1. Who We Are
Upcore Technologies Pvt. Ltd. ("Upcore", "we", "our", or "us") is a private limited company incorporated under the Companies Act, 2013, with its registered office at Unit No. 625, 6th Floor, Tower-A, Bestech Business Tower, Sector 66, Sahibzada Ajit Singh Nagar (Mohali), Punjab 160062, India.
We operate the website at upcoretech.com and related subdomains (the "Site"), and we provide AI engineering governance, AI agent development, and related technology services.
This Privacy Policy explains what personal data we collect when you visit the Site or interact with us, how we use it, and the rights you have. It applies to:
- Visitors to our Site, including prospective clients
- People who contact us via forms, chat, email, or WhatsApp
- Business clients whose employees or data we process under a service engagement
2. Data We Collect
Information you provide directly
When you fill in a form on our Site or contact us, we may collect your name and job title, business email address, company name and industry, phone or WhatsApp number, a description of your AI challenge or use case, and team size where provided.
Website assistant
Our website includes an assistant that answers questions about Upcore. When you type a question, the text of your recent messages, the assistant's replies and the address of the page you are on are sent to our server and passed to a third-party AI model provider (currently Groq, Inc., United States) to generate the answer. We do not store chat conversations on our servers; the conversation is kept in your browser for the current session only. If the AI service is unavailable, the assistant answers from pre-written content in your browser. If you choose "Talk to a person", your name, email, question and the recent conversation are relayed to our team inbox via FormSubmit.co (a form-relay service) and used only to respond to you. Do not include sensitive personal data - health information, government IDs, or financial account numbers - in the assistant.
Calendar bookings
If you book a call via a "Book a Discovery Call" button or our assessment page, you interact with Google Calendar's Appointment Scheduling. Google collects your name, email, and chosen timeslot to confirm the booking. That data is governed by Google's Privacy Policy.
Before the calendar opens, we may ask for your work email (you can skip this step). We store that email in a private Google Sheet together with the page you booked from, any campaign parameters in the link you arrived on (such as utm_source or a Google Ads click ID), and your analytics ID where analytics cookies are allowed. When a booking is made with the same email, we use this record to send our team the booking context and to measure which pages and campaigns lead to booked calls. Our team is also notified by email via FormSubmit.co so we can follow up if a booking is not completed.
Analytics and usage data
We use Google Analytics 4 and Google Tag Manager to understand how visitors use our Site. This includes pages visited, scroll depth and click events, referring website or search query, browser type and device category, and approximate geographic location. This data is collected via cookies and associated with a randomly assigned analytics ID, not with your name or email. IP addresses are not logged or stored by GA4.
We use Microsoft Clarity to see, in aggregate and through session replays, how visitors use our pages (for example where they click and how far they scroll). Clarity masks text you type into forms.
Advertising measurement
We use the Google Ads tag to measure which of our ads lead to enquiries and booked calls, and it may be used to show our ads to people who have visited the Site (remarketing). When you arrive from one of our ads, the Google Ads click ID in the link is stored in your browser so a later booking can be attributed to that ad.
Your cookie choices
If you visit from the UK, the European Economic Area or Switzerland, analytics and advertising cookies are off until you accept them in our cookie banner. Elsewhere they are on by default. You can change your choice at any time using the Cookie settings link in the footer of our pages, and you can also delete cookies through your browser settings.
Hosting and server logs
Our Site is hosted on Vercel. Vercel may collect standard server access logs including IP addresses, request paths, and timestamps as part of normal infrastructure operation.
Google Fonts
Our Site loads the DM Sans and Geist typefaces from Google Fonts servers. When your browser requests the font files, your IP address is transmitted to Google. See Google's Font API Privacy FAQ for details.
3. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Respond to your enquiry or contact form submission | Name, email, company, challenge | Legitimate interests / pre-contractual steps |
| Schedule a discovery or governance review call | Name, email, phone, timeslot | Consent (booking action) |
| Answer questions in the website assistant, and pass them to our team if you ask | Text of your conversation and the page you are on; name and email if you choose “Talk to a person” | Legitimate interests |
| Understand Site usage and improve content | Analytics data (pseudonymous analytics ID, usage events) | Consent where required (UK/EEA/Switzerland); otherwise legitimate interests |
| Measure which pages and ad campaigns lead to booked calls | Email you enter before booking, campaign parameters, Google Ads click ID, analytics ID | Legitimate interests; consent for advertising cookies where required |
| Send follow-up emails about your enquiry | Email address | Legitimate interests |
| Fulfil contractual obligations to B2B clients | Per engagement contract | Contract performance |
| Comply with legal obligations | As required by law | Legal obligation |
We do not sell your personal data to third parties. We do not use your data for automated profiling that produces legal or similarly significant effects on you.
4. Legal Basis for Processing
India - Digital Personal Data Protection Act 2023 (DPDP Act)
As an Indian company, our primary legal framework is the DPDP Act 2023. We process personal data on the basis of:
- Consent - collected before or at the time of data processing, for analytics and marketing communications
- Legitimate uses - processing necessary to perform a contract or take pre-contractual steps at your request, and processing for compliance with applicable law
You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
European Union / EEA visitors - GDPR
For visitors based in the EU or EEA, we additionally rely on the legal bases specified in the table in Section 3 above, as required by GDPR Article 6. Our processing of special categories of data (GDPR Article 9) is limited to what is strictly necessary and based on explicit consent where applicable.
California residents - CCPA / CPRA
California residents have specific rights under the California Consumer Privacy Act and the California Privacy Rights Act. See Section 10 for details. We do not sell personal information as defined by CCPA.
