Privacy Policy

1. Who we are

UPCNTRL ("UPCNTRL", "we", "us") is a customer-relationship-management (CRM) app for independent specialists and small service businesses (for example beauty and wellness professionals). It consists of the UPCNTRL iOS app and the online services that store and synchronise its data (together, the "Service").

The Service is provided under the name UPCNTRL by Vladyslav Lukyanenko, a private individual (independent developer) resident in Italy, who is the controller for the data described in section 2 (1) and is also the seller of the app shown in the App Store.

Contact for privacy questions and data requests, including all data-protection matters: privacy@upcntrl.app. Legal notices: legal@upcntrl.app. Help with the app: support@upcntrl.app.

2. Two kinds of data and two roles

The Service handles two different kinds of personal data:

1. Your account data — data about you as a user of UPCNTRL (for example your name and e-mail address). For this data UPCNTRL decides why and how it is processed.
2. Business data — data that you, or members of your team, enter about your business and your own clients, suppliers and staff (for example a client's name, phone number, appointment history and notes). You decide what to enter and why. For this data the business using UPCNTRL is responsible towards its clients (in GDPR terms, the business is the controller), and UPCNTRL stores and processes it on the business's behalf and only to provide the Service (UPCNTRL is the business's processor). The processing terms are part of the Terms of Service (section 5).

If you are a client of a business that uses UPCNTRL and you want to access, correct or delete your data, please contact that business first. We will support the business in answering your request.

3. How you sign in

You sign in with Sign in with Apple or Sign in with Google. The app does not offer sign-in with an e-mail address and password.

When you sign in, we receive from Apple or Google:

• a unique account identifier issued by Apple or Google;
• your e-mail address (with Apple you may choose "Hide My Email", in which case we receive an Apple relay address);
• your name, if you allow Apple to share it, or the name and profile details that Google shares with the sign-in (name and profile picture URL).

We create an internal user identifier (a random ID) for your account.

Sign-in with a phone number (SMS code) is not available. Before we offer it, we will update this policy and name the SMS provider.

4. What data we process

4.1 Account and profile

• Name and contact phone number that you enter in your profile.
• E-mail address from Apple or Google.
• Optional profile photo that you choose with the iOS photo picker. Only the photo you select is uploaded (to our file storage at Supabase); the app has no access to the rest of your photo library.
• Appearance preference (light / dark / system).
• Which sign-in methods (Apple, Google) are linked to your account.

4.2 Business (workspace) data

Each business ("project") you create or join can contain:

• Business details: name, type of activity, address, phone, Instagram handle, time zone, currency, working hours.
• Team: members, their roles (owner, administrator, staff member, guest), the individual permissions the owner sets for each member, and invitations. Invitations are shared as a link; the server stores only a hash of the invitation code.
• Clients of the business: name, phone number, Instagram handle, how the client found the business ("source"), optional gender (female / male / not specified), and free-text notes.
• Appointments (visits): date and time, services, price, the team member who performs it, colour, status (for example booked, arrived, cancelled, no-show), notes, and a history of changes to the appointment (what changed and when).
• Payments and prepayments recorded by the business: amounts, date and a method label (for example cash, card, transfer). UPCNTRL does not process payments and never receives card or bank details. These are bookkeeping records typed in by the business.
• Expenses: date, amount, category, note.
• Services and prices, inventory / stock, stock movements, purchase receipts and suppliers (supplier name, contact person, phone, Telegram, WhatsApp, website, notes).
• Imported data: if you import an inventory list from a CSV file, its rows are stored as inventory items.

Sensitive information in notes. Free-text notes are entered by the business. A business may choose to record remarks that relate to a client's health (for example an allergy or a skin condition relevant to a treatment). UPCNTRL does not ask for such information and is not a medical system. If a business records such information, it is responsible for having a lawful basis for doing so and for informing its clients.

