Privacy policy

1. Who we are

The controller of the personal data described in this policy is Upkyo, the trade name of a Limited Liability Company organized under the laws of the State of New Mexico, USA, company number 6867626.

Mailing address: 1178 Broadway, 3rd Floor #1249, New York, NY 10001, USA. For any privacy question, contact support@upkyo.com or open a ticket from the client area.

In this policy, “Upkyo,” “we,” “us” and “our” refer to this operator. “You” means any person whose data we process: website visitors, customers, authorized users of a customer account, affiliates, and anyone who contacts us.

2. Scope

This policy covers the processing we carry out on our own behalf: the upkyo.com website, the client area, billing, support, the affiliate program, the Upkyo mobile app and our communications.

It does not cover the data our customers place on the services they buy from us, such as websites, databases, mailboxes, files and backups. For that content, the customer is the controller and Upkyo acts as a processor, as described in section 8 below and in our Data Processing Agreement.

It also does not cover third-party websites, apps or services, including those our website links to or that we resell, which are governed by their own policies.

3. Account data

When you create an account or order a service, we collect your first and last name, your company name and tax ID where applicable, your email address, mailing address, country, phone number if you provide it, preferred language, login credentials, and your order and service history.

Your password is stored as a cryptographic hash and is never readable by our staff. If you add authorized users to your account, we process their name, email address and access rights; you agree to inform them of this processing.

To register a domain name, we also collect the registrant, administrative, technical and billing contact details required by ICANN and by the relevant registry. For the affiliate program, we process the information needed to track referrals and pay commissions.

4. Billing and payment data

We keep your invoices, payment history, amounts, taxes applied based on your country and status, and the information we need for accounting and tax compliance.

Card payments are processed by Stripe, and PayPal payments are processed by PayPal. Upkyo does not collect or store full card numbers or security codes. You enter that data directly with these providers, which handle it under their own policies and the payment card industry security standards. We only receive limited details, such as the card brand, last digits, expiration date, the email address of your PayPal account, the transaction status, and a reusable payment token used for automatic renewals.

Stripe and PayPal may run their own fraud checks and act as independent controllers for those checks and for their regulatory obligations.

5. Technical data and logs

When you use our website, the client area, the app or our servers, we automatically collect technical data: IP address, connection dates and times, browser and device type, operating system, pages viewed, access and error logs, security logs, login attempts, and actions taken in the client area.

The servers that host your services also generate technical logs about traffic, email, backups, and the detection of attacks and malware. We use these logs to operate, secure and troubleshoot the services, prevent fraud and abuse, and respond to legal requests.

Our website only uses cookies that are strictly necessary for it to work, as described in our Cookie Policy. We do not use advertising cookies or any third-party tracking tools.

6. Support communications

When you open a ticket, email us or use a contact page, we process the content of your messages, any attachments, any access details you choose to share for a task, and the history of our conversations.

To work on a service, our staff may need technical access to your hosted content. That access is limited to what your request, security or the law requires. Never send us a card number by ticket or email.

7. Upkyo mobile app

The Upkyo mobile app gives you access to your client area. It processes your login credentials, a session token kept in your device’s secure storage, your display and language preferences, and technical information about your device and app version that it needs to work and stay secure.

When you add a card in the app, the card details are entered in a component provided by Stripe and sent directly to Stripe. If the app offers notifications and you allow them, we process your device’s push token; you can turn notifications off at any time in your device settings.

The app contains no advertising or cross-app tracking tools. Apple and Google, which distribute the app, process certain data under their own policies when you download or update it.

8. Hosted content: Upkyo acts as a processor

Websites, databases, emails, files and backups you store on our services, along with the data of the visitors, customers or contacts of your own sites and mailboxes, are processed by Upkyo solely on your behalf and on your instructions.

For that data, you are the controller under the GDPR, or the “business” under U.S. state privacy laws, and Upkyo is your processor or “service provider.” You are responsible for having a legal basis, informing the people concerned, publishing your own privacy policy and handling their requests. We do not look at that content except where needed to provide the service, keep it secure, handle an abuse report, carry out your request or comply with the law.

People whose data appears in a customer’s content should contact that customer. If they write to us, we forward their request to the customer when we can identify them. Upkyo’s commitments in this role are set out in our Data Processing Agreement.

9. Purposes and legal bases

We process your data for the following purposes, each based on a legal ground under Article 6 of the GDPR.

Performance of a contract or steps before entering into one: creating and managing your account; providing, renewing and terminating services; registering and transferring domain names; billing and collecting payments; support; sending service emails; and running the affiliate program.

Legal obligation: bookkeeping, retaining invoices, tax compliance, responding to lawful requests from authorities, handling copyright notices, complying with ICANN and registry rules, and handling privacy requests.

Legitimate interests: network and system security; preventing fraud, non-payment, spam and abuse; protecting against attacks; improving our services; internal statistics; establishing or defending legal claims; debt collection; and emailing business customers about similar services. We make sure these interests do not override your rights and freedoms, and you can object as explained in section 14.

