UpOnUp
privacy notice.

Who handles your information

UpOnUp is responsible for information you send to us. Contact [email protected] with a privacy question or request.

What we collect and why

When you enquire or use live chat, we receive the contact details and message you choose to provide so we can answer you. When you pay through Stripe, we receive checkout contact information, the selected currency, payment status and order identifiers. If you choose bank transfer, we save your name, email, business name, optional website, selected currency, amount, terms acceptance and unique payment reference. We also save project details you submit and the result of checking payment. We use these records to deliver the website, communicate with you, provide support and keep necessary business records.

Your private bank-transfer order link grants access to its payment instructions and status. Keep it private. We store a hash of its access token rather than the token itself. We rely on our legitimate interest in answering enquiries and running our business, on steps toward or performance of a contract when you order a website, and on legal obligations for records we must retain. We do not use your project brief to send unrelated marketing.

Your customer account

After checkout, we verify your email using a one-time code sent through Resend. We use the name and email supplied by Stripe to prefill your account details. Cloudflare stores your account, project brief, progress updates, private design previews and change requests so we can deliver and support your website. We use an essential secure sign-in cookie to keep you signed in for up to seven days. Signing out revokes that session. Codes expire after ten minutes. We retain expired authentication records for no longer than 30 days before scheduled cleanup. Private account pages do not load page measurement or public live chat.

Your project conversation saves requests for UpOnUp to review. It does not automatically change or publish your website. Please do not send passwords, full card details or other private account credentials.

Referrals and reward payments

When someone introduces a business through Refer to Earn, we receive the referrer’s name and email, the business and contact names, the contact’s email, any optional website, and a short explanation of when and how the contact asked UpOnUp to email about their website. We also record the permission confirmation and programme terms version. These details come from the referrer; we explain who introduced the contact and provide this privacy notice when we first get in touch. We review the introduction before contacting them.

We use the information to handle the requested introduction, check eligibility and duplicate claims, match a qualifying website order, administer the two reward stages and answer questions. This supports our legitimate interests in handling genuine business introductions and preventing misuse, performance of the referral agreement with the referrer, and any legal record-keeping obligations. Neither person is added to a newsletter.

We tell the referrer only the limited progress needed to administer the reward, such as whether the introduction qualifies and a reward stage has been reached. We do not share the customer’s invoices, project brief or wider financial details. If a reward is due, we arrange the necessary payout details privately; do not put bank details into the referral form. We retain introduction records only as long as needed to resolve the referral and related queries, and payout records for applicable accounting and legal requirements. Contact us using the details below to exercise your information rights.

Page measurement

Cloudflare Web Analytics helps us see aggregate page visits, referral sources and page speed so we can improve this website. Cloudflare says its Web Analytics service does not collect or use visitors' personal data or track individual people across websites. We do not use it for advertising or to identify visitors. The measurement script runs on public pages only. It does not run on private checkout return pages.

You can switch page measurement off or on using the control in the footer. Turning it off reloads the page without the analytics script and stops measurement on later page views in this browser. We store your choice in your browser so it is remembered. If browser storage is unavailable, we do not load the measurement script.

Optional Google Analytics

If you accept optional analytics, Google Analytics helps us understand which public pages and resources people use, which links lead towards an order, and when a website enquiry has been saved. We use this information to improve the site. We do not load the Google tag or send it measurement requests before you accept. Declining does not affect the website, forms or purchases.

After you accept, Google receives page paths, selected interaction names and technical browser information. Analytics cookies distinguish browser visits. We send a broad source category, such as Google, Bing or another referring site, rather than the full referring address. Our events exclude URL query strings, form answers, names, email addresses, private account information and order or enquiry references. Account, checkout, private return and preview pages are excluded. A checkout-link click is not recorded as a purchase; an enquiry event means the website saved a submission, not that it was a qualified lead or a sale.

Google advertising personalisation and Google Signals are disabled. We do not use this setup for remarketing. Our analytics cookies and your choice have a maximum 90-day lifetime. You can change your choice using “Analytics cookies” in the footer. Turning it off stops further Google measurement in that browser and removes the Google Analytics cookies set by this setup. It does not undo information already collected. Your Google Analytics choice is separate from the Cloudflare page-measurement switch.

We rely on your consent for this optional measurement. Google processes the measurement information through Google Analytics; processing may take place outside the UK. Read Google’s privacy policy and how Google uses information from sites that use its services. Contact us if you want to discuss information rights or international-transfer safeguards.

Your currency preference

We use the country signal supplied by our host to suggest GBP, USD or EUR. We do not use browser language as your location. A currency you choose is stored in this browser and takes precedence on future visits.

Chat and browser storage

Chat loads only when you open it. Its short notice gives you a choice before starting a conversation. tawk.to uses cookies and browser storage to keep chat working and stores the conversation so we can answer your enquiry. You can start live chat without sharing a name or email. If you leave before we reply, an email address is optional for follow-up; the separate offline form asks for contact details.

We also use browser storage to remember your currency and measurement choices, keep records you choose to save in our website tools, carry a brief to the enquiry form, and help you return to a bank-transfer order in the same browser session. Saving a tool record does not send it to us. You can clear these records in your browser; export anything you want to keep first.

Services that help us

Stripe processes online checkout payments. Your bank and our receiving bank process bank transfers if you choose that alternative. Cloudflare receives and stores website enquiries, website-review requests, referral introductions and project briefs so we can handle them even if an email notification is delayed. Resend sends notification emails to our Google Workspace mailbox. Google Workspace provides our business email. When you open live chat, tawk.to powers that conversation. Cloudflare hosts this website, stores bank-order, project-brief, paid-order and email-handoff records, and provides the page measurement described above. Resend sends transactional order emails using your checkout email address. These providers process the information needed for their role under their own service terms and privacy notices. Some processing may take place outside the UK; contact us for information about a provider's location and transfer safeguards. We do not ask for your bank login, passwords or full card details; card details are entered with Stripe.

Keeping forms reliable

We use background checks to prevent spam and repeated submissions. These include a pseudonymous digest of the request’s network address, rather than the raw IP address in our form records. We use that digest for abuse prevention and remove it after 30 days. These checks do not add either person to marketing lists.

How long we keep it

We keep enquiry information for as long as needed to answer and follow up, and project and transaction records for as long as needed to deliver the service and meet accounting or legal obligations. If you would like us to review or delete information, contact us. Some records may need to be retained where the law requires it.

Your choices

You can ask to see, correct or delete the information we hold about you, restrict or object to some uses, or request a copy for transfer where the law provides that right. Your right to object to processing based on legitimate interests is available by emailing [email protected]. We will explain any legal reason we need to keep particular records. You can also raise a concern with the UK Information Commissioner’s Office.