This Privacy Policy describes how The Update LLP ("Uplabs", "we", "us", or "our") collects, uses, stores, and protects personal data when you use the Uplabs platform at uplabs.in. This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and applicable Rules thereunder.
1. Data We Collect
1.1 Account and identity data
- Full name, email address, phone number of workspace owners and members.
- Business name, GST registration number, business address.
- Profile information you choose to provide.
1.2 Workspace and operational data
- Client contact details, project records, invoices, expenses, salary information entered by your studio.
- Time tracking entries, proposals, and documents created within the platform.
- Financial data including payment amounts, GST and TDS records.
1.3 Usage and technical data
- IP address, browser type, device identifiers, operating system.
- Pages visited, features used, session duration, click patterns.
- Error logs and performance data for platform improvement.
1.4 Payment data
- Transaction identifiers and payment status from our payment processor.
- We do not store full card numbers or banking credentials — these are handled by our payment gateway.
1.5 Communication data
- Support conversations via email or in-app chat.
- Survey responses and feedback you voluntarily provide.
2. How We Use Your Data
We process your personal data for the following purposes:
- Service delivery: To operate, maintain, and improve the Uplabs platform and deliver the features you have subscribed to.
- Billing and compliance: To process subscription payments, issue GST-compliant invoices, and meet our statutory tax obligations.
- Communication: To send transactional emails (payment receipts, subscription notices), product updates, and where you have opted in, marketing communications.
- Support: To respond to your queries, investigate issues, and provide technical assistance.
- Security: To detect, investigate, and prevent fraud, misuse, and security incidents.
- Legal compliance: To meet obligations under Indian law including the IT Act, DPDPA, GST Act, and court orders.
- AI feature improvement: Where you have provided separate explicit consent at signup, anonymised and aggregated data may be used to train and improve AI-powered features within Uplabs. You may withdraw this consent at any time.
3. Legal Basis for Processing
Under the DPDPA 2023, we process your personal data on the following bases:
- Consent: For marketing communications and AI training use, obtained via explicit opt-in.
- Contract performance: For delivering the platform services you have subscribed to.
- Legitimate interests: For security monitoring, fraud prevention, and anonymised analytics.
- Legal obligation: For GST invoicing, tax records, and regulatory compliance.
4. Data Sharing and Sub-Processors
We do not sell your personal data to third parties. We share data only with trusted sub-processors necessary to operate the platform, all of whom are contractually bound to protect your data:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database hosting, authentication, storage | United States / EU |
| Cloudflare Inc. | CDN, DDoS protection, R2 object storage | United States / Global |
| Razorpay | Payment processing | India |
We may also disclose data to law enforcement or regulatory authorities where required by applicable Indian law, court order, or to protect the rights and safety of Uplabs or others.
5. Cross-Border Data Transfers
Your data is stored on servers operated by Supabase and Cloudflare, which may be located outside India. By using Uplabs, you acknowledge and consent to this cross-border transfer. We ensure adequate safeguards are in place through contractual protections with these providers.
6. Data Retention
We retain your personal data and Studio Data indefinitely on our servers unless you request deletion. This approach allows studios to maintain long-term access to their financial history and project records, which is particularly important for GST audit purposes (where the Indian tax authority requires records to be available for up to 6 years).
You may export all your data at any time and may request permanent deletion by contacting legal@uplabs.in. Deletion requests are processed within 30 days. Note that certain records may be retained longer where required by law (e.g. GST transaction records).
7. Your Rights Under DPDPA 2023
As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access: Request a summary of personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data, subject to legal retention obligations.
- Grievance redressal: Raise complaints with our Grievance Officer (details in Section 9).
- Withdraw consent: Withdraw any previously given consent (including AI training consent) at any time via account settings.
- Nominee: Designate a nominee to exercise your rights in the event of death or incapacity, as provided under the DPDPA.
To exercise any of these rights, submit a request via our data request form or email privacy@uplabs.in. We will respond within 30 days.
8. Data Security
Uplabs implements the following security measures to protect your data:
- Row-level security (RLS) ensuring strict workspace isolation — no studio can access another studio's data.
- Encryption in transit (TLS 1.2+) and at rest for all stored data.
- Immutable audit logs for all staff access to workspace data.
- Multi-factor authentication available for workspace owners.
- Regular security audits and vulnerability assessments.
Breach notification: In the event of a personal data breach, we will notify affected users and the relevant authorities as required by the DPDPA 2023 and applicable regulations, including the Data Protection Board of India within 72 hours of becoming aware of a notifiable breach.
9. Grievance Officer
Grievance Officer details (DPDPA 2023 — mandatory):
- Email: grievance@uplabs.in
- Address: The Update LLP, Mysuru, Karnataka, India
- Availability: Monday to Friday, 10am – 6pm IST
- Response commitment: Acknowledgement within 24 hours, resolution within 30 days.
10. Children's Data
Uplabs is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us immediately at privacy@uplabs.in and we will delete the account.
11. Updates to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via email at least 7 days before they take effect. The current version is always available at uplabs.in/privacy.