Privacy Policy

Upreciated helps teams thank each other and celebrate birthdays and work anniversaries. This policy explains what personal data we handle, why, and what you can do about it.

Who we are

Upreciated is run by , (“we”). You can reach us about anything in this policy at support@upreciated.com.

Our two roles

For your organization’s data, the people its admins add and what everyone posts, we act on behalf of your organization. Your organization is the controller and decides what goes in; we are its processor and follow its instructions, as set out in our Terms of Service.

For your account, our website and the emails we send, we are the controller.

What we handle

• Your account: your name, email address and profile photo, from the way you sign in.
• What your organization adds: names, work email addresses, birthdays (the day and month only, never the year), start dates, departments or groups, employee IDs and photos. Admins add these by hand, from a CSV file, or from an HR system they connect, such as BambooHR.
• What you create: boards, the messages on them, and the company values you tag them with.
• How you use the app: which boards you opened and when, which notifications you’ve seen, and your email settings.
• Emails: the addresses we send to, and whether the emails were delivered.
• Integrations: the Slack workspace and channel, or the Teams team and channel or workflow, your organization’s admins connect, the access Slack gives us to post there, and whether the posts went through. If you turn on Slack or Teams messages, your user ID there.
• Technical data: IP addresses, browser details and logs that our hosting and backend providers keep to run the service and keep it secure, and reports of errors in the app, with your browser details but not your name or email address.
• Billing: the organization’s billing contact, company details and invoices. Card details go straight to Stripe; we never see them.
• Visits to our website: on the public pages (the home page, pricing, the blog, the free tools and these legal pages), we count visits with Umami: the page, the site you came from, and your browser, type of device and country. It uses no cookies and doesn’t identify you. The app’s own pages, where you’re signed in, aren’t counted.

Why, and on what legal basis

• To provide Upreciated: boards, celebrations, notifications, analytics and integrations. For your account this is necessary for our contract (GDPR Article 6(1)(b)); for your organization’s data we follow its instructions (Article 28).
• To send the emails that are part of the service: invites, celebration reminders, and emails when someone recognizes you. You can turn the recognition emails off in your settings.
• To keep the service secure, fix problems and improve it, in our legitimate interest (Article 6(1)(f)).
• To know which of our public pages people visit and how they found them, in our legitimate interest (Article 6(1)(f)).
• To keep accounting and tax records, as the law requires (Article 6(1)(c)).

We don’t sell personal data, use it for advertising, or use your messages to train AI models.

Who helps us

These services process data for us, under contracts that require them to protect it:

Your organization’s admins can also connect services of its own. We exchange data with them on your organization’s behalf; they are your organization’s providers, not ours, and their own terms and privacy policies apply to what they keep:

• BambooHR: We receive employee details from it: names, work email addresses, birthdays, start dates, departments, employee IDs and photos.
• Slack: We post to the channel its admins pick when someone is recognized or a board opens: who was recognized and by whom, the company value, the start of the message and a link to the board. Members who turn it on are also messaged there when they’re recognized, with what the recognition email says; we find them in the workspace by their email address and keep their Slack user ID. Members can also thank someone from Slack, with a command or from a message: we receive who sent it, who it’s for, the message and the company value, find both of them in the organization by the email address Slack has for them, and post the message on the recipient’s board. Either of them we have no name for yet takes the name Slack shows for them. Members can also upvote a message from our post in the channel: we receive who clicked, find them in the organization by the email address Slack has for them, and show the new number of upvotes in the post.
• Microsoft Teams: With the Upreciated app, which its admins add to a team, we post the same to the channel they pick, and keep the IDs of the team and its Microsoft 365 organization. Members can thank someone from Teams, with the app’s form or by mentioning it: we receive who sent it, who it’s for, the message and the company value, look both of them up in Teams for their email address and the name Teams shows, find them in the organization by that email address, and post the message on the recipient’s board. Either of them we have no name for yet takes the name Teams shows. Members can also upvote a message from our post in the channel: we look up who clicked the same way, and show the new number of upvotes in the post. Members who turn it on are messaged there when they’re recognized, with what the recognition email says; we find them in the team by their email address and keep their Teams user ID. Without the app, the same posts can go to the channel of a workflow its admins made in Teams.

Nothing about a surprise board is posted before it’s revealed, admins choose what gets posted, and each member chooses whether they’re messaged in Slack or Teams.

Some of these services are in the United States. Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework for providers certified under it, or on the European Commission’s Standard Contractual Clauses.

How long we keep it

• For as long as your account and your organization exist.
• When you delete your account, your data is deleted straight away, including your boards and the messages on them. Messages you wrote for colleagues stay on their boards, without your name.
• When an admin deletes an organization, it and everything in it are deleted 30 days later. Until then, any admin can keep it.
• When someone leaves your organization, its admins decide whether to keep their board or remove them for good.
• Backups are kept for a limited time and then overwritten.
• Billing records are kept as long as tax and accounting law requires.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to get a copy in a portable format. You can delete your account yourself in your settings, and admins can export their organization’s data.

For data your organization added, please ask its admins first: they control it, and we help them answer you. For anything else, write to support@upreciated.com. You can also complain to a data protection authority, such as Cyprus’s Commissioner for Personal Data Protection or the one where you live.

Cookies

We only use cookies the app needs to work: to keep you signed in and to remember which organization you’re in. The app also keeps small preferences in your browser, such as whether the sidebar is folded. We don’t use advertising or tracking cookies, so there’s nothing to agree to. Visits to the public pages are counted without cookies.

Children

Upreciated is for workplaces and isn’t meant for anyone under 16.

Changes

When this policy changes, we update this page and its date. For significant changes, we also tell your organization’s admins by email in advance.