Privacy policy

Who we are

Up’n’Top (“we”) is a service that checks websites and shows what needs fixing. The controller of your personal data is Denis Malov s.p., Mlinska ulica 22, 2000 Maribor, Slovenia (tax number 14795914, registration number 7306024000).

Contact for any privacy question or request: support@upntop.com.

What we collect

Account data: email, name, organization, role. Site data: addresses you add and the public pages we fetch from them. If you connect Google Search Console: your Google account email and statistics of the sites you choose (clicks, impressions, CTR, positions, queries, pages). If you connect Google Analytics: aggregated reports of the GA4 properties you link to your sites (visitors, sessions and page views by page, channel, source and campaign, device, browser, country, city and language, age and gender brackets, on-site search terms, and for shops — revenue and purchases by product). We never receive data about individual visitors.

Where your data is stored

Your data is hosted within the European Union (Germany). The servers and databases of Up’n’Top run at IONOS in Germany. Backups are encrypted on our server before they leave it and are stored with Backblaze B2 (EU (Amsterdam, Netherlands)); Backblaze cannot read them.

Some of our service providers are based outside the EU. Transfers to them are covered by the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. The full list is on the Subprocessors page: https://upntop.com/subprocessors.

Free website check

When you check a site at upntop.com/check without an account, we keep the result for 30 days so that you can open and share its link; after that it is deleted. Your IP address is stored only as a hash and only for 48 hours, to limit abuse, and is then removed from the record.

Use of Google user data

Up’n’Top is a website monitoring service. You can connect your Google account to see how your sites perform in Google Search and how much traffic they get, next to the problems we find on them. We ask Google for exactly four permissions (OAuth scopes), and nothing else: openid and https://www.googleapis.com/auth/userinfo.email (to know which Google account is connected — its email address and account id), https://www.googleapis.com/auth/webmasters.readonly (read-only access to Google Search Console) and https://www.googleapis.com/auth/analytics.readonly (read-only access to Google Analytics 4). Search Console and Analytics are connected separately, and each permission is requested only when you connect that source. We never write to, change or delete anything in your Google account.

Search Console data (the list of your properties; clicks, impressions, CTR, positions, queries and pages; URL inspection results for pages of your sites) is used only to show search statistics of the sites you link, in the Search section and in the reports you share. Google Analytics data (the list of your GA4 properties and aggregated reports of the properties you link to a site) is read once a day and is used only to show that site’s traffic, to rank detected issues by the visitors they affect, and to warn when a page loses traffic after a change or a property stops receiving data. This data is shown to you and to the members of your organization and — if you turn it on — in the reports you share. We do not use it for any other purpose.

Up’n’Top’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The policy is available at https://developers.google.com/terms/api-services-user-data-policy.

In line with the Limited Use requirements: we use Google user data only to provide and improve the user-facing features described above, which are visible in the Up’n’Top interface. We do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you. We do not use or transfer it for serving advertisements, including retargeting, personalized or interest-based advertising, and we do not sell it. We do not allow humans to read it unless we have your affirmative agreement for specific data (for example, when you ask support to look into a problem), it is necessary for security purposes (for example, investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymized and used for internal operations of the service in accordance with applicable privacy laws.

How long we keep it: Search Console statistics are kept for up to 25 months in totals by day, 16 months in monthly top lists and 93 days in daily top lists of queries and pages; older rows are deleted automatically every day. Google Analytics daily totals are kept for up to 400 days; the latest per-page figures are replaced on every sync. When you disconnect Google on the Integrations page, we revoke the token at Google and immediately delete the connection and all data received through it. If access is revoked at Google or the person who connected it leaves the organization, the stored statistics are deleted after 30 days unless the connection is restored. When an organization is deleted, all its Google data is deleted with it.

Keys and data of your services

Some data can be read only with a key you create in your own service, for example a WooCommerce REST API key. If you add such a key, we store it encrypted (AES-256-GCM) with a key kept outside the database, bound to your organization and site; it is never shown again, never sent back to your browser and never written to logs. We accept only keys with read-only permission: when you save a key we check that it cannot change your store, and we refuse a key that can. We only send read requests to your store, through our protected fetcher, over HTTPS, a few times a day.

