Privacy policy
The short version
- We collect what you type into our form, what you email us, and redacted files you choose to share for an audit.
- We use it to reply to you and to run the audit you asked for. Nothing else.
- We don't sell data, run ads, or use your files to train any model.
- We count visits and tool use with a cookieless analytics service. This site sets no cookies and doesn't record your session.
- Audit files are deleted 30 days after we deliver the audit.
Who we are
TrueUpp (“we”, “us”) is responsible for the personal data described in this policy and decides how it's used.
Contact for anything in this policy: hello@trueupp.com.
What we collect
| Source | What |
|---|---|
| Calculator spreadsheet form | Your work email and, optionally, your company name, when you ask for the true-up calculator spreadsheet. |
| Audit and demo form | Company name, work email, role, billing system, your optional message, whether you asked for an audit or a demo, and which plan you clicked from, if any. |
| Email and calls | Your name, email address, job title, and whatever you choose to tell us. |
| Audit files | Redacted contracts, usage exports and billing figures you choose to share. We ask you to remove customer names and personal data first. See how we handle audit files. |
| Website analytics | Pages viewed, the referring site, browser and device type, approximate location, and events such as calculator use and successful form submissions. No cookies or other identifiers are stored in your browser; see below. |
| Server logs | Our hosting provider logs IP addresses and requests to keep the site running and secure. |
We don't knowingly collect sensitive personal data, and the site isn't directed at children.
How we use it, and why we're allowed to
- To answer your request and arrange an audit or demo. This is a step you asked us to take before any agreement (and, under UK and EU law, our legitimate interest in replying to business enquiries).
- To run the audit on the files you share, with your consent, which you can withdraw at any time by asking us to delete them. We may use AI tools to help extract contract terms from those files. A person checks every result before it goes into your audit.
- To send the spreadsheet you asked for, and occasional emails about true-ups and TrueUpp. Every email lets you unsubscribe, and we stop as soon as you do. This is our legitimate interest in following up with people who ask for our resources.
- To follow up about the audit or TrueUpp, in proportion to what you asked about. If you'd rather not hear from us, reply “stop” and we won't contact you again.
- To understand how the website is used so we can improve its pages, tools, and request forms. This is our legitimate interest in running a useful website, and we limit it to cookieless measurement that can't follow you across visits or other sites.
We don't use your data for advertising, sell it, or use it to train machine-learning models.
Website analytics
We use a product analytics service to see which pages are visited, which site sent you, and whether people use the calculator, the simulator and our request forms. It runs without cookies: nothing is stored in your browser's cookies or local storage, so each page visit is counted on its own and we can't recognise you on a later visit or on other websites. We use no cross-site identifiers, and session recording is switched off.
Besides page views, we record only a few named events: calculator or simulator use, copying the simulator's clause wording, a successful spreadsheet request, and whether an audit or demo was requested. They don't include form contents or the numbers you enter. Shared calculator and simulator links carry your scenario after a “#” in the address; we strip that part before anything is recorded.
The analytics service uses your IP address to estimate an approximate location, and the data is held in the United States. If your browser sends a Do Not Track or Global Privacy Control signal, the analytics service doesn't load at all. You can also ask us to stop using your data for analytics by emailing hello@trueupp.com.
This website sets no cookies, which is why there's no cookie banner.
Who we share it with
We use a small number of carefully chosen service providers for website hosting, email, form handling, secure file storage, analytics, and AI-assisted document processing. Each one processes data only on our instructions and only for that purpose. We use AI providers only under business terms that prohibit them from using your data to train their models. We may also disclose data if the law requires it. We never sell personal data, and outside these service providers, we never share audit files with anyone.
International transfers
We and our service providers operate in more than one country, so your data may be processed outside the country where you live. Where UK or EU law applies, transfers rely on standard contractual clauses or equivalent safeguards.
How long we keep it
- Audit files: deleted 30 days after we deliver the audit, or sooner if you ask.
- Form submissions and email: up to 24 months after our last contact, unless you become a customer, in which case they're kept for the length of our agreement plus any period the law requires.
- Analytics: up to 12 months.
Your rights
Depending on where you live (including under the UK GDPR, the EU GDPR, India's Digital Personal Data Protection Act 2023, and US state privacy laws), you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it;
- stop using it for follow-up or analytics, or restrict how we use it;
- withdraw consent you've given, such as for audit files.
Email hello@trueupp.com and we'll respond within 30 days. This address is also our grievance contact. You can also complain to your data protection authority. In the UK that's the Information Commissioner's Office.
Security
Access to form submissions, email and audit files is restricted to the people who need it to respond to you. Accounts use two-factor authentication. Audit files are shared through private folders restricted to named email addresses, and are processed only on an encrypted device. No system is perfectly secure; if a breach affected your data, we would tell you and any authority we're required to notify without undue delay.
Changes
If we change this policy, we'll update the date at the top. If a change materially affects how we use data you've already given us, we'll tell you by email first.