Privacy Policy

This policy explains what data UpBidAI collects, how it is used, and your rights. We collect only what is necessary to deliver the service.

UpBidAI is a service operated by Zia-ur-Rehman, an individual based in Islamabad, Pakistan, Postal code: 44000. Contact: support@upbidai.com. Zia-ur-Rehman is the data controller responsible for personal data collected through UpBidAI.

We collect the following categories of personal data when you use UpBidAI:

• Email address — login, verification, transactional communications
• Full name — display within the platform
• Password — stored as a bcrypt hash; never stored in plaintext
• Account type — Individual or Agency

• Professional title and services list (Individual users)
• Agency name, website, and services (Agency users)
• Portfolio items: title, description, tags, URLs, NDA flag, priority order
• Upwork profile URLs and display names

When using the extension on Upwork, the following is extracted and sent to our servers. It only reads pages you are already logged in to and authorized to view, in your own browser, on your own account:

• Job data: Title, description, skills, budget, URL, UID, from job listings you view
• Profile data: Name, title, overview, hourly rate, skills, work history, education, verified badge, Upwork UID — from your own Upwork profile only
• Submission data: Proposal text submitted on apply pages (for your proposal history)

• Proposals generated, submitted, and recorded outcomes
• Token usage per AI operation
• Job match records and Win Chance scores
• Prompt presets, user ratings, and notes

All payment processing is handled by Paddle.com Market Ltd ("Paddle"), our authorized reseller. Paddle acts as the merchant of record for all purchases — Paddle, not Zia-ur-Rehman, is the seller on your payment statement and is responsible for collecting and remitting applicable sales tax/VAT. UpBidAI does not receive or store your full credit card or payment details — these are handled securely by Paddle.

Paddle collects and processes payment data on our behalf as a data processor. Please refer to Paddle's Privacy Policy for details on how payment data is handled. By completing a purchase, you also agree to Paddle's Buyer Terms.

• To provide the service: Portfolio content is vectorized to power AI proposal generation. Job data is processed for Win Chance scores.
• To personalize AI generation: Portfolio, profile title, and services are injected into proposal prompts.
• To send transactional emails: Verification, password reset, invitations, subscription updates.
• To improve the platform: Aggregated, anonymized usage patterns reviewed for AI and feature improvements.
• To enforce limits: Token quotas and plan limits enforced using usage data.

• OpenAI, Google (Gemini), and Anthropic: Portfolio and job data sent to whichever provider is assigned to a given AI task for embedding and generation.
• Amazon Web Services (AWS): Hosting infrastructure for the platform, including self-hosted Weaviate (vector database) and Redis (job queues) instances running on our own servers.
• Paddle: Merchant of record and payment processor. Handles checkout, billing, tax collection/remittance, and payment data as our authorized reseller and data processor.
• SMTP / Email Provider: Transactional email delivery. Only name and email passed.

We do not sell your data. We do not use your data for advertising.

• Contract performance: Account, portfolio, and billing data processed to provide the service you signed up for.
• Legitimate interest: Aggregated usage data processed to improve the platform and AI features.
• Consent: Where required (e.g. certain cookies or marketing communications), processing relies on your consent, which you may withdraw at any time.
• Legal obligation: Billing records retained to meet tax and accounting requirements.

UpBidAI is operated from Pakistan. Your data is processed by service providers located in the United States and other countries outside Pakistan, including OpenAI, Google, Anthropic, AWS, and Paddle. Where required, transfers rely on the receiving provider's standard contractual safeguards (such as Standard Contractual Clauses or equivalent mechanisms). By using UpBidAI, you acknowledge that your data may be processed outside your country of residence.

• Active accounts: data retained while account is active
• Deleted accounts: 30-day recovery window, then permanent deletion
• Vector embeddings: deleted when portfolio item is removed or account closed
• LLM usage logs: sanitized records (no proposal content) retained up to 12 months

You have the right to access, correct, delete, restrict, or export your data, and to object to certain processing. Where processing is based on consent, you have the right to withdraw it at any time. Email support@upbidai.com. We respond within 30 days.

Right to lodge a complaint: If you are located in the EU, UK, or another jurisdiction with a data protection supervisory authority, you have the right to lodge a complaint with your local supervisory authority if you believe our processing of your data violates applicable law.

California Residents (CCPA): If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of any sale of your data. We do not sell personal information. To submit a request, email support@upbidai.com with the subject line "CCPA Request."

• Passwords hashed with bcrypt — never stored in plaintext
• All data in transit encrypted via HTTPS/TLS
• Extension API tokens in Chrome's encrypted local storage, not cookies
• Session tokens short-lived and revoked on logout
• Production access restricted to Zia-ur-Rehman and any authorized contractors bound by confidentiality obligations

UpBidAI is not directed at users under 18. We do not knowingly collect data from minors. Contact us if you believe a minor has registered and we will delete it promptly.

We may update this policy and will notify you of significant changes via email or platform notice. The effective date reflects the most recent version.

UpBidAI uses strictly necessary cookies to maintain your login session and keep the platform functional. We do not use advertising cookies or third-party tracking cookies.

Our Chrome Extension does not set or read browser cookies — it uses Chrome's encrypted local storage for authentication tokens only.

You may clear cookies at any time via your browser settings. Clearing session cookies will log you out of the platform.