Privacy Notice

We collect only the data needed to respond to your enquiry, prepare a conversation with Oleh, protect access to your information and provide communications you select separately.

The Aisha chat is intended for adults and professional or business enquiries. Do not submit special-category personal data, private data about other people, or information that is not needed for your request.

• your name or preferred form of address;
• your professional role, company, project or field;
• your request, current situation, relevant previous experience or attempts, and desired result;
• your email address for verification, contact and data controls;
• the brief you confirm and the agreed next step;
• separate choices about news, professional public sources and other optional features;
• security events, action timestamps, a session identifier and protected hashes needed to prevent abuse.

Each purpose has its own basis. Refusing news does not prevent you from asking a question, verifying your email or preparing a meeting.

Aisha helps explain UpMan’s areas of expertise, organise the facts you provide and prepare a brief for a conversation. She does not make decisions producing legal or similarly significant effects for you.

The external AI model receives only a minimised context for the current request. Email, telephone, Telegram, verification codes, Calendar identifiers, permission evidence and Oleh-only notes are not sent to the AI provider.

Direction, boundaries and responsibility for the final synthesis remain with a human. Deterministic email verification and data-control forms do not depend on AI availability.

We use providers only for defined technical functions and share the minimum data needed.

• Supabase — authentication, protected storage and access control;
• Resend — verification codes and other transactional email;
• Vercel — web application hosting and delivery;
• Google Gemini API — bounded processing of permitted free text in the paid server-side AI runtime without contact data;
• Google Workspace — messages sent to privacy@upman.group and, once separately launched, requested meeting administration;
• Telegram Bot API — only if you start the separate bot and consent to that channel;
• professional advisers or public authorities — only where justified, necessary to protect legal claims or required by law.

Core UpMan data is stored in a European Supabase region. Some providers or their subprocessors may process data outside the European Economic Area.

Where no European Commission adequacy decision applies, a transfer must rely on contractual safeguards, including the EU Standard Contractual Clauses, and supplementary measures where needed.

For the paid Gemini API, Google does not use prompts or responses to improve its products. The provider may log them for a limited period for safety, prohibited-use detection and required legal disclosures. UpMan disables application dialogue logging, does not use search grounding, minimises context and does not send contact data to the AI provider.

We do not describe retention as indefinite. Data remains identifiable only while a defined purpose or legal reason continues.

• an unverified draft brief remains in the current browser for no longer than two hours and does not become a durable record;
• a verified enquiry and brief are kept while communication or possible cooperation remains active;
• after 24 months without meaningful interaction, necessity is reviewed and the data is retained with a recorded reason, restricted, anonymised or deleted;
• active-client data may be kept during the relationship and afterwards where required for a contract, legal obligation or legal claims;
• marketing consent remains active until withdrawal, but its continued relevance is also reviewed after prolonged inactivity;
• minimum evidence of permissions, withdrawals and data requests is kept as long as needed to perform and demonstrate legal obligations;
• protected security events are kept only as long as needed to prevent abuse and investigate incidents.

You may request access, correction, download, deletion or restriction of your data, object to applicable processing or withdraw an optional consent. Withdrawal does not affect processing lawfully performed before it.

Contact privacy@upman.group. Once the protected mode is launched, you will also be able to choose “Manage my data” in the Aisha chat. A six-digit code verifies control of the email address but is not universal proof of identity. We may ask for the minimum additional information needed for a risky or disputed request.

We respond without undue delay and normally within one month. If you believe your rights have been infringed, you may complain to the Agencia Española de Protección de Datos at aepd.es.

News and special offers, review of professional public sources you provide, and future Telegram messages are separate features. None is enabled automatically or required for an enquiry or meeting.

You may change each permission separately through Aisha’s protected mode or by emailing privacy@upman.group. Refusing does not prevent you from contacting UpMan again.

The service may use strictly necessary cookies for a protected session and browser local storage for short-lived draft state. They are not used for advertising tracking.

If optional analytics, advertising pixels or other tracking technologies are added later, they will not be enabled without a separate decision, appropriate information and consent where required.

We will update this notice before launching a new purpose, a new data recipient or a material change in processing. The current version will always be shown here. If a change requires new permission, we will ask separately.