5. Third-Party Processors
We engage the following sub-processors. Each processes your data only as necessary for the stated purpose and under appropriate data protection agreements.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC (Calendar Appointment Scheduling) | Call scheduling and booking | Name, email, chosen timeslot | United States |
| FormSubmit.co | Relays website form submissions to our team inbox | Form contents (name, email, company, message) | United States / EU |
| Google LLC (Analytics / Tag Manager) | Site analytics and event tracking | Pseudonymous usage data, device info, approximate location | United States |
| Google LLC (Google Ads) | Advertising measurement and remarketing | Ad click ID, conversion events, cookie identifiers | United States |
| Google LLC (Google Workspace) | Private spreadsheet storing booking records | Email entered before booking, campaign parameters, analytics ID | United States |
| Microsoft Corporation (Clarity) | Usage analytics and session replay | Pseudonymous usage data, device info | United States |
| Google LLC (Fonts) | Serving the DM Sans typeface | IP address (font request) | United States |
| FormSubmit.co | Email delivery for contact forms | Form fields (name, email, company, message) | United States |
| Groq, Inc. | AI model for the website assistant | Text of assistant conversations, page address | United States |
| Vercel Inc. | Website hosting and infrastructure | Server access logs, IP addresses | United States / Global CDN |
None of these providers receive your personal data for their own marketing purposes.
6. Cookies
| Category | Cookie Names | Purpose |
|---|---|---|
| Strictly necessary | Session state | Required for the Site to function correctly. Cannot be disabled. |
| Analytics | _ga, _ga_*, _gid | Google Analytics 4 - understand traffic patterns and page performance |
| Analytics | _clck, _clsk (Microsoft Clarity) | Usage analytics and session replay |
| Advertising | _gcl_au, _gcl_aw (Google Ads) | Attribute enquiries and bookings to the ad that brought you; remarketing |
| Tag management | _gtm* | Google Tag Manager - manages analytics and tracking configurations |
| Preferences (browser storage) | upc_consent, upc_attrib | Remember your cookie choice; keep the campaign you first arrived from so a later booking can be attributed |
Analytics and advertising cookies are set only where you have accepted them or where consent is not required (see "Your cookie choices" in Section 2). We do not use social media tracking pixels.
You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout. You can also manage or delete cookies through your browser settings.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Contact form enquiries | 3 years from submission, or for the duration of a client relationship |
| Chat-widget submissions | Retained in our team inbox as ordinary business correspondence |
| Google Analytics data | 14 months (GA4 default event-level data retention) |
| Calendar booking records | 12 months from the booking date |
| Booking-attribution records (email entered before booking, campaign data) | 12 months from entry |
| Email correspondence | 3 years from last communication |
| B2B client data (code, audit logs) | Per contractual agreement; minimum 5 years for compliance records |
After the applicable retention period, data is securely deleted or permanently anonymised.
8. International Data Transfers
As a company based in India, we transfer personal data to the United States and other countries where our sub-processors operate. These countries may not have data protection laws equivalent to the India DPDP Act 2023 or EU GDPR.
For data transfers, we rely on:
- Contractual safeguards in our data processing agreements with processors
- Processors' own compliance frameworks - for example, Google's EU-US Data Privacy Framework certification
For EU/EEA residents, where required under GDPR Chapter V, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.
9. B2B Client Data
When we deliver AI engineering governance or agent development services, we may access or process:
- Source code repositories (read access for governance review and audit)
- CI/CD pipeline configurations and build logs
- AI-generated code samples submitted for review
- Audit trail data and compliance artefacts
- Limited employee data - names, roles, team structures - necessary for governance reporting
We do not use client code or client data to train AI models. Code reviewed as part of a governance engagement is processed only for the purposes of that engagement and is not shared with third parties, except as required by law or as expressly directed by the client.
10. Your Rights
Under the DPDP Act 2023 (India)
- Right to information - know what personal data we hold about you and how it is being processed
- Right to correction and erasure - have inaccurate data corrected or have your data erased when no longer needed or when consent is withdrawn
- Right to grievance redressal - raise a complaint with us as Data Fiduciary, which we will respond to within 30 days
- Right to nominate - nominate another individual to exercise your data rights in case of death or incapacity
Under GDPR (EU / EEA residents)
- Right of access to your personal data (Article 15)
- Right to rectification of inaccurate data (Article 16)
- Right to erasure / "right to be forgotten" (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object to processing based on legitimate interests (Article 21)
- Right not to be subject to solely automated decision-making with significant effects (Article 22)
- Right to lodge a complaint with your EU member state's data protection supervisory authority
Under CCPA / CPRA (California residents)
- Right to know what personal information is collected, disclosed, or shared
- Right to delete personal information we hold about you
- Right to correct inaccurate personal information
- Right to opt out of sale or sharing of personal information (we do not sell personal information)
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising any of the above rights
11. Children
Our Site and services are directed at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently received data from a minor, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time as our services evolve or as legal requirements change. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes affecting active client relationships, we will provide notice by email.
Continued use of the Site after changes are posted constitutes your acceptance of the updated policy.
13. Contact
For all privacy-related queries, data rights requests, or complaints, contact us at:
Upcore Technologies Pvt. Ltd.
Unit No. 625, 6th Floor, Tower-A, Bestech Business Tower
Sector 66, Sahibzada Ajit Singh Nagar (Mohali), Punjab 160062
India
Email: gaurav@upcoretechnologies.com
Grievance Officer (DPDP Act 2023): Gaurav Passi, Co-Founder & CEO — gaurav@upcoretechnologies.com, at the address above. We acknowledge grievances within 72 hours and aim to resolve them within 30 days.
If you are an EU/EEA resident and are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your EU member state. If you are based in India, you may raise a complaint with the Data Protection Board of India once it is formally constituted under the DPDP Act 2023.