This policy explains how Upra (“Upra”, “we”) handles personal data on the website upra.ai and in the Upra application (app.upra.ai). It includes specific sections on the data Upra receives from Google and Microsoft accounts you choose to connect, and on how Upra uses AI.
1. Who we are
The data controller for the website, your account and billing is:
UPRASET
293/295 boulevard Saint-Denis
92400 Courbevoie
France
Registration: RCS Nanterre 834 361 016
VAT: FR00834361016
Email: support@upra.ai
Data protection contact: Data protection contact, support@upra.ai.
2. Scope and roles
This policy covers three situations, and Upra plays a different role in each:
- Visitors and prospects of upra.ai (for example when you request a demo or write to us). Upra is the controller.
- Customers and users of the Upra application: account, profile, billing, security and usage data. Upra is the controller.
- Customer Data: the contacts, companies, deals, conversations, files and any other information that a customer imports into or synchronises with its Upra workspace, including data from connected Google or Microsoft accounts. The customer is the controller; Upra is the processor and acts only on the customer’s instructions under the Data Processing Agreement (DPA). If you are a contact of one of our customers and have a question about your data, please address it to that customer first; we will assist them.
3. Data we collect
3.1 Account and profile data
Name, business email address, password (hashed), job title, company, workspace name, language, time zone, profile picture, and the sign-in method you use (email and password, Google or Microsoft).
3.2 Billing data
Company name, billing address, VAT number, plan, seats, invoices and payment status. Payments are processed by Mollie B.V.. Upra never stores full card numbers or bank credentials; Mollie shares with us only a payment reference, the payment method type and the last digits of the instrument.
3.3 Technical and usage data
IP address, browser and device information, log-in events, pages and features used, error reports and security logs. On the website we do not use analytics or advertising trackers (see the Cookies section).
3.4 Communications
Emails you send us, demo requests, support conversations and their metadata.
3.5 Customer Data
Everything a customer puts in its workspace or connects to it: CRM records, notes, files, conversations from connected channels (email, WhatsApp, LinkedIn, SMS, Telegram, web chat), calendar events, call recordings and transcripts, and enrichment data. This includes personal data of the customer’s own contacts, employees and partners.
3.6 Data from third-party sign-in
When you sign in with or connect a Google account, we receive your email address and a unique account identifier. When you do so with a Microsoft account, we receive your name, email address and a unique account identifier.
4. Why we use data and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Create and operate your account and workspace, provide the Service | Account, profile, Customer Data, technical data | Performance of a contract |
| Bill and collect payment, keep accounting records | Billing data | Contract; legal obligation |
| Synchronise email, calendar and contacts you connect | Connected-account data (see sections 5–7) | Contract; your explicit authorisation at the provider |
| Provide AI features (summaries, enrichment, signals, Ask Upra, agents) | Customer Data, usage data | Contract (features you or your workspace enable) |
| Secure the Service, prevent abuse, keep logs | Technical data | Legitimate interest (security) |
| Answer your requests, run demos, support you | Communications, account data | Contract or pre-contractual steps; legitimate interest |
| Send product and service notices | Account data | Contract; legitimate interest |
| Send marketing communications | Email address | Consent (you can withdraw it at any time) |
| Comply with law, respond to lawful requests, establish or defend claims | Any relevant data | Legal obligation; legitimate interest |
5. Email, calendar and contacts synchronisation
Upra’s core promise is zero manual entry. To deliver it, each user can connect a Google Workspace or Microsoft 365 account. Connecting is optional, happens through the provider’s own consent screen, and can be revoked at any time from Upra (Settings → Connected accounts) or from your Google or Microsoft account security settings.
When an account is connected, Upra:
- reads emails exchanged with your contacts to attach them to the right contact and company, log the activity and let AI features summarise conversations and detect signals;
- sends emails from Upra only when you (or an agent acting within the autonomy level you configured) trigger a send — every draft is visible in your own mailbox’s sent folder;
- reads calendar events to log meetings and prepare meeting briefs, and creates, updates or deletes the meetings you schedule in Upra;
- reads contacts to match emails and meetings to the right person, and creates, updates or deletes them when you change a contact in Upra, so your address book and your CRM stay in sync.
Upra does not read mail unrelated to your CRM contacts for any other purpose, does not sell or share mailbox content with third parties, and does not use it for advertising.
