Privacy Policy

upfy.me provides a multi-tenant platform that lets organizations collect incident reports through QR codes and route them to the right team. Each customer organization (a "workspace") is the controller of the data it manages; upfy acts as a processor on its behalf.

Account data: name, email and password (stored hashed) for people who sign up.

Report data: the description, optional photos and metadata submitted when someone scans a QR code and reports an issue. Reporters are not required to create an account.

Usage data: log data, device and browser information, and approximate location derived from IP, used to operate and secure the service.

To provide the service: create workspaces, route reports, send notifications and show dashboards.

To secure and improve the platform, prevent abuse and comply with legal obligations.

We do not sell personal data, and we do not use report content for advertising.

We process data under the bases that apply to your region, including performance of a contract, legitimate interests, consent (for example, non-essential cookies) and legal obligations. We honor data-subject rights under applicable law such as Brazil's LGPD and comparable frameworks.

We share data with infrastructure and email providers strictly to run the service, under contracts that require appropriate safeguards. We may disclose data when required by law.

Report history is retained according to each workspace's plan. We apply encryption in transit, access controls and regular backups. No method of transmission is 100% secure, but we work to protect your data.

You may request access, correction, deletion or portability of your personal data, and you may object to or restrict certain processing. Contact us and we will respond within the timeframes required by law.