Privacy Policy

Upsoma, Inc. ("Upsoma," "we," "us," or "our") builds an AI-native adaptive learning platform that turns goals into personalized learning pathways and turns progress into readiness evidence. This Privacy Policy ("Policy") explains how we collect, use, share, and otherwise process personal data from learners, educators, teams, and visitors ("you," "your") of our website, applications, and services (collectively, the "Services").

By using our Services you acknowledge this Policy. If you do not agree with it, please discontinue use of the Services.

1. Definitions

• "Personal Data" means any information that relates to an identified or

identifiable person — for example your name, email address, account identifier, IP address, authentication tokens, or usage and telemetry logs generated through your use of the Services.

• "Service Data" means data relating to the operation, support, security,

and billing of the Services that is not, on its own, Personal Data.

• "Data Protection Laws" means the EU GDPR, the UK GDPR, applicable U.S.

state privacy statutes, Canada's PIPEDA, and other laws governing the processing of Personal Data that apply to us.

2. Information We Collect

• Information you provide directly. When you create an account, subscribe to

a plan, contact support, or apply for a role, you may give us your name, email address, payment information (processed by our payment provider, Stripe — see stripe.com/privacy), and content you submit such as goals, prompts, and pathway configurations.

• Information collected automatically. When you interact with the Services we

automatically collect technical data such as IP address, browser and device type, pages visited, timestamps, and error logs.

• Learning & telemetry data. Our Skill Telemetry Agent records signals

such as completed labs, assessments, and projects to compute per-concept readiness scores and proficiency levels. We use these signals to personalize your pathway and surface prerequisite gaps.

• Sensitive data. We do not intentionally collect special-category or

sensitive data, and we instruct users not to upload it.

3. How We Use Personal Data

We process Personal Data to:

• provide, operate, and maintain the Services, including generating and adapting

learning pathways;

• personalize your experience and tune AI-driven features for your workspace;
• analyze usage to improve performance, functionality, and reliability;
• detect, prevent, and investigate fraud, abuse, or security incidents;
• communicate with you and provide customer support;
• process payments and transactions you authorize; and
• comply with legal, regulatory, and audit obligations.

We do not engage in automated decision-making that produces legal or similarly significant effects on you.

4. Legal Bases for Processing

Where Data Protection Laws apply, we rely on one or more of the following:

• Performance of a contract to provide the Services you request.
• Legitimate interests to secure the platform, prevent fraud, and improve

features, where not overridden by your rights.

• Consent for non-essential cookies and marketing communications, which you

may withdraw at any time.

• Legal obligations to comply with bookkeeping, regulatory, and legal duties.

5. AI Features and Model Training

Your prompts, goals, and generated outputs are used to serve your workspace. Once anonymized or aggregated, they may be used to improve our models. We do not use your raw or identifiable Personal Data to train general-purpose models that benefit other customers without your permission. To opt out of using your data for model improvement, email privacy@upsoma.com.

6. Sharing and Sub-Processors

We do not sell your Personal Data. We engage vetted sub-processors to support the Services — for example hosting providers, payment processing (Stripe), analytics, and customer support tooling. All sub-processors are bound by contractual obligations consistent with this Policy and applicable Data Protection Laws.

7. International Data Transfers

If you are located in the EEA, UK, or Switzerland, we may transfer Personal Data to the United States or other jurisdictions. Where required, we safeguard such transfers using mechanisms such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

8. Cookies and Tracking

We and selected partners use cookies and similar technologies to operate, secure, and analyze the Services. We deploy four categories:

• Strictly necessary cookies support core functions such as sign-in and

fraud prevention and do not require consent.

• Analytics & performance cookies measure feature adoption and diagnose

errors.

• Functional cookies remember preferences such as language and theme.
• Marketing cookies measure campaign effectiveness.

You can manage or withdraw consent at any time through the cookie preferences control on this site, your browser settings, or an authorized signal such as the Global Privacy Control (GPC).

9. Data Security

We implement reasonable, industry-standard safeguards, including encryption in transit and at rest, role-based access controls, multi-factor authentication, continuous backups, and security monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Data Retention

We retain Personal Data only as long as necessary to fulfil the purposes in this Policy or as required by law. Upon account termination we delete your Personal Data within a reasonable period, except where retention is required for fraud prevention, legal compliance, or dispute resolution. Backups may persist for a limited additional period.

11. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or port your Personal Data; to withdraw consent; and to opt out of targeted advertising. To exercise these rights, email privacy@upsoma.com. We will verify your identity and respond within the period required by applicable law. We will not discriminate against you for exercising your rights.

12. Children's Data

The Services are not directed to individuals under 18, and we do not knowingly collect Personal Data from them. If we learn that we have collected such data without appropriate consent, we will delete it.

13. Changes to This Policy

We may update this Policy to reflect changes in our practices or the law. We will post the revised Policy here and update the version and effective date above. For material changes that reduce your rights, we will provide advance notice by email or in-product notice.

14. Contact Us

If you have questions or wish to exercise your privacy rights, contact us at privacy@upsoma.com.