4.3 Google Calendar integration (optional)

A business owner or admin can connect a Google Calendar to a business. If you do:

• You grant UPCNTRL access through Google's consent screen. The requested permissions are: your Google account's e-mail address and basic identity (openid, email), read-only access to your list of calendars (calendar.calendarlist.readonly) and access to see, create, change and delete events only on calendars you own (calendar.events.owned). A connection made before 2026-10-03 may still hold the earlier, broader permission (calendar.events) until you reconnect; UPCNTRL uses it only for the same operations on the one calendar you chose.
• We store, on our servers: the connected Google account's e-mail address, the chosen calendar's ID and name, your event colour / reminder preferences, and a refresh token encrypted with AES-GCM. The token is used only by our server; it is never sent to the app.
• What we write to Google Calendar: for each appointment, an event with the client's name and the names of the services as the title, start and end time, a colour that reflects the status, an optional reminder, visibility "private", and technical identifiers that link the event to the appointment. The client's phone number, Instagram, source and notes are not sent to Google.
• What we read from Google Calendar: the list of your calendars (to let you choose one that you own), and for the days you view, the start and end times of busy events (so that the app can show when you are not available and does not book a client at those times). We store only these start and end times — not the titles, descriptions, attendees or IDs of your own events. This cache is replaced on every refresh; days older than 7 days are removed at the next refresh, and the whole cache is deleted when you disconnect.
• To keep each appointment linked to its event, we store the ID of each event that UPCNTRL created (or linked) in the selected calendar, together with that calendar's ID.
• When you disconnect, we delete the stored token, the connection data and the cached busy times. The link between each appointment and the event UPCNTRL created (event ID and calendar ID) is kept, so that reconnecting the same calendar does not create duplicates; it is deleted when the business is deleted. Disconnecting does not currently withdraw the permission on Google's side; you can remove UPCNTRL's access at any time in your Google Account (myaccount.google.com/permissions). When a business is deleted, its Calendar permission is also revoked with Google. Events already written to your Google Calendar stay in your Google account (after a disconnect and after a business deletion); you can delete them in Google Calendar.

Google's processing of data in your Google account is governed by Google's own privacy policy.

4.3.1 Google user data: use, sharing and disclosure

"Google user data" means the data that UPCNTRL receives from Google APIs: through Sign in with Google (section 3) and through the Google Calendar integration (section 4.3).

• Use only for the features you request. We use Google user data only to provide and improve the features that you request and that are visible in the app: signing you in, showing which Google account is connected, letting you choose a calendar, writing your appointments to that calendar, and showing and respecting your busy times when you book.
• No sale. We do not sell Google user data.
• No advertising. Google user data is not used for advertising, including personalised, retargeted or interest-based advertising, and is not transferred to advertising platforms, data brokers or information resellers.
• No AI / machine-learning training. Google user data is not used to develop, improve or train generalised artificial-intelligence or machine-learning models.
• No other purposes. Google user data is not used to determine creditworthiness or for lending purposes, or for any purpose other than the features described above.
• No human reading. No person at UPCNTRL reads Google user data, except: (a) with your explicit consent for specific data (for example, when you ask support to look into a synchronisation problem); (b) when necessary for security purposes, such as investigating abuse or a security incident; (c) to comply with applicable law; or (d) when the data has been aggregated and anonymised and is used for internal operations.
• Service providers. Google user data is stored and processed on our behalf only by Supabase (our database and server functions; data stored in AWS region eu-central-1, Frankfurt, Germany — see section 6), only as far as necessary to provide the features you requested, and on our instructions. It is included in Supabase's backups (section 7). The appointment events that you ask us to write are sent to Google itself. No other provider listed in section 6 (GitHub, Netlify, Apple, PostHog, RevenueCat) receives Google user data. The app may keep the connection status and busy times in its local cache on your device (section 4.4).
• No other transfers. We do not transfer or disclose Google user data to any other third party, except: (1) as necessary to provide or improve the features you requested, through the service providers named above; (2) when necessary for security purposes, such as investigating abuse; (3) to comply with applicable law or a binding order of a public authority; or (4) as part of a merger, acquisition or sale of assets of UPCNTRL, and only after we have obtained your explicit prior consent. In that case the data remains subject to the commitments in this section.
• Retention and deletion. See section 4.3 (disconnect), section 7 and section 8 (deletion of a business or an account). You can remove UPCNTRL's access to your Google account at any time at myaccount.google.com/permissions.