Consent: newsletters and promotional offers sent to consumers where the law requires consent, mobile app notifications, and any other processing for which we ask you. You can withdraw consent at any time without affecting processing carried out before.

Providing the data marked as required is necessary to enter into the contract. Without it, we cannot provide the service.

10. How long we keep data

We keep personal data only as long as needed for the purposes for which it was collected, plus any period required or permitted by law.

Account data is kept for as long as our contractual relationship lasts, then for the statute of limitations that applies to any related legal claims. Invoices and accounting records are kept for the periods required by applicable accounting and tax laws. Marketing data is kept until you unsubscribe or after a reasonable period of inactivity.

Technical and security logs are kept for a limited time that is proportionate to their security, troubleshooting and evidentiary purposes, or longer if the law requires it or an incident or abuse is under investigation. Support tickets are kept for the duration of the relationship and the applicable statute of limitations.

Hosted content is deleted after a service ends, as set out in our Terms of Service and Data Processing Agreement; copies in backups are removed as those backups rotate out in the normal course. When these periods end, data is deleted or anonymized.

11. Recipients and service providers

Authorized Upkyo staff can access your data only as their duties require. We disclose it to third parties only in the following cases.

Processors acting on our behalf, chosen for their security safeguards and bound by contract: hosting infrastructure partners located in the European Union; transactional email delivery services; and the support, billing and administration tools our services rely on.

Providers acting as independent controllers: Stripe and PayPal for payments; our ICANN-accredited registrar and the domain registries, which may publish certain data in WHOIS or RDAP directories under their rules; and the providers of third-party services you order through us, such as NordVPN, for the data needed to activate them.

Authorities and other permitted parties: courts, government and tax authorities in response to a lawful request; rights holders in a procedure provided for by law; and lawyers, accountants and auditors bound by confidentiality. Corporate transactions: in a merger, acquisition, asset sale or restructuring, your data may be transferred to the successor, which remains bound by this policy.

Customers covered by our Data Processing Agreement can request the detailed list of our sub-processors.

12. International data transfers

Hosted content and the data of our hosting services are stored on servers located in data centers in the European Union.

Upkyo is a company organized in the United States. Some data, especially account, billing and support data, may therefore be accessed or processed from the United States or from other countries where our providers operate. When personal data subject to the GDPR is transferred outside the European Economic Area to a country without an adequacy decision, we protect the transfer with the Standard Contractual Clauses adopted by the European Commission, supplemented with additional measures where needed, or with another recognized mechanism, such as the recipient’s certification under the EU-U.S. Data Privacy Framework where available.

Transfers from the United Kingdom and Switzerland are covered by the versions of these clauses recognized by the authorities of those countries. You can request a copy of the applicable safeguards by writing to support@upkyo.com.

13. Security

We use technical and organizational measures suited to the risk: encryption in transit; servers paired for high availability; automatic hourly backups for hosting; DDoS and malware protection; access control and logging; least-privilege access; strong authentication for administrative accounts; security updates; and confidentiality commitments from our staff.

No system is completely secure. Security is a shared responsibility: you remain responsible for keeping your passwords confidential, updating your websites and software, managing the access you grant, and keeping your own backup copies. Tell us right away about any unauthorized use of your account.

14. Your rights under the GDPR

If the GDPR or a similar law applies to you, you have the right to access your data; to have it corrected; to have it erased; to restrict its processing; to receive the data you gave us in a portable format; to object to processing based on our legitimate interests, and to object at any time to direct marketing; to withdraw your consent at any time; and, where the law of your country provides for it, to give instructions about what happens to your data after your death.

You can exercise most of these rights from your client area, or by writing to support@upkyo.com. We respond within one month of receiving your request, as required by Article 12 of the GDPR. That period may be extended in the cases that article allows, and we will let you know if it is.

We may ask you to verify your identity if we have reasonable doubts. Some rights have legal limits: for example, we may keep data needed to meet a legal obligation, such as invoices, or to establish, exercise or defend legal claims. Exercising your rights is free unless a request is manifestly unfounded or excessive.

15. California residents: information we collect

This section and the next apply to California residents when the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to Upkyo. They supplement the rest of this policy.

In the past 12 months, we have collected the following categories of personal information as defined by that law: identifiers, such as name, email address, mailing address, IP address and account identifiers; customer records information, such as phone number, company and limited payment information; commercial information, such as services purchased and order history; internet or other electronic network activity information, such as login and usage logs; approximate geolocation data derived from IP addresses; professional information, such as company and job title; and the content of support communications.

We also collect sensitive personal information as defined by that law, limited to account login credentials combined with a password. We use it only to let you access and secure your account, not to infer characteristics about you.

We collect this information from you, from your devices, from our payment providers and from domain registries. We use it for the purposes described in section 9 and disclose it for business purposes to the categories of recipients described in section 11. We keep it based on the criteria in section 10.