6. Google user data
The Upra application requests the following Google OAuth scopes. Each scope is only requested for the feature described, and only after you grant it on Google’s consent screen.
| Scope / permission | What Upra uses it for |
|---|---|
openid, email | Identify the Google account you connect, so Upra shows its address and sends from it, and sign you in to your existing Upra account with Google. |
gmail.readonly | Read the emails you exchange with your contacts to attach them to the right record and log activity. |
gmail.send | Send emails from Upra (drafts you or an agent prepared, always confirmed by you). |
calendar.events.owned | Read the events of the calendars you own to log meetings, and create, update or delete the meetings you schedule in Upra, with a Google Meet link. |
contacts | Read your contacts to match emails and meetings to the right person, and create, update or delete them when you change a contact in Upra, so your address book and your CRM stay in sync. |
How Google user data is used
Data received from Google APIs is used exclusively to provide and improve the user-facing features described above for the user who granted access and for that user’s workspace: attaching emails and meetings to CRM records, logging activity, generating summaries, briefs and signals, sending messages the user approves, scheduling, and importing contacts.
How it is stored
Data obtained from Google is stored encrypted at rest in the European Union, inside the customer’s isolated workspace, and is protected by the security measures described on our Security & Sovereignty page. Access tokens are stored encrypted and are used only to perform the synchronisation. When you disconnect your Google account or delete your Upra account, synchronisation stops immediately and data obtained from Google that is not already part of your CRM records is deleted immediately, and removed from backups within 40 days.
How it is shared
Google user data is not sold, and is not shared with third parties except: (a) sub-processors that are strictly necessary to provide the feature (hosting and AI model inference, both operated by Scaleway in France), under contract and under the same restrictions; (b) if required by law; (c) as part of a merger or acquisition, with notice to you; (d) with your explicit consent. Google user data is never used for advertising, is never transferred to data brokers or information resellers, and is never used to determine creditworthiness or for lending purposes.
Human access
Google user data (email content, calendar events, contact lists) is never sent to our web-search provider Exa; only generic search queries such as a company name or website domain may be sent for enrichment, as described in section 9.
Upra personnel do not read Google user data, except (a) with your explicit consent for a support case, (b) as necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations on data that has been aggregated and anonymised.
Limited Use disclosure
Upra’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
Upra does not use Google user data, including Google Workspace data, to develop, improve or train generalised artificial intelligence or machine-learning models.
Revoking access
You can revoke Upra’s access at any time from myaccount.google.com/permissions or from Upra Settings → Connected accounts.
7. Microsoft user data
The Upra application requests the following Microsoft Graph permissions when you connect a Microsoft 365 account, subject to your consent on Microsoft’s consent screen (and, where required, your organisation’s administrator).
| Scope / permission | What Upra uses it for |
|---|---|
openid | Sign you in with your Microsoft account. |
email | Identify the Microsoft account you connect, so Upra shows its address and sends from it. |
offline_access | Keep the connection active so Upra can sync in the background, without asking you to sign in again. |
User.Read | Read your basic profile (name and email address) to set up your Upra account. |
Mail.ReadWrite | Read the emails you exchange with your contacts to attach them to the right record and log activity, and create a draft before each send so the message stays in its thread. |
Mail.Send | Send emails from Upra (drafts you or an agent prepared, always confirmed by you). |
Calendars.ReadWrite | Read your calendar events to log meetings, and create, update or delete the meetings you schedule in Upra. |
Contacts.ReadWrite | Read your contacts to match emails and meetings to the right person, and create, update or delete them when you change a contact in Upra, so your address book and your CRM stay in sync. |
Data received through Microsoft Graph is used, stored, shared and protected exactly as described for Google user data in section 6: only for the user-facing features of your workspace, encrypted at rest in the EU, never sold, never used for advertising, never used to train generalised AI models, and deleted immediately when you disconnect the account, then removed from backups within 40 days.
You can review and revoke Upra’s access at myapps.microsoft.com (work or school accounts) or account.live.com (personal accounts), or from Upra Settings → Connected accounts.
8. AI processing
Upra is an AI-native, AI-operated CRM. AI features include conversation summaries, meeting briefs, contact and company enrichment, deduplication, lead and deal scoring, risk signals, next-best-action suggestions, Ask Upra (a conversational assistant over your workspace data) and agents that prepare follow-ups, qualify leads and perform other routines.
- What is processed: the CRM records, conversations, calendar events and documents in your workspace that are relevant to the feature you use, and the questions you ask.
