Privacy Policy

1. Scope and Definitions

This Privacy Policy describes the manner in which Upkept ("we," "us," or "our") collects, processes, discloses, and retains information in connection with the provision of its website-care subscription service (the "Service"). Capitalised terms not defined herein bear the meanings given in our Terms and Conditions, which this Policy forms part of and is incorporated into. This Policy applies to the Service, to the complimentary Website Health Check, and to our website. Enquiries may be directed to upkept11@gmail.com.

2. Categories of Information Collected

We collect the following categories of information, in each case limited to what is necessary to provide the Service:

1. (a)Identifying and contact information furnished at subscription, comprising name, business name, electronic mail address, mobile telephone number (optional), industry, the address of the Connected Website, and the platform upon which it was constructed.
2. (b)Service records, comprising the Change requests submitted, any report of a fault in the Service submitted from within the account, any photographs or files attached to either, and versioned copies of the Connected Website retained so that a Change may be reverted.
3. (c)Operational records, comprising authentication events, timestamps, and a record of Changes implemented, retained so that an accurate history exists of what was requested and when.
4. (d)Where a personal promotional offer or a grant of Complimentary Access has been extended to a prospective Client by private link, the first name, business name, and trade of that person, together with the accompanying message, recorded so that the offer page may be presented to them and so that a record exists of what was extended to whom and whether it was claimed. No electronic mail address, telephone number, or payment information is held in respect of a person who has not subscribed. Where Complimentary Access is taken up, whether by private link or by access code, no payment method is requested or collected at any point and none is held; an access code itself identifies nobody and is not recorded against the account that used it.
5. (e)Billing information, processed by our payment processor. WE DO NOT RECEIVE, PROCESS, OR STORE FULL PAYMENT CARD NUMBERS AT ANY TIME.

3. Access to and Processing of the Connected Website

So that the nature of our processing is fully disclosed:

1. (a)we retrieve a Connected Website in the manner of an ordinary member of the public, accessing only such pages and resources as are publicly served to any visitor;
2. (b)where the Plan so provides, we retrieve, copy, store, version, and modify the Connected Website and the Client Content, solely for the purpose of performing the Service. We do not host the Connected Website: it is served throughout by the Client's own provider, and what we hold is a working copy;
3. (c)we conduct availability checks and automated assessments for indicia of common security defects; and
4. (d)we do not seek to access any resource that is not publicly served, nor to circumvent any authentication or protective measure, save to the extent the Client has expressly furnished administrative access in order that we may work upon the website.

3A. Access to the Client's Upkept Account by Our Personnel

Distinct from our processing of the Connected Website described in Section 3, our own personnel are able to administer the account an account holder maintains with us. So that this is not left to inference:

1. (a)We are able to view an account as its holder sees it, in order to provide support, investigate a fault, or answer a question about what the account displays. Such viewing discloses to us what the account holder can themselves see — the websites connected, the Change requests made, and the assessments held — and no more. It is read-only: no Change may be requested, no purchase made, no version restored, and no website altered while an account is being viewed, and our systems are built to refuse those actions rather than merely our practice being not to take them.
2. (b)We are able to cause a password-reset message to be sent to the address recorded upon an account. WE DO NOT KNOW, CANNOT READ, AND CANNOT SET AN ACCOUNT HOLDER'S PASSWORD. A password is stored only in a form from which the original cannot be recovered, and is changed only by the account holder following the link so sent.
3. (c)We are able to end all active sessions upon an account, whereupon every device signed in to it is signed out. This alters no information held upon the account and does not affect the password.
4. (d)We are able to correct the electronic mail address recorded upon an account. Because that address is the credential by which its holder signs in, any such correction is notified to both the former and the new address and ends all active sessions.
5. (e)These facilities are available only to our own personnel. They are not exercisable by any other account holder, and no account holder is able to view, alter, or obtain information about another.
6. (f)Access of this kind is not presently recorded in an audit log. Where an account holder wishes to know whether their account has been viewed, they may ask us and we will tell them.