UPCNTRL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.4 Data stored on your device

• The app keeps a local copy (cache) of business data you have opened so that screens load quickly. It is stored with iOS "complete" file protection (readable only while the device is unlocked) and excluded from iCloud / device backups.
• Your sign-in session is stored in the iOS Keychain.
• Simple preferences (for example language, appearance, the last opened business) are stored in the app's settings.
• Signing out removes the session, the local cache and account-related settings from the device.

4.5 Technical data

When the app talks to our servers, the infrastructure of our hosting provider (Supabase) necessarily processes technical data such as your IP address, the time of the request and technical request details, and keeps it in service logs for operation and security, for the period set by the provider. Our own server code logs only technical status codes, not the content of your records.

4.6 What we do not do

• No advertising, no ad networks, no selling of personal data.
• No tracking across other companies' apps or websites; no advertising identifier (IDFA).
• The only usage statistics are the optional, consent-based usage analytics described in section 4.8 (off unless you switch them on).
• No crash-reporting tools and no third-party analytics in the app other than the optional usage analytics of section 4.8. (If you have enabled "Share with App Developers" in iOS, Apple may share crash reports with us according to Apple's own settings.)
• No access to your device's location, contacts / address book, calendar (EventKit), health data, camera or microphone.
• No push notifications.

4.7 This website

The public website upcntrl.app (Home, Privacy, Terms, Support) uses no cookies, no JavaScript, no analytics and no resources from other websites. It is hosted by Netlify. When you visit it, Netlify processes technical request data (such as your IP address, the time, the requested page and your browser's user agent) in its request logs to deliver the pages and keep them secure, for the period set by Netlify. We do not use this data to identify or profile visitors.

4.8 Usage analytics (optional, only with your consent)

*Applies to app version 0.1.0 (48) and later.*

• What: if — and only if — you switch on "Send usage statistics" (asked after you sign in, off by default; you can change it any time in *My profile → Privacy*), the app sends usage events that are not linked to your account (pseudonymous data): which sections and features are used (for example "an appointment was created", "the paywall was opened"), error codes (for example "server conflict", "no connection"), loading and saving times (in milliseconds and as ranges, for example "0.5–1 s"), HTTP status codes and the number of retries of a failed operation, a random identifier of a single operation (for example one save; it exists only for that operation and is not linked to you, your account or the appointment) and technical context (app version and build, iOS version, device type and size class, whether the app is a test build, app language, theme, your role in the business such as owner or guest, a random identifier of the current app session). Before you decide, nothing is set up and nothing is sent. To switch the statistics on, you also confirm that you can give this consent yourself under the law of your country; without this confirmation they stay off.
• Never sent: names, e-mail addresses, phone numbers, notes, amounts or prices, names of businesses, services or products, any identifier of your account, business, clients or appointments, your IP address (PostHog receives it when events arrive and discards it; it is not stored), location (no location is derived from the IP address either), advertising identifiers. The app can only send values from a fixed list, bounded whole numbers (such as milliseconds) and that random operation identifier; it has no way to send free text.
• Identifier: a random installation identifier created by the app. It is not linked to your account or business and is replaced by a new one when you sign out, delete your account or withdraw consent. After signing out or deleting the account, the app asks for consent again at the next sign-in.
• Purpose: to understand which features are used, find errors and slow screens and improve UPCNTRL. No advertising, no profiling of individuals, no tracking across apps or websites. Session recording, screenshots and automatic capture of taps are switched off.
• Legal basis: your consent (Art. 6(1)(a) GDPR; storing the identifier on your device: Art. 5(3) ePrivacy Directive / Art. 122 Italian Privacy Code). Withdrawing consent stops sending immediately and does not affect processing before the withdrawal.
• Processor: PostHog Inc. (PostHog Cloud EU, servers in Frankfurt, Germany) under a data processing agreement; PostHog's sub-processors are listed at posthog.com/subprocessors. Support or maintenance access from outside the EEA may occur under Standard Contractual Clauses / the EU–US Data Privacy Framework. PostHog's AI features are not used for this data.
• Retention: 12 months, then deleted.
• Your rights: see section 9. Because the data is not linked to your account, we usually cannot find events of a specific person (Art. 11 GDPR); withdrawing consent and signing out make future events unlinkable to past ones. Events already sent are deleted when the 12 months expire.