16. California residents: your rights

Upkyo does not sell your personal information or share it for cross-context behavioral advertising, as those terms are defined by that law, and has not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

You have the right to know the categories and specific pieces of personal information we have collected, their sources, our purposes and the categories of recipients; the right to delete; the right to correct; the right to opt out of sale or sharing; and the right to limit the use of sensitive personal information, which we already use only for permitted purposes.

To exercise these rights, email support@upkyo.com or open a ticket from the client area. We verify your identity by matching the information you provide with the information we hold, and we may ask for more. You may use an authorized agent: we will ask the agent for written permission signed by you, and we may ask you to verify your identity directly with us.

We will confirm receipt of your request and respond within 45 days, as the law requires. We may extend that period once where the law allows, after letting you know. We will not discriminate against you for exercising your rights: we will not deny you service or charge you a different price or provide a different level of service for that reason.

17. Residents of other U.S. states

Several U.S. states, including Virginia, Colorado, Connecticut, Utah, Texas and Oregon, as well as other states with comparable laws, grant rights over personal data. When those laws apply to Upkyo, and depending on your state, you may ask us to confirm whether we process your data, access it, correct it, delete it, receive a portable copy, and opt out of targeted advertising, the sale of your data, and profiling that produces legal or similarly significant effects. We do not sell data, engage in targeted advertising, or carry out that kind of profiling.

You can submit requests as described in the previous section. If we decline your request, you may appeal by replying to our response or by emailing support@upkyo.com with “Appeal” in the subject line. We will tell you in writing what we decided on your appeal. If your appeal is denied, you may contact your state’s Attorney General.

18. Global Privacy Control and Do Not Track

We treat a Global Privacy Control signal sent by your browser or an extension as a valid request to opt out of the sale and sharing of your personal information for that browser and, if you are signed in, for your account. Because we do not sell or share your data, the signal does not change how we process it.

There is no common industry standard for interpreting Do Not Track signals. Our website does not track visitors across third-party sites and does not allow third parties to do so, so it works the same way whether or not the signal is turned on.

19. Children

Our services are intended for businesses and for adults with the legal capacity to enter into a contract. They are not directed to children.

We do not knowingly collect personal information from children under 13 years of age, in line with the U.S. Children’s Online Privacy Protection Act, or from minors under 16 in the European Union, or under the lower age set by the law of their country, without the consent of a parent or guardian.

If you believe a child has given us personal information, email support@upkyo.com and we will delete that information and the related account. Customers who host websites directed to children are solely responsible for complying with the laws that apply to those sites.

20. Marketing emails and unsubscribing

We may send you information about our services, offers and newsletters as described in section 9: to business customers about services similar to the ones they use, and to others with their consent where the law requires it.

Every marketing message identifies Upkyo as the sender, has a subject line that reflects its content, includes our mailing address, and contains a simple, free unsubscribe link, in line with the U.S. CAN-SPAM Act and European rules. We honor unsubscribe requests within the time the law requires. You can also unsubscribe by emailing support@upkyo.com.

Unsubscribing does not apply to service messages that are necessary to perform the contract, such as order confirmations, invoices, renewal and due-date notices, security alerts, incident updates and changes to our terms.

21. Automated decision-making

Upkyo does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the GDPR.

Our security tools may automatically block a suspicious IP address or connection to protect the services, and our payment providers run their own fraud checks. If you believe such a measure affects you wrongly, contact support and a person will review your situation.

22. Data breaches

We have procedures to detect, assess and handle security incidents. If a personal data breach occurs for which we are the controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 of the GDPR, unless the breach is unlikely to result in a risk to people’s rights and freedoms.

If the breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay, in line with Article 34 of the GDPR. We also comply with the breach notification requirements of applicable U.S. state laws.

For data you host as a customer, we notify you of any breach without undue delay under our Data Processing Agreement so you can meet your own obligations.

23. Complaints to a regulator

If you believe your data is not being handled lawfully, you can first write to us at support@upkyo.com and we will look into it carefully.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you habitually live, where you work or where the alleged infringement took place, under Article 77 of the GDPR. California residents may contact the California Privacy Protection Agency or the California Attorney General, and residents of other states may contact their state’s Attorney General.

24. Changes to this policy

We may update this policy to reflect changes to our services, our providers or the law. The current version is posted on this page with its last updated date.

If we make a material change, we will notify you in advance by email or in the client area. If the law requires your consent for new processing, we will obtain it before we start.

This policy is published in several languages. If there is any inconsistency between versions, the English version controls, subject to any mandatory provisions that protect you.

25. Contact us

For any question about this policy or to exercise your rights, email support@upkyo.com or open a ticket from the client area.

Mail: Upkyo, 1178 Broadway, 3rd Floor #1249, New York, NY 10001, USA.

Last updated: October 2026.