Last updated 28 September 2026
Who we are
Upcase is provided by [Company name] Ltd (company number [company number], registered office [registered office address]). We're the controller for the personal data described here. Contact us about privacy by opening a ticket or at support@upcase.example.
What this policy doesn't cover: your store's data
The Upcase plugin runs on your own server. When it opens a case, it sends the details you type and the order fields you've chosen straight from your server to ClickUp. That data never passes through us, and we can't see it. For it, you're the controller and ClickUp is your processor, so mention ClickUp in your own shop's privacy policy.
What we collect, and why
Your account and billing
Your name, email address, company, billing address, VAT number if you give one, what you've bought and your invoices. We use them to provide your plan and to keep tax records. Payments are handled by [payment provider]; we never see or store full card numbers. Lawful basis: contract, and legal obligation for tax records.
Licence and update checks
When your site checks its licence or looks for updates, it sends your licence key, your site's address, the plugin and PHP versions and your WordPress language, and our server sees the request's IP address. We use these to confirm your licence and offer the right updates. Lawful basis: contract.
Connecting ClickUp
If you use "Connect ClickUp", ClickUp sends the access token for your workspace to our server, because ClickUp only allows sign-ins to return to one address. We hold it encrypted for at most ten minutes, hand it once to the site that asked for it, and then delete it. We don't use it for anything else. Lawful basis: contract.
Support
Whatever you send us in tickets and emails, including attachments such as logs or screenshots. Please remove customer details from anything you send us. Lawful basis: contract, and our legitimate interest in helping you.
This website
Our server keeps standard logs (IP address, browser and pages requested) for security, for up to [30 days]. We use no analytics or advertising cookies, and our fonts are served from our own server. The client area uses essential cookies to keep you signed in. Lawful basis: legitimate interests in running a secure site.
Who we share it with
Only the companies that help us run Upcase, under contracts that protect your data: our hosting provider [hosting provider], our payment provider [payment provider] and our email provider [email provider]. We never sell personal data. If any of them process data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement.
How long we keep it
- Account and billing records: six years after your last purchase, as HMRC requires.
- Licence and update check records: [12 months].
- Support conversations: [2 years] after they're closed.
- ClickUp access tokens: ten minutes at most.
Your rights
You can ask us for a copy of your data, to correct or delete it, to limit or object to how we use it, or to move it elsewhere. Open a ticket or email us and we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Keeping it safe
Licence data is signed so it can't be tampered with, connections are encrypted, and access to our systems is limited to the people who need it.
Changes
If we change this policy in a way that matters, we'll email you first. The date at the top shows when it last changed.