4.9 Subscriptions (Light / Pro)

*Applies to app version 0.1.0 (48) and later.*

• Paid plans are sold by Apple through the App Store (In-App Purchase). Apple processes the payment; we never receive card or bank details, your Apple ID or your name from the purchase.
• To link a subscription to the right business, we use RevenueCat (RevenueCat, Inc.) as our processor for subscriptions: the app identifies the business to RevenueCat by its internal random business ID (only the owner of the business can buy; no name, e-mail address or account ID is sent), and RevenueCat receives from Apple / StoreKit the purchase records of that subscription: product (Light / Pro, monthly / annual), transaction identifiers, purchase / renewal / expiry dates, trial status, price, currency and App Store country, and technical device data needed to validate purchases (app version, OS version, device type, language settings, IP address and the identifier that Apple assigns to this device for our apps — the "identifier for vendor", IDFV; it is not an advertising identifier and is not used for tracking).
• Our server stores the plan status of the business (plan, billing period, validity and grace dates, whether it renews) and, for each Apple subscription, its Apple transaction identifiers, the business it pays for and the processed purchase / renewal events.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for the records kept after a business is deleted: legitimate interest in preventing one subscription from being used for several businesses and in handling refunds, disputes and restores.
• Retention: the plan status is deleted with the business. After a business is deleted we keep only the Apple transaction identifiers of its subscription, the internal ID of the deleted business and the type and time of the processed purchase events — no names, e-mail addresses or business content — so that the subscription can be linked to another business of the purchaser and refunds, disputes and restores can be handled. These records have no fixed deletion date and are not deleted automatically: we keep them only as long as they are needed for these purposes and delete them on request (privacy@upcntrl.app) when they are no longer needed. RevenueCat keeps its copy according to its data processing agreement.

5. Why we process data and legal bases

Account data is needed to create an account and use the Service; business data is entered by the business. Usage analytics is optional. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not profile users.

6. Who receives the data (service providers)

We use the following providers to run the Service. They process data on our instructions.

Supabase, GitHub, Netlify, Apple, Google, PostHog and RevenueCat are companies based in the United States or with group companies there, so personal data may be accessible from outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework (for providers certified under it) or on the European Commission's Standard Contractual Clauses included in the providers' data processing terms.

Within a business, data is visible to the team members of that business according to their role and the permissions the owner sets (for example, a staff member works with their own clients and appointments, and a guest sees only the calendar and appointments, without client contact details or finances).

We do not sell or rent personal data. We may disclose data if required by law or by a binding order of a public authority.

7. How long we keep data

• Account data: as long as your account exists.
• Business data: as long as the business exists in UPCNTRL. Individual records you delete are removed; some records (for example expenses) are first marked as deleted.
• Google Calendar connection: until you disconnect or the business is deleted. The links between appointments and the events UPCNTRL created (event ID and calendar ID) are kept until the business is deleted (section 4.3).
• Backups: our hosting provider makes daily backups that are kept for about 7 days. After a deletion, deleted data can remain in these backups for up to about 7 days until they expire. If a backup ever had to be restored, we use the deletion records (section 8) to delete again any data that had already been deleted.
• Deletion records: see section 8.
• Technical logs: for the period set by the hosting provider (Supabase for the app, Netlify for the website).
• Usage analytics (section 4.8): 12 months.
• Subscriptions (section 4.9): plan status while the business exists; purchase records as stated in section 4.9.

8. Deleting your account or a business

The app contains these options:

• Delete account: My profile → Danger zone → Delete account.
• Delete business (owner only): Settings → Business information → Danger zone → Delete business.
• Leave business (team members who are not the owner): Settings → Business information → Danger zone → Leave business. Your access ends; the business's data stays with its owner.

For your security, the app asks you to sign in again with Apple or Google before a deletion. If you cannot use the app, send your deletion request to privacy@upcntrl.app from the e-mail address linked to your account.

