Trust
Security and your data
Effective date: 11 October 2026
Operated by UptenAI, Inc., a Delaware corporation. Contact: ops@uptenai.com.
Brands trust us with their store, their search data and their customers’ questions. This page explains, in plain language, what we hold, where it lives, who can see it and what to do if you spot a problem.
What we hold for a brand, and why
- Your account details: names and work email addresses of the people on your team, so they can sign in.
- Your store and search data: your public pages, policies and product data, and, when you connect them, read only Google Search Console and Google Analytics data. We use these to score your store and measure what our fixes do.
- Store access: when you connect Shopify, the access needed to ship the fixes you approve and, for Jenny, to look up an order when a customer asks about it.
- Customer conversations: web chat transcripts and, when you connect them, Instagram comments and messages and WhatsApp messages, so Jenny can answer and your team can follow up.
We ask only for the access each job needs, most of it read only. You can disconnect any service at any time.
Where it is hosted
Our database and file storage run on Supabase, in its Sydney, Australia region. Our website and app run on Vercel. Each provider describes its own security on the pages linked here.
Encryption
Data travels between your browser, our app and our providers over encrypted connections (HTTPS). Data is encrypted at rest, including backups, as provided by Supabase and Vercel. Access tokens for the services you connect are also encrypted by our own application before they are stored.
Who can see it
- People on your team see only your brand’s data. Row level security in our database keeps every brand’s records apart, and our app checks the brand again on every request.
- UptenAI staff access is invite only, limited to the people who work on your account, and protected by two factor sign in.
- We are adding an access log that records every time a staff member or Jenny reads order or customer data, so that every read can be accounted for.
- We do not copy customer data to personal devices, spreadsheets or third party tools.
AI processing
Jenny and our reports use AI models from Anthropic, through its commercial API. Under Anthropic’s commercial terms, content we send is not used to train its models. We do not use your data or your customers’ data to train AI models either.
How long we keep it
We keep data only as long as we need it to provide the service, and delete it when you disconnect a service or ask us to. Our retention schedule, data type by data type, will be published here. Until then, you can ask us for it at any time.
Sub processors
| Provider | What it does for us |
|---|---|
| Supabase | Database, authentication and file storage |
| Vercel | Hosting for our website and app |
| Anthropic | AI processing for Jenny and our reports |
| Resend | Sending account and report emails |
| Meta | Instagram and WhatsApp messaging, when you connect them |
| Search Console and Analytics data, when you connect them |
Report a security problem
If you think you have found a security problem, email ops@uptenai.com. We acknowledge every report within 1 business day and keep you updated until it is resolved. Please give us a fair chance to fix an issue before making it public.
Data Processing Agreement
We sign a Data Processing Agreement with every brand that asks. Email ops@uptenai.com and we will send it.
See also our Privacy Policy and Data Deletion page.