Privacy Policy

Last updated: July 25, 2026

UPZARE TECHNOLOGIES PRIVATE LIMITED ("UPZARE", "we", "us", or "our") is a private limited company incorporated in India. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information across our company website at upzare.com and the products we operate: Waffy (waffy.io and the Waffy browser extension) and SuperPost(superpost.dev). We refer to these collectively as the "Services".

UPZARE is transitioning and our products are under active development. This policy may evolve as the Services change. Each product may also publish its own product-specific privacy notice; where a product notice applies, it should be read together with this policy.

1. Information We Collect

1.1 Information You Provide

• Account and Contact Information: Name, email address, username, password, and time zone when you register, join a waitlist, or contact us.
• Billing Details: For paid features (such as SuperPost premium plans), payment card information and billing address, processed through our payment providers.
• Support Communications: Information you provide when you contact support, including ticket content, attachments, and chat transcripts.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, session duration, and referring URLs.
• Device and Technical Data: IP address, browser type and version, operating system, device identifiers, and access logs.
• Cookies and Similar Technologies: We use cookies and similar technologies as described in our Cookies Policy.

1.3 Product-Specific Data

• Waffy: Waffy is a free, open-source browser extension that runs locally in your browser. Your prompts, instructions, page content, and the API keys you configure are stored locally on your device and sent directly from your device to the third-party AI providers you choose. We do not operate a hosted inference backend and do not receive your extension activity or API keys. We only receive information you submit to the Waffy website, such as waitlist sign-ups or support requests.
• SuperPost: When you connect social media platforms (such as Facebook, Instagram, TikTok, LinkedIn, Pinterest, X, Threads, or YouTube), we may access profile details, account IDs, access tokens, and content you publish along with related performance metrics (likes, clicks, shares, and impressions). This data is used solely to operate SuperPost and is not shared with unrelated third parties.

1.4 Information from Third Parties

We may receive information about you from payment processors, analytics providers, and fraud-detection services, as well as from the third-party platforms and AI providers you connect to our Services.

2. How We Use Your Information

• Provide, operate, maintain, and improve the Services.
• Process transactions and send billing-related communications.
• Respond to support requests and provide customer service.
• Send service updates, security alerts, and administrative messages.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Analyse usage trends to improve performance and user experience.
• Comply with legal obligations and enforce our Terms of Service.
• Send marketing communications, only with your consent, which you may withdraw at any time.

3. Legal Basis for Processing

Where data protection laws such as the EU/UK GDPR or Brazil's LGPD apply, we rely on the following legal bases:

• Contract Performance: Processing necessary to provide the Services you request.
• Legitimate Interests: Fraud prevention, security, analytics, and improving our Services, where not overridden by your rights.
• Consent: Where you have given explicit consent, such as for marketing or connecting third-party accounts.
• Legal Obligation: Processing required to comply with applicable law.

4. How We Share Your Information

We do not sell your personal information. We may share data with:

• Service Providers: Payment processors, cloud infrastructure, email delivery, and analytics providers that help us operate the Services.
• Third-Party Platforms and AI Providers: When you connect them, subject to their own terms and policies.
• Legal Requirements: Authorities when required by law, court order, or subpoena.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• With Your Consent: In any other case where you have provided explicit consent.

5. Account Disconnection and Data Deletion

For SuperPost, you can disconnect connected social accounts and permanently delete the associated credentials, access tokens, and stored data from your dashboard: log in, open the Integrations page, select the connected account, and choose Disconnect. You may also revoke access directly from the security settings of the respective platform. For Waffy, uninstalling the extension removes locally stored settings, keys, and history from your browser.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. After account deletion, we retain certain data for a limited period for backup and audit purposes. Billing records are retained as required to comply with tax and accounting regulations. You may request deletion of your data at any time, subject to our legal retention obligations.

7. Data Security

We implement technical and organisational measures to protect your data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

8. International Data Transfers

Your data may be processed in countries other than your country of residence, including India and the countries where our service providers operate. Where required, we adopt appropriate safeguards for international transfers.

9. Your Rights

Depending on your location, you may have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion, anonymization, or blocking of unnecessary data.
• Request restriction of, or object to, certain processing.
• Request your data in a portable, machine-readable format.
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with your local data protection authority (for example, the ANPD in Brazil).

10. Children's Privacy

Our Services are not directed to children. Waffy and our company website are intended for individuals who are at least 18 years old, and SuperPost is not intended for children under 16. We do not knowingly collect personal information from children, and we will delete such data if we become aware of it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy and revise the "Last updated" date above. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

UPZARE TECHNOLOGIES PRIVATE LIMITED is the data controller for personal data collected through the Services. For any privacy-related request, contact us at privacy@upzare.com. You can also reach our product teams at support@waffy.io (Waffy) and support@superpost.dev (SuperPost). We aim to respond within 30 days.