Privacy Policy
This policy applies to the Upstairs app, operated by Upstairs Limited.
The app is for authorised users only. It provides restricted services connected with a user's account and role.
Data We May Collect
Depending on how the app is used, we may collect or process:
- Account, contact and profile information.
- Eligibility, verification and service records, including images where supplied or required.
- User content, uploads, preferences, transactions and app activity.
- Payment status and payment reference information. We do not store full card numbers.
- Device, log, permission, notification and technical information.
How We Use Data
We use data to provide, secure, manage and support the app and related services; process requests, transactions and communications; prevent misuse; keep necessary records; and comply with legal or regulatory obligations.
Sharing
We do not sell personal data or use it for third-party advertising.
We may share data with authorised personnel, authorised users where an app feature requires it, service providers who help operate the app and related services, and other parties where required for legal, regulatory, accounting, tax, insurance, safety, fraud prevention, dispute or enforcement reasons.
App Permissions
Some features may request device permissions such as camera, photos/files, location, nearby-device access, notifications or device security. These permissions are used only where needed for app features, security, verification, communication or user-requested actions.
Retention and Deletion
We keep personal data for as long as reasonably needed. Retention depends on the type of data, why it was collected, account status, legal and accounting requirements, security and audit needs, dispute risk, fraud prevention and backup cycles.
We may retain records after app access ends where needed for lawful, operational, security, audit, dispute or business continuity reasons.
You can request app account deletion or raise a data request through the public Account and Data Requests page, or through any in-app route made available for that purpose.
A request does not automatically mean all records will be deleted from every Upstairs system. We will assess requests and respond in accordance with applicable law. Some rights are not absolute and may not apply where we have a lawful reason to continue processing or retaining data.
Security
We use safeguards intended to protect personal data, including controlled access, secure transmission where available and audit controls. No app, network or system can be guaranteed to be completely secure.
Your Rights
Depending on your location and the circumstances, you may have rights to access, correct, restrict, object to, erase or receive a copy of personal data. Requests will be handled in accordance with applicable law.
Changes
We may update this policy from time to time. The latest version will be made available on this page.