Privacy Policy
Effective October 11, 2026
1. Who we are
Uplevel is a real estate customer relationship management platform operated by Uplevel Technologies, Inc. ("Uplevel," "we," "our," or "us"). This policy explains how we collect, use, disclose, retain, and protect personal information when you visit uplevelre.com, use the Uplevel platform, connect a third-party service, or contact us.
2. Information we collect
Depending on how you use Uplevel, we collect:
- Account information, including your name, email address, profile image, sign-in methods, preferences, and workspace membership.
- CRM and business content that you or your workspace provides, including contacts, communications, tasks, calendar items, deals, listings, files, notes, and automation settings.
- Billing and transaction information. Payment-card details are handled by our payment provider rather than stored directly by Uplevel.
- Product usage, device, browser, diagnostic, security, and support information needed to operate and protect the service.
- Information submitted through applications, forms, surveys, referrals, and communications with us.
3. Google user data
Connecting Google is optional. We request only the permissions needed for the Google features you choose. Depending on those features, Uplevel may access:
- Google identity: your Google account identifier, name, email address, and profile image so you can sign in or identify a connected account.
- Gmail: messages, threads, participants, headers, labels, bodies, previews, and attachments so Uplevel can synchronize client conversations and, at your direction, send, label, archive, or otherwise manage email.
- Google Calendar: calendar lists, event details, attendees, and app-created calendars so you can view and synchronize appointments and manage events from Uplevel.
- Google Tasks: task lists, tasks, notes, links, status, and dates so tasks can synchronize with Uplevel.
- Google Drive: only files you create with Uplevel or explicitly select through Google Picker. We use file metadata to attach a link, and we access file contents only when you choose to import a private copy into Uplevel. We do not scan or request access to your entire Drive.
Your general Google connection and Google Drive connection use separate, least-privilege authorization grants. Disconnecting one does not revoke the other. Other workspace members cannot use your personal Google credential. Synchronized Gmail content is private to you unless you choose to share it with your team, when you connect or later in Settings → Integrations. Some older connections share with the team; you can turn that off there at any time. Messages sent from the shared CRM are workspace work product.
4. How we use information
We use information to:
- Provide, personalize, maintain, synchronize, and improve Uplevel.
- Carry out actions you request and operate automations you configure.
- Authenticate users, administer workspaces, and process transactions.
- Send service notices, product updates, and support responses.
- Monitor reliability, troubleshoot problems, and protect against abuse.
- Comply with law and enforce our agreements.
AI features
When you or your workspace use an AI feature, such as asking Jan, a contact or call summary, reading a lead email, or an automation step that reads replies or writes a message, the information that request needs is sent to our AI providers to produce the answer. Depending on the feature, this can include contact details, notes, activity, emails with the contact (including synchronized Gmail), texts, call transcripts, lead emails and listing details. Voice dictation sends the recorded clip.
Requests go through Requesty, an AI router, to Fireworks AI for most features, TypeSafe AI for short decisions about replies and requests, OpenAI for voice dictation, and Anthropic for reading brand guides. Our sub-processor list says what each one receives.
AI features use Google user data only to provide the feature you asked for. We do not use your Google user data or other customer content to train AI models, and we do not use Google user data for advertising.
5. Google API Services User Data Policy
Uplevel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide or improve the user-facing Google features described in this policy. We do not sell Google user data, use it for personalized advertising, or allow humans to read it except with your affirmative agreement for support, when necessary for security or abuse investigation, to comply with law, or when the data has been aggregated and anonymized for internal operations.
6. When we disclose information
We do not sell personal information or customer content. We disclose information only as needed:
- To your workspace and the people you direct us to share with, subject to your role and privacy settings.
- To service providers that host, secure, support, or process the service for us, including the AI providers described above. Our sub-processor list names each one and what it receives.
- To comply with law, respond to lawful process, protect rights and safety, or investigate fraud and abuse.
- In connection with a financing, merger, acquisition, or sale, subject to this policy and appropriate safeguards.
7. Retention, disconnection, and deletion
We retain personal information while your account or workspace is active and as needed to provide the service, meet legal obligations, resolve disputes, enforce agreements, and maintain security. Retention depends on the type of information and why we hold it.
