymous daily totals remain.
9. How do we keep your information safe?
In Short: We aim to protect your personal information through organizational and technical security measures.
10. Do we collect information from minors?
In Short: Uprate is a service for app developers. For our own purposes, we do not knowingly collect data from or market to children under 18 years of age. Apps that use Uprate may have children among their users. If a child's data has reached Uprate, tell us and we will delete it within 30 days of verifying your report.
Under our Terms of Use, only adults may create an Uprate account.
For the data that apps send through the Uprate SDK or hosted feedback pages, the app's developer is the controller and we are their processor, as described in section 2. Our Terms prohibit developers from sending us personal data of children under 13 in the United States, or of children in the European Union under the age of digital consent in their country, without verifiable parental consent. Developers must also turn on the "Made for kids" setting in Uprate for apps directed to children.
How to report a child's data
If you think personal data of a child has reached Uprate, email [email protected]. Anyone can report it, whether you are a parent or guardian, the developer of the app, or the child. You do not have to contact the app's developer first. Tell us which app it is and anything that helps us find the data, such as the name, email address or user ID the app used and roughly when the data was sent.
We may ask for more details to find the data and verify the report. Within 30 days after we verify it, we delete the child's personal data together with the feedback linked to it, and we tell the app's developer.
11. What are your privacy rights?
In Short: Depending on your state or country of residence, you may have rights that allow access to and control over your personal information.
12. Controls for do-not-track features
Most browsers and some mobile operating systems include a Do-Not-Track feature. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized.
13. Do United States residents have specific privacy rights?
In Short: Residents of certain US states, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, may have specific privacy rights.
14. Do we make updates to this notice?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
15. How can you contact us about this notice?
If you have questions or comments, email [email protected] or contact us by post at:
CLEEVIO s.r.o.Karolinská 706/3
Prague 18600
Czechia
16. How can you review, update, or delete the data we collect from you?
You can update your profile and delete your account in the app settings. Depending on applicable law, you may also request access to, correction of, or deletion of your personal information by emailing [email protected]. If you are a user of an app that uses Uprate, contact that app's developer first, as described in section 2.