Privacy policy
Last updated 11 September 2026.
Who we are
Upstream is operated by Upstream (“we”, “us”). We are the data controller for the personal data described here. You can reach us at support@example.com.
What we collect and why
Your account
When you sign up we receive your email address, your name if you provide one, and a profile image if you sign in with a third-party provider. Authentication is handled by Clerk, who store your credentials and session information on our behalf. We use this data to run your account, to contact you about it, and to prevent abuse. Lawful basis: performing our contract with you.
The content you create
Your master CVs, variants, keyword rules, applications, recruiter and company records, and send log entries are stored in our database so the service can work. They will usually contain personal data about you and may contain names and contact details of recruiters and hiring managers you deal with; you are responsible for having a lawful basis to record those. We never use your content for advertising, never share it with recruiters or employers, and do not train models on it. Lawful basis: performing our contract with you.
Payments
Card payments are taken by Stripe. We never see or store your card number. We keep the Stripe customer and subscription identifiers, your plan and its renewal date so we know what you are entitled to. Lawful basis: performing our contract with you and meeting our legal obligations for accounting.
Technical data
Our hosting provider records standard request logs (IP address, browser, pages requested) for a short period to keep the service secure and to diagnose faults. Lawful basis: our legitimate interest in running a reliable, secure service.
Cookies
We use only the cookies needed to keep you signed in. There is no advertising or cross-site tracking on this site.
Who processes data for us
- Clerk (authentication and user accounts)
- Stripe (payments and subscriptions)
- Vercel (hosting, request logs, PDF rendering)
- Neon (database hosting)
Some of these providers process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement or an adequacy decision.
How long we keep it
Your content stays until you delete it, or until you delete your account, at which point it is removed immediately from the live database. Database backups held by our hosting provider expire within 30 days. Accounting records relating to payments are kept for six years as the law requires.
Your rights
You can export everything you have entered as a single file from the Data page at any time, and delete your account and all of its data from the plan and billing page. You also have the right to ask us to correct or erase your data, to restrict or object to processing, and to complain to the Information Commissioner’s Office. Email us and we will respond within one month.
Changes
If we change this policy in a way that matters, we will email account holders before the change takes effect.