1. Who We Are
Upcore Technologies Pvt. Ltd. ("Upcore", "we", "our", or "us") is a private limited company incorporated under the Companies Act, 2013, with its registered office at Bestech Business Tower, Sector 66, Sahibzada Ajit Singh Nagar (Mohali), Punjab 160062, India.
We operate the website at upcoretech.com and related subdomains (the "Site"), and we provide AI engineering governance, AI agent development, and related technology services.
This Privacy Policy explains what personal data we collect when you visit the Site or interact with us, how we use it, and the rights you have. It applies to:
- Visitors to our Site, including prospective clients
- People who contact us via forms, chat, email, or WhatsApp
- Business clients whose employees or data we process under a service engagement
2. Data We Collect
Information you provide directly
When you fill in a form on our Site or contact us, we may collect your name and job title, business email address, company name and industry, phone or WhatsApp number, a description of your AI challenge or use case, and team size where provided.
AI chat with Kai
Our website includes an AI assistant named Kai. When you send a message to Kai, the text of your messages is transmitted to Anthropic, PBC (our AI provider) to generate a response. We do not store your conversation history on our own servers after the session ends; message content is processed in transit by Anthropic under their data usage policies. Do not include sensitive personal data - health information, government IDs, or financial account numbers - in your chat messages.
Calendar bookings
If you book a call via the "Book a Governance Review" button, you interact with Google Calendar Appointments. Google collects your name, email, and chosen timeslot. That data is governed by Google's Privacy Policy.
Analytics and usage data
We use Google Analytics 4 and Google Tag Manager to understand how visitors use our Site. This includes pages visited, scroll depth and click events, referring website or search query, browser type and device category, and approximate geographic location. This data is collected via cookies and associated with a randomly assigned analytics ID, not with your name or email. IP addresses are anonymised by default in GA4.
Hosting and server logs
Our Site is hosted on Vercel. Vercel may collect standard server access logs including IP addresses, request paths, and timestamps as part of normal infrastructure operation.
Google Fonts
Our Site loads the DM Sans typeface from Google Fonts servers. When your browser requests the font files, your IP address is transmitted to Google. See Google's Font API Privacy FAQ for details.
3. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Respond to your enquiry or contact form submission | Name, email, company, challenge | Legitimate interests / pre-contractual steps |
| Schedule a discovery or governance review call | Name, email, phone, timeslot | Consent (booking action) |
| Operate the Kai AI chat assistant | Chat message content | Legitimate interests |
| Understand Site usage and improve content | Analytics data (anonymised) | Legitimate interests |
| Send follow-up emails about your enquiry | Email address | Legitimate interests |
| Fulfil contractual obligations to B2B clients | Per engagement contract | Contract performance |
| Comply with legal obligations | As required by law | Legal obligation |
We do not sell your personal data to third parties. We do not use your data for automated profiling that produces legal or similarly significant effects on you.
4. Legal Basis for Processing
India - Digital Personal Data Protection Act 2023 (DPDP Act)
As an Indian company, our primary legal framework is the DPDP Act 2023. We process personal data on the basis of:
- Consent - collected before or at the time of data processing, for analytics and marketing communications
- Legitimate uses - processing necessary to perform a contract or take pre-contractual steps at your request, and processing for compliance with applicable law
You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
European Union / EEA visitors - GDPR
For visitors based in the EU or EEA, we additionally rely on the legal bases specified in the table in Section 3 above, as required by GDPR Article 6. Our processing of special categories of data (GDPR Article 9) is limited to what is strictly necessary and based on explicit consent where applicable.
California residents - CCPA / CPRA
California residents have specific rights under the California Consumer Privacy Act and the California Privacy Rights Act. See Section 10 for details. We do not sell personal information as defined by CCPA.
