Legal
Privacy Policy
Last updated: April 17, 2026
1. Information We Collect
We collect information you provide directly (name, email, company), usage data (API calls, flag evaluations, rollout events), and technical data (IP address, browser type) for service operation and security purposes.
2. How We Use Your Information
- To operate and improve the Upstream platform
- To process payments and manage subscriptions
- To send product updates and support communications
- To comply with legal obligations
- To detect and prevent fraud and abuse
3. Data Isolation
Every customer workspace is isolated at the data layer. Flag configurations, evaluation logs, and rollout data are never shared between customers. Scale and Enterprise customers may opt for dedicated infrastructure.
4. Data Retention
Audit logs are retained per plan (7 days Free, 90 days Team, 1 year Scale, custom Enterprise). You may request deletion of your data at any time by contacting privacy@upstreamapi.com.
5. Third-Party Services
We use third-party services for payment processing (Stripe), error monitoring (Sentry), and cloud infrastructure (AWS). These providers are bound by their own privacy policies and data processing agreements.
6. Your Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal data. To exercise these rights, contact privacy@upstreamapi.com.
7. GDPR Compliance
For EU customers, Upstream acts as a data processor for customer data and as a data controller for account information. We execute a Data Processing Agreement (DPA) on request.
8. Security
We use TLS encryption in transit, AES-256 at rest, and maintain SOC2 Type II certification (available to Enterprise customers). We conduct annual penetration tests.
9. Cookies
We use essential cookies for authentication and session management. We do not use third-party tracking or advertising cookies.
10. Changes to this Policy
We will notify you of material changes to this policy via email and in-app notification with at least 30 days' notice.
11. Contact
Privacy questions: privacy@upstreamapi.com — Upstream Labs, Inc., San Francisco, CA 94105.