4. Visitor Data; Allocation of Controller Responsibility

This Section is material and the Client's attention is specifically drawn to it. Where a Connected Website collects information from the Client's own customers or visitors — whether by contact form, booking form, mailing-list subscription, telephone or electronic mail link, or analytics installed upon it — the following applies:

1. (a)such information is collected by the Client, for the Client's own purposes, and the relationship in respect of it subsists between the Client and its visitors and not between Upkept and those visitors;
2. (b)the Client is the controller of such information and determines the purposes and means of its processing; Upkept neither determines those purposes nor processes such information for any purpose of its own;
3. (c)the Client is solely responsible for the lawfulness of that collection, for informing its visitors of it, and for maintaining its own privacy notice where one is required by applicable law;
4. (d)Upkept may unavoidably observe such information incidentally in the course of performing the Service, but does not use, analyse, monetise, or retain it for its own purposes, and does not contact the Client's visitors; and
5. (e)the Client's obligations under Section 10 (Indemnification) of the Terms and Conditions extend to any claim arising from the Client's own collection or handling of visitor information.

5. The Website Health Check

The complimentary Website Health Check may be used without an account. Upon submission of a web address we retrieve the publicly served homepage of that address, together with a small sample of pages linked from it, analyse them, present the result, and discard them. We do not store the pages, their contents, or the resulting assessment. The submitted address is held transiently in volatile memory for a period of minutes, for the sole purpose of rate-limiting and preventing the tool being used to burden third-party websites, and is discarded thereafter. We do not require, request, or collect any name, electronic mail address, or other identifying information in order to perform a Health Check.

6. Purposes of Processing

We process information solely for the following purposes: to implement and publish the Changes requested; to monitor the Connected Website and run the safety checks your Plan includes, together with any optional extra you purchase; to send you a link, at your own request or where you are otherwise unable to obtain access, by which you may set a new password; to administer your account as described in Section 3A, including providing support upon it; to transmit service notifications, including availability alerts and individual replies to matters you raise; to invoice and collect subscription fees; to maintain an accurate record of work performed; to provide support; and to comply with legal, tax, and accounting obligations. WE DO NOT SELL PERSONAL INFORMATION, WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING, AND WE DO NOT PROCESS IT FOR ADVERTISING PURPOSES OF ANY KIND.

7. Your Mobile Number

We no longer send text messages of any kind. Text alerts were offered upon our two highest plans between 31 July 2026 and 5 August 2026, and were withdrawn on 5 August 2026 when we closed the account with the provider that carried them. If you give us a mobile telephone number it is used only so that we can reach you about your own account should we need to, and it is not used to send you messages, marketing, or alerts — those go to your electronic mail address instead. We have never sold, rented, or shared your mobile telephone number with third parties or affiliates for their marketing purposes, and we do not do so now. Where you gave consent to text messages at signup, that consent is no longer acted upon; the record that you gave it is retained only as proof of the basis upon which any message was sent to you at the time, and you may ask us to erase your number under Section 15.

8. Electronic Mail

We use the electronic mail address recorded upon the account to transmit service notifications, including availability alerts, warnings generated automatically as a domain registration or security certificate approaches expiry, notice of a fault found upon the Connected Website by a scheduled assessment, and updates upon Change requests, together with billing notices. Separately, account holders below the top Plan receive at most one promotional message per calendar month suggesting the next Plan up, each of which carries a one-click means of opting out; opting out of those has no effect upon service notifications, which continue regardless. Where a password reset is requested, the address submitted is held transiently in volatile memory for a period of minutes, for the sole purpose of limiting the rate at which such messages may be requested and thereby preventing the facility being used to burden a third party's inbox, and is discarded thereafter; it is not written to our database by reason of that request and no record is kept of whether it corresponded to an account.