From a connected store we keep only totals: the number of orders and the revenue by day and currency for the last 400 days, and revenue by product for the last 28 days. We do not receive or store customer names, emails, addresses or the items of individual orders. We use these totals to show orders and revenue to your organization, to warn when orders fall below the usual level, and to show which broken pages and products put revenue at risk. We do not share them with anyone else and do not use them to train artificial intelligence models.

You can remove the key at any time on the Shop tab of the site or in Integrations, Service keys: the key is deleted at once and its collected totals are deleted with it. “Delete shop data” removes the totals and keeps the key. When a site or an organization is deleted, its keys and totals are deleted with it. You can also revoke the key in your store (WooCommerce, Settings, Advanced, REST API). If your store rejects the key twice in a row, we stop using it and tell you.

Artificial intelligence

We do not use data received from Google APIs to develop, improve or train artificial intelligence or machine learning models — ours or anyone else’s — and we do not send it to AI services for processing.

Google data is not available through the Up’n’Top API or MCP server: they return only data that Up’n’Top collects itself (site checks, issues, uptime and changes).

How we protect your data

We treat Google user data, tokens of connected services and account credentials as sensitive data and protect them with the following measures.

Encryption in transit: all traffic between your browser, our servers and Google APIs uses TLS (HTTPS); we do not accept unencrypted connections.

Encryption at rest: Google refresh tokens and keys of connected services are stored encrypted with AES-256-GCM; the encryption key is kept outside the database, so a copy of the database alone does not reveal them. Google access tokens are short-lived and kept in memory only, never written to disk. Backups are encrypted on our server before they leave it.

Tokens never leave our servers: they are not sent to your browser, not shown in the interface or API and not written to logs.

Least privilege: we request only read-only Google permissions. Each organization’s data is isolated, and every request is checked against the organization and role of the signed-in user, so members of one organization cannot see another’s data.

Account security: passwords are stored only as salted argon2id hashes; sessions use HttpOnly cookies; two-factor authentication (TOTP) is available to every user.

Staff access: access to production systems and databases is limited to the people who run the service; sensitive administrative actions require a two-factor code and are recorded in an audit log. Staff read Google user data only in the cases listed in the “Use of Google user data” section.

Hosting and incidents: servers run in the European Union (IONOS, Germany). If a security incident affects your data, we notify you and the competent authority without undue delay, and in any case within 72 hours of becoming aware of it.

Why we process it

We process account and site data to provide the service you signed up for (performance of a contract, GDPR Art. 6(1)(b)); data from connected Google accounts — on the same basis and only after you connect them; security logs — for our legitimate interest in protecting the service (Art. 6(1)(f)); billing records — to meet legal obligations (Art. 6(1)(c)).

Service providers

We use a small number of processors under data processing terms: IONOS (server hosting, Germany), Cloudflare (DNS and network protection), Backblaze B2 (encrypted backups), and, once paid plans start, Stripe (payments). Emails are sent from our own mail server, not through a third-party email provider. Google receives requests only for the accounts you connect. The current list, with what each provider can see, is at https://upntop.com/subprocessors. If you are an agency and process your clients’ data in Up’n’Top, our Data processing agreement applies: https://upntop.com/dpa.

Cookies

We set only the cookies needed to keep you signed in (session and refresh tokens, HttpOnly). We do not use advertising or analytics cookies and do not load third-party trackers.

How long we keep it

Account, organization and site data are kept while your account exists. When a site, an organization or an account is deleted (by you or at your request to support), the related data is deleted from the live database within 30 days, usually at once. Encrypted backup copies disappear as the backups rotate, within 90 days. Invoices and payment records are kept for as long as tax and accounting law requires.

Your rights

Under the GDPR you may request access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and object to processing based on legitimate interest. Write to support@upntop.com. You may also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si) or the data protection authority of your country.

Who sees it

Search and analytics data of an organization’s sites is visible to all members of that organization. The person who connected the account and the owners and admins see which Google account is connected.

Disconnecting and deletion

Owners and admins can disconnect Google at any time on the Integrations page: we revoke the token at Google and delete the connection and its data. You can also revoke access at myaccount.google.com/permissions. To delete your account or organization data, write to support@upntop.com. Details are on the Data deletion page: https://upntop.com/data-deletion.

Changes

We will publish changes on this page and update the date above.