1. Controller
tlpth labs GmbH, Obere Zäune 12, 8001 Zürich, Switzerland, is responsible for processing personal data in Upaya. Contact: florian@tlpth-labs.com.
Swiss data-protection law applies. Where the EU or UK GDPR applies, its requirements apply in addition.
2. Data we process
- Account data, including your email address, password hash, username, profile photo, bio, and preferences.
- Content you create, including buckets, collections, entries, descriptions, tags, images, links, ratings, prices, dates, and locations.
- Social and collaboration data, including follows, friendships, invitations, likes, blocks, reports, notification settings, and read status.
- Sharing data, including public pages, embeds, and expiring private share links you deliberately create.
- Technical data needed to run and secure the service, such as IP address, device and browser information, timestamps, diagnostics, and security logs.
3. How we use data
- Provide accounts, profiles, playlists, collaboration, sharing, search, maps, reminders, and notifications.
- Store your preferences and make the app available offline where supported.
- Generate link previews, import structured lists, and provide suggestions you explicitly request.
- Prevent abuse, investigate reports, maintain security, diagnose errors, and improve reliability.
- Respond to support, access, export, correction, or deletion requests.
4. Visibility and sharing
You choose whether a bucket or collection is private, shared with selected people, shared with friends, or public. Public profiles and public lists can be viewed and indexed by search engines. Anyone with a valid private share link can access the content covered by that link until it expires or is revoked. Do not share a private link with people who should not have access.
5. Location, images, links, and imported data
Upaya requests device location only when you use a location-based action. Coordinates you deliberately save become part of the relevant entry. Uploaded images are stored for you; externally linked images remain hosted by their source. When you import a list or request a link preview, Upaya retrieves the submitted page and stores the information you choose to add.
6. Notifications and automated assistance
If you enable browser push notifications, the browser or operating-system push service receives the technical information needed to deliver them. You can disable notifications globally or per bucket. Suggestions requested through Upaya may be processed by an AI service; review suggested content before adding it because generated results can be incomplete or inaccurate.
7. Service providers and international transfers
We use specialist providers for cloud hosting, database and file storage, authentication, content delivery, email, error monitoring, web push, maps, and optional AI assistance. They process only the data needed to provide their service. Where data is processed outside Switzerland or the EEA, we use recognised safeguards such as adequacy decisions or standard contractual clauses.
8. Retention and deletion
We keep account data while your account is active and retain other data only as long as needed for the purposes described here, legal obligations, or security. You can request a data copy and permanently delete your account from profile settings. Account deletion removes your profile, owned lists, entries, images, and social connections, subject to short-lived backups and legal retention duties.
9. Your rights
Depending on applicable law, you may request access, correction, export, restriction, objection, or deletion of your personal data and may withdraw consent at any time. Contact florian@tlpth-labs.com. You may also complain to the competent data-protection authority.
10. Children and security
Upaya is not directed at children under 16. We use appropriate technical and organisational safeguards, including encrypted transport and access controls, but no online service can guarantee absolute security.
11. Changes
We may update this policy as Upaya evolves. Material changes will be communicated in the app or by email where appropriate.