5. Third-Party Processors
We engage the following sub-processors. Each processes your data only as necessary for the stated purpose and under appropriate data protection agreements.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic, PBC | Powers the Kai AI chat assistant | Chat message text | United States |
| Google LLC (Analytics / Tag Manager) | Site analytics and event tracking | Anonymised usage data, device info, approximate location | United States |
| Google LLC (Fonts) | Serving the DM Sans typeface | IP address (font request) | United States |
| Google LLC (Calendar Appointments) | Call scheduling and booking | Name, email, timeslot | United States |
| FormSubmit.co | Email delivery for contact forms | Form fields (name, email, company, message) | United States |
| Vercel Inc. | Website hosting and infrastructure | Server access logs, IP addresses | United States / Global CDN |
None of these providers receive your personal data for their own marketing purposes.
6. Cookies
| Category | Cookie Names | Purpose |
|---|---|---|
| Strictly necessary | Session state | Required for the Site to function correctly. Cannot be disabled. |
| Analytics | _ga, _ga_*, _gid | Google Analytics 4 - understand traffic patterns and page performance |
| Tag management | _gtm* | Google Tag Manager - manages analytics and tracking configurations |
We do not use advertising cookies, remarketing cookies, or social media tracking pixels.
You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout. You can also manage or delete cookies through your browser settings.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Contact form enquiries | 3 years from submission, or for the duration of a client relationship |
| Kai chat session data | Not retained by Upcore after the session ends; subject to Anthropic's retention policy |
| Google Analytics data | 14 months (GA4 default event-level data retention) |
| Calendar booking records | 12 months from the booking date |
| Email correspondence | 3 years from last communication |
| B2B client data (code, audit logs) | Per contractual agreement; minimum 5 years for compliance records |
After the applicable retention period, data is securely deleted or permanently anonymised.
8. International Data Transfers
As a company based in India, we transfer personal data to the United States and other countries where our sub-processors operate. These countries may not have data protection laws equivalent to the India DPDP Act 2023 or EU GDPR.
For data transfers, we rely on:
- Contractual safeguards in our data processing agreements with processors
- Processors' own compliance frameworks - for example, Google's EU-US Data Privacy Framework certification
For EU/EEA residents, where required under GDPR Chapter V, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.
9. B2B Client Data
When we deliver AI engineering governance or agent development services, we may access or process:
- Source code repositories (read access for governance review and audit)
- CI/CD pipeline configurations and build logs
- AI-generated code samples submitted for review
- Audit trail data and compliance artefacts
- Limited employee data - names, roles, team structures - necessary for governance reporting
We do not use client code or client data to train AI models. Code reviewed as part of a governance engagement is processed only for the purposes of that engagement and is not shared with third parties, except as required by law or as expressly directed by the client.
10. Your Rights
Under the DPDP Act 2023 (India)
- Right to information - know what personal data we hold about you and how it is being processed
- Right to correction and erasure - have inaccurate data corrected or have your data erased when no longer needed or when consent is withdrawn
- Right to grievance redressal - raise a complaint with us as Data Fiduciary, which we will respond to within 30 days
- Right to nominate - nominate another individual to exercise your data rights in case of death or incapacity
Under GDPR (EU / EEA residents)
- Right of access to your personal data (Article 15)
- Right to rectification of inaccurate data (Article 16)
- Right to erasure / "right to be forgotten" (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object to processing based on legitimate interests (Article 21)
- Right not to be subject to solely automated decision-making with significant effects (Article 22)
- Right to lodge a complaint with your EU member state's data protection supervisory authority
Under CCPA / CPRA (California residents)
- Right to know what personal information is collected, disclosed, or shared
- Right to delete personal information we hold about you
- Right to correct inaccurate personal information
- Right to opt out of sale or sharing of personal information (we do not sell personal information)
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising any of the above rights
11. Children
Our Site and services are directed at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently received data from a minor, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time as our services evolve or as legal requirements change. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes affecting active client relationships, we will provide notice by email.
Continued use of the Site after changes are posted constitutes your acceptance of the updated policy.
13. Contact
For all privacy-related queries, data rights requests, or complaints, contact us at:
Upcore Technologies Pvt. Ltd.
Bestech Business Tower, Sector 66
Sahibzada Ajit Singh Nagar (Mohali), Punjab 160062
India
Email: gaurav@upcoretechnologies.com
If you are an EU/EEA resident and are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your EU member state. If you are based in India, you may raise a complaint with the Data Protection Board of India once it is formally constituted under the DPDP Act 2023.