Subscriptions are not cancelled by a deletion. A paid plan is billed by Apple; cancel it in your Apple ID settings (Settings → your name → Subscriptions) — the app reminds you of this before the deletion.

Delete account removes your profile, profile photo, your memberships in other businesses and your sign-in account. Deleting your account never deletes a business: before you can delete your account, you must first delete each business you own (Delete business). An owner cannot leave their own business. It also revokes UPCNTRL's sign-in access at Apple and Google (Sign in with Apple and Sign in with Google). Business data that you entered in a business owned by someone else (for example appointments you booked as a team member) belongs to that business and stays there.

Delete business removes all data of that business (clients, appointments, payments, expenses, services, inventory, suppliers, team and invitations) and disconnects its Google Calendar (the access token is revoked). Events already written to Google Calendar remain in the Google account. Purchase records of a paid plan are kept as stated in section 4.9.

What remains after a deletion. To be able to prove that a deletion happened and to make sure that deleted data is not brought back by a restore of a backup, we keep a minimal deletion record ("tombstone") containing only: internal technical identifiers (a random deletion ID, the internal ID of the deleted user or of the owner, and the internal ID of the deleted business), the type of deletion (account / business), its status (pending / completed / cancelled) and timestamps. It contains no names, e-mail addresses, phone numbers or business content. These records are kept:

• in a technical deletion log in our main database;
• in a separate Supabase project dedicated to deletion records (also in AWS eu-central-1, Frankfurt);
• as a backup copy that is mirrored asynchronously to a private GitHub repository. This copy is append-only (kept in the repository history).

Planned retention — not yet in force (the automatic clean-up that will apply it is not running yet): deletion confirmation codes 7 days; completed deletion log entries 35 days; completed or cancelled deletion records 35 days (a longer period of 45 days is being considered for technical recovery reasons); deletion records still in progress are kept until the deletion has finished; blocked or failed deletions are kept until they are resolved. Backups of the main database expire after about 7 days.

The GitHub backup copy currently contains the internal identifiers (random IDs) as they are — no names, e-mail addresses or content — and cannot be shortened without rewriting its history. Replacing the user and business identifiers in this copy with pseudonyms is planned.

9. Your rights

Depending on where you live, you may have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. You can use many of these rights directly in the app (edit your profile, delete records, delete your account). For other requests, write to privacy@upcntrl.app. We may need to verify your identity. We answer within one month (Art. 12(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work (in Italy: Garante per la protezione dei dati personali). As UPCNTRL is operated from Italy, the Garante (garanteprivacy.it) is the competent supervisory authority for UPCNTRL.

Clients of a business that uses UPCNTRL should address their requests to that business (see section 2).

10. Security

• All connections between the app and our servers use HTTPS (TLS).
• Access to business data is enforced on the server according to the member's role in each business.
• Google Calendar refresh tokens are encrypted on the server; sign-in sessions are stored in the iOS Keychain; the local cache uses iOS file protection.
• Deletion requires a fresh sign-in.

No system is perfectly secure. If we learn of a personal data breach that affects you, we will inform you and the authorities where required by law.

11. Children

UPCNTRL is intended for business use and is not directed to children; it has no content or features made for children. We do not knowingly collect personal data from a child without the consent that the law requires. Optional usage statistics (section 4.8) are based on consent: the app switches them on only after you confirm that you can give this consent yourself under the law of your country. If you are below the age of digital consent under the applicable law, they stay switched off. If you believe that a child has given us personal data without the necessary consent, write to privacy@upcntrl.app and we will delete it. Data that a business records about its own clients, including minors, is covered by section 2.

12. Changes to this policy

We may update this policy when the Service changes. We will show the date of the latest version at the top and, for important changes, inform you in advance in the app or by e-mail before they take effect.

This policy is available in English, Italian, Russian and Ukrainian. If translations differ, the English version prevails.

13. Contact

UPCNTRL — Vladyslav Lukyanenko, Italy — e-mail: privacy@upcntrl.app (support: support@upcntrl.app; legal: legal@upcntrl.app)