Privacy Policy & Data Protection Governance Sizin məlumatlarınız, sizin hüquqlarınız, aydın şəkildə izah olunub.

Version: 2.1.0  |  Effective Date: October 2026  |  Status: Global Privacy Governance & Data Protection Policy

1. Roles of the Parties (Data Controller vs. Data Processor)

To ensure strict regulatory clarity under Article 4 and Article 28 of the GDPR:

• Account & Registration Data: Upinno acts as the Data Controller regarding customer contact details, login credentials, billing transaction histories, and security audit logs.
• Customer Messaging & End-Consumer Data: With respect to direct messages, social comments, end-buyer shipping addresses, and transaction slips processed on behalf of the customer, the Customer acts as the Data Controller, and Upinno operates strictly as the Data Processor carrying out documented automation instructions.

---

2. Information We Collect and Process

• Identity & Authentication Data: Name, business email, authorized phone numbers, and encrypted third-party social media access tokens (Instagram, Meta Page IDs, WhatsApp Business, Telegram IDs).
• Operational Interaction Data: Inbound message bodies and comments routed through Upinno pipelines for real-time automated chatbot responses.
• Payment & Order Data: Machine-vision character extraction from customer-uploaded bank transfer slips strictly to streamline merchant order reconciliation.
• Technical Telemetry: Anonymized IP addresses, browser agents, access timestamps, and webhook response payloads used for DDoS mitigation, intrusion detection, and performance telemetry.

---

3. Artificial Intelligence Policy (Zero Public Model Training)

1. No Foundation Model Training: Upinno unconditionally warrants that private customer communications, direct messages, brand product catalogs, and confidential business workflows are never used to train, fine-tune, or reinforce public foundation models.

2. In-Context Inference Only: Prompts and context vectors are processed strictly in transient memory (RAM) during live inference. Contextual buffers are purged from runtime instances upon delivery of the response.

---

4. Data Security Architecture & Cryptographic Safeguards

Pursuant to Article 32 of the GDPR, Upinno deploys defense-in-depth security measures:

• Encryption at Rest: All social media OAuth access tokens and private credentials are encrypted at rest using AES-256-GCM. Encryption keys are maintained in isolated environment vaults decoupled from the primary database.
• Encryption in Transit: All data transmissions between clients, Upinno cloud clusters, and external social webhooks are protected with TLS 1.3 / HTTPS.
• Multi-Tenant Isolation: Customer data is logically segregated using unique workspace tenant keys (workspace_id), preventing cross-tenant access.

---

5. Financial Information & Sensitive Payment Data

1. No Storage of Primary Card Data: Upinno does not collect, process, or store sensitive payment card details (16-digit primary account numbers, CVV/CVC security codes, or PINs).

2. All platform subscription billing is conducted through PCI-DSS Level 1 certified international payment processors.

---

6. Data Retention, Automated Pruning, and Right to Erasure

1. Automated 90-Day Message Pruning: To comply with data minimization mandates (Article 5(1)(c) GDPR), direct messages, bot transaction logs, and customer comments older than ninety (90) days are automatically and irrevocably deleted from operational databases.

2. Right to Erasure (Article 17 GDPR): Customers may revoke social channel tokens or request full account termination at any time via the dashboard. Upon account closure, all associated workspace data is purged within seventy-two (72) hours.

3. Encrypted disaster recovery snapshots are automatically overwritten and purged on a rolling 30-day lifecycle.

---

7. Sub-processors and Cross-Border Transfers

Upinno utilizes tier-1 infrastructure providers (e.g., Hetzner Online GmbH in Germany/EU, OpenRouter API gateways, and enterprise edge caching). Transfers of personal data are conducted pursuant to standard contractual clauses (SCCs) ensuring an adequate level of protection under Chapter V of the GDPR.

---

8. CCPA / CPRA Notice: "We Do Not Sell Personal Information"

Upinno does not sell, rent, or lease personal information or user-generated chat data to data brokers, ad networks, or external third parties for monetary or other valuable consideration.

---

9. Contact the Data Protection Officer (DPO)

For inquiries regarding privacy, exercising data subject rights, or security disclosures, contact our Data Protection Office:

• Email: [email protected] / [email protected]
• Support Desk: Available via the in-app support ticketing terminal.

---

10. Controlling Language

This Privacy Policy is executed in the English language. Any translation is provided solely for reference. In the event of any conflict, discrepancy, or ambiguity between the English version and any translated version, the English version shall govern, control, and prevail.