9. Disclosure to Sub-Processors and Third Parties

We disclose information only as follows:

1. (a)to the sub-processors that enable the Service to operate, namely our hosting and deployment provider, our database provider, our file-storage provider, our payment processor, the provider that delivers our electronic mail, and the provider of the automated systems that implement Changes and produce assessments — which processes the content of the Connected Website and of Change requests in order to carry them out — in each case acting upon our instructions and permitted to use the information solely to provide their service to us;
2. (b)where disclosure is required by applicable law, legal process, or governmental request;
3. (c)where disclosure is reasonably necessary to establish, exercise, or defend legal claims, to enforce our Terms and Conditions, or to protect the rights, property, or safety of Upkept, our clients, or the public; and
4. (d)to an acquirer or successor in connection with a merger, reorganisation, or sale of all or substantially all of our assets or business, subject to that party being bound by terms no less protective than this Policy.

10. Location of Processing

Upkept and its sub-processors store and process information upon servers situated in the United States of America. Where information is furnished from outside the United States, the furnishing party acknowledges and consents to its transfer to, and processing within, the United States.

11. Cookies

We employ a limited number of strictly necessary cookies in order to maintain authenticated sessions and to preserve the security of the Service. We do not employ advertising cookies, cross-site tracking cookies, or third-party analytics cookies upon our own website.

12. Retention

1. (a)Account information is retained for the duration of the subscription and for such further period as is reasonably necessary for legal, tax, and accounting purposes.
2. (b)Versioned copies of a Connected Website are available to the Client during the subscription and for thirty (30) days following its termination, after which they may be deleted.
3. (c)Residual copies may persist within routine backup media for a reasonable period following deletion, and are thereafter overwritten in the ordinary course.
4. (d)A request for deletion may be made at any time in accordance with Section 15.

13. Security

WE EMPLOY MEASURES APPROPRIATE TO THE NATURE OF THE SERVICE, INCLUDING ENCRYPTED TRANSPORT, HASHED CREDENTIAL STORAGE, AND ACCESS LIMITED TO WHAT IS NECESSARY TO OPERATE THE SERVICE. HOWEVER, NO METHOD OF TRANSMISSION OR STORAGE IS PERFECTLY SECURE, AND WE DO NOT AND CANNOT WARRANT OR GUARANTEE THAT UNAUTHORISED ACCESS, DISCLOSURE, ALTERATION, OR DESTRUCTION WILL NEVER OCCUR. THE CLIENT'S ATTENTION IS DRAWN TO SECTIONS 18 AND 20 OF THE TERMS AND CONDITIONS, WHICH LIMIT OUR LIABILITY IN RESPECT OF ANY SUCH EVENT.

14. Notification of Security Incidents

Where we become aware of a security incident affecting personal information for which we are responsible, we shall notify affected parties without undue delay and in accordance with applicable law, describing the nature of the incident, the categories of information involved so far as known, and the measures taken in response.

15. Rights and Elections

Subject to applicable law and to verification of identity, any person may:

1. (a)request access to, correction of, or deletion of the personal information we hold concerning them;
2. (b)request a copy of the Client Content associated with their account;
3. (c)opt out of the monthly promotional message by means of the link contained within it;
4. (d)cancel the subscription at any time from the billing page; and
5. (e)lodge a complaint with the applicable supervisory authority where one has jurisdiction.

15A. No Detriment

We shall not deny service, charge a different price, or provide a different level or quality of service by reason of any person exercising a right or election described in Section 15. Requests may be made by writing to upkept11@gmail.com.

16. Children

The Service is directed to businesses and is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children. Where we become aware that such information has been collected, we shall delete it. Any person believing that a child has furnished us with personal information should write to us so that we may do so.

17. Amendment

We may amend this Policy from time to time. Material amendments shall be notified by electronic mail or by publication upon this page, and the date recorded at the head of this page shall be updated accordingly. Continued use of the Service following the effective date of an amendment constitutes acceptance thereof.

18. Contact

Questions concerning this Policy, or concerning the information we hold, may be directed to upkept11@gmail.com.