- Where: by default, on models Upra manages on European cloud infrastructure (Scaleway, France); the content you process with AI features stays in the European Union. When an AI feature needs fresh information from the public web (for example researching a company), it sends a search query — never your emails, documents or CRM records — to our web-search provider Exa (United States). Customers may instead configure their own model provider with their own API key, in which case that provider’s terms apply to the data sent to it. Upra only supports providers whose API terms exclude training on the data sent to them. Google Workspace user data is never sent to a provider that uses it to train its models.
- No training on your data: Customer Data and Google or Microsoft user data are not used to train or improve generalised AI models, whether Upra’s or a third party’s. Our contracts with AI sub-processors prohibit such use.
- Human in the loop: AI output is a proposal. Agents operate in the mode you configure (suggestion, approval or autonomous), every proposal shows the data it relies on, and Upra never edits your CRM behind your back.
- Automated decision-making: Upra does not make decisions producing legal or similarly significant effects on individuals without human involvement. Scores and signals are aids for your team, not decisions.
9. Data enrichment
When enabled by the customer, Upra completes contact and company records (for example job title, company size, industry, public social profiles) using publicly available web information retrieved through Exa, listed in our sub-processors. Only the search query needed (such as a company name, a website domain or a person’s name and company) is sent; the results are stored in the customer’s workspace in the EU. Enrichment relies on the customer’s legitimate interest in maintaining accurate business records. Customers remain responsible for informing their contacts and honouring their rights.
10. Sharing and sub-processors
We share personal data only with:
- Sub-processors that help us run the Service, under written contracts that impose confidentiality and data-protection obligations. The current list is below and maintained on the Sub-processors page, which also describes how we notify changes.
- Your organisation: workspace administrators can see the users, records and activity in their workspace.
- Authorities when required by law or to protect rights, safety and property.
- A successor in the event of a merger, acquisition or asset sale, with prior notice.
We do not sell personal data and we do not share it with advertisers.
| Sub-processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Website and application hosting, databases, backups | France (EU) |
| Scaleway SAS | AI model inference (Upra-managed models on European cloud) | France (EU) |
| Scaleway SAS (Transactional Email) | Transactional email delivery | France (EU) |
| Mollie B.V. | Payment processing | Netherlands (EU) |
| Exa Labs, Inc. | Web search for AI research and company/contact enrichment (search queries only) | United States (Standard Contractual Clauses) |
11. International transfers
Upra hosts and processes data in the European Union. One sub-processor, Exa Labs, Inc., is located in the United States and receives only web-search queries for enrichment and research. Where a sub-processor processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses, together with additional safeguards where needed. Details are available on request at support@upra.ai.
12. Retention
| Data | Retention |
|---|---|
| Account and profile data | 30 days after account deletion |
| Customer Data (CRM records, conversations, files) | 30 days after workspace termination (export window) |
| Data synced from a connected Google or Microsoft account | Deleted immediately when you disconnect the account; removed from backups within 40 days |
| Invoices and billing records | 10 years (French accounting obligations) |
| Technical and security logs | 12 months |
When retention ends, data is deleted or irreversibly anonymised. Backups are rotated on a fixed schedule so that deleted data disappears from backups within the following cycle.
13. Security
Upra applies technical and organisational measures appropriate to the risk: encryption in transit and at rest, tenant isolation enforced at the database layer, role-based access control, multi-factor authentication, audit logs, encrypted backups, vulnerability management and staff confidentiality obligations. Details are on the Security & Sovereignty page. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authority as required by law.
14. Your rights
Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time where processing is based on consent. You can exercise these rights by writing to support@upra.ai. We answer within one month (extendable in complex cases) and may ask you to verify your identity.
If you are a contact of one of our customers, please contact that customer, who is the controller of your data; we will support their response.
You may also lodge a complaint with your supervisory authority. In France this is the CNIL (Commission Nationale de l’Informatique et des Libertés).
15. Cookies
The website upra.ai sets no analytics or advertising cookies. The Upra application uses only strictly necessary cookies for authentication, security and your preferences. See the Cookie Policy.
16. Children
Upra is a business service and is not directed at anyone under 16. We do not knowingly collect personal data from children; if you believe we have, contact support@upra.ai and we will delete it.
17. Changes to this policy
We may update this policy as the Service and the law evolve. The date at the top shows the latest version. For material changes we notify account holders by email or in the application before they take effect.
18. Contact
UPRASET
293/295 boulevard Saint-Denis
92400 Courbevoie
France
Privacy: support@upra.ai
General: support@upra.ai