How long we keep information
| Information | How long we keep it |
|---|---|
| Contacts and their messages, notes, deals, tasks and files | Until the workspace deletes them |
| Call transcripts, call summaries and voicemail recordings | Until deleted, or 30 days to 2 years if the workspace chooses |
| Conversations with Jan, the AI assistant | Until deleted, or 30 days to 2 years if the workspace chooses |
| Page views and visitor history on websites built with Uplevel | 13 months |
| Carrier notices for texts and calls | 30 days |
| Automation trigger details | 30 days |
| Notifications | 180 days |
| Support requests sent from our website, or from a deleted workspace | 1 year after the last message |
| Security activity | 400 days |
| API and connected-app request logs | 90 days |
| Webhook delivery history | 30 days |
| Expired sign-in sessions, codes and links | 1 day after they expire |
| Encrypted backups | Up to 35 days |
Deleted information stays in our encrypted backups for up to 35 days, then it is gone. What deleting removes, and what we keep explains each row, what happens when a contact or a website account is deleted, and how website visitors are counted.
- You can disconnect Google or Google Drive in Settings → Integrations. We then request revocation at Google and remove the encrypted OAuth tokens for that connection. Disconnecting the general Google connection also removes synchronized Gmail, Calendar, and Google Tasks records tied to it, including their entries on contact timelines.
- If you leave or are removed from a workspace, or your account or the workspace is deleted, your Google connections in that workspace are disconnected the same way.
- Content deliberately brought into the CRM becomes workspace content. Imported contacts, messages sent from Uplevel, Drive link metadata, and private file copies may remain until they are deleted from Uplevel or the applicable workspace is deleted. External Drive links continue to follow Google's own sharing settings.
- Deleting a contact erases their messages, call transcripts, voicemails, lead emails and website history. Their opt-outs are kept so they are not contacted again if they are added back: email opt-outs as a one-way hash of the address, and text opt-outs by phone number, as carrier rules require.
- If you have an account on a website built with Uplevel, you can delete it from the “Manage or delete your account” link in its listing alert emails, or ask the agent who runs the site. The agent can also delete it, or delete your contact record entirely.
- You can close your account from Settings → My profile. If you are the only member of a workspace, closing your account deletes that workspace. Content in a workspace with other members may remain as shared business records after your personal account is removed.
You can also ask us to delete personal information or help remove Google-derived workspace content by emailing [email protected]. We may retain limited records where required by law or for legitimate security, fraud-prevention, billing, and audit purposes.
8. Affiliate referrals and first-party cookies
When you follow an approved affiliate link, we record a privacy-minimized click. If you consent—or if an approved program policy classifies the referral token as strictly necessary—we may store an opaque, first-party token in your browser. The token lets us connect the referral to a later application, account, workspace, and eligible payment so we can administer the affiliate program and prevent fraud. We keep campaign labels and standard UTM parameters separate from the referral token.
Referral memory is limited to the attribution window disclosed when you arrive. A direct return does not replace an active referral. Under our current last-click policy, a later valid link from another affiliate replaces the earlier referral until you create an account. Attribution may be unavailable after expiry or revocation, if you reject referral storage or clear cookies, or when you use another browser or device. We do not use fingerprinting to bridge those limits.
We hash browser and email matching values before storing affiliate attribution evidence. Affiliates receive opaque referral identifiers and status—not a referred person's name, email address, phone number, payment details, or workspace data. We retain click evidence and financial records only for the periods in the active affiliate policy and applicable law.
9. Security and location
We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. Connections use TLS in transit, stored application data is encrypted at rest, and Google OAuth tokens are encrypted separately. Uplevel application data is hosted in the United States. Some of our providers, such as Requesty, are based elsewhere; the sub-processor list names them. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
10. Your choices
You can update profile and workspace information, control Google connections and Gmail sharing, export available CRM data, disconnect integrations, or close your account through Uplevel. You can also revoke Uplevel from your Google Account connections. Depending on where you live, you may have additional rights to access, correct, delete, or receive a copy of personal information. Contact us to exercise those rights.
11. Children
Uplevel is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13.
12. Changes to this policy
We may update this policy as our services or legal obligations change. We will post the updated policy here, change the effective date, and provide additional notice when a change is material.
13. Contact us
Questions, privacy requests, and deletion requests can be sent to [email protected] or submitted through our support page.