Privacy Policy

Last updated: 26 October 2026

العربية Terms of Service

Upcycle ("we", "us"), operated by Upcycle CRM — Commercial Registration No. 26-20752-061, is a business management platform for agencies and companies: CRM, projects, marketing, reporting and messaging. This policy explains what data we collect, what we access from platforms you connect (such as Google and Meta), why, how long we keep it and how you can delete it.

1. Information we collect

  • Account information: name, email address, phone number, password (stored hashed) and profile photo.
  • Workspace information: company name, branding, team members, and the business records you create (leads, clients, projects, tasks, invoices, files, messages).
  • Usage information: sign-in history, IP address, browser type and the actions you take in the app, used for security and support.
  • Payment information: processed by our payment providers; we do not store full card numbers.
  • Data from platforms you connect, described below. We only access it after you connect the platform yourself.

2. Google user data

When you choose "Connect with Google", you pick the Google products to connect. We ask Google only for the permissions of the products you picked, and you can add others later. We identify the connected Google account by its email address (userinfo.email scope).

For each product, this is the data we access and why:

  • Google Ads

    https://www.googleapis.com/auth/adwords

    Read your ad accounts, campaigns, ad groups, ads, budgets and performance metrics (impressions, clicks, cost, conversions) to show them in your marketing dashboards and reports. Campaign changes are made only when you explicitly act on them inside Upcycle.

  • Google Analytics

    https://www.googleapis.com/auth/analytics.readonly

    Read your GA4 properties and reports (traffic, sources, top pages, conversions, real-time users) to show website performance in your dashboards and client reports. Read only.

  • Google Search Console

    https://www.googleapis.com/auth/webmasters.readonly

    Read your verified sites and search analytics (queries, pages, clicks, impressions, position) for the SEO module and reports. Read only.

  • Google Tag Manager

    https://www.googleapis.com/auth/tagmanager.readonly

    Read your accounts, containers and tags to show tracking setup in the marketing module. Read only.

  • Google Calendar

    https://www.googleapis.com/auth/calendar, https://www.googleapis.com/auth/calendar.events

    Only if you connect it from the calendar settings: create and sync the meetings you schedule in Upcycle and generate Google Meet links. It is never requested from the marketing integrations.

  • Gmail

    https://www.googleapis.com/auth/gmail.send

    Only if you connect your mailbox in the Mail module: send the emails you write inside Upcycle from your Gmail address. It is never requested from the marketing integrations.

  • Gmail inbox sync (optional)

    https://www.googleapis.com/auth/gmail.readonly

    Only if you turn on inbox sync in the Mail module: read the messages in your inbox to show them inside Upcycle. Off by default, and you can turn it off at any time.

  • Google Drive and Slides

    https://www.googleapis.com/auth/drive.file, https://www.googleapis.com/auth/presentations

    Only if you use "Import from Drive" or export to Slides: open only the files you pick in the Google Picker and create presentations you ask for. We cannot see any other file in your Drive. It is never requested from the marketing integrations.

  • YouTube

    https://www.googleapis.com/auth/youtube.upload, https://www.googleapis.com/auth/youtube.readonly, https://www.googleapis.com/auth/yt-analytics.readonly

    Only if you connect a YouTube channel to a project: show the channel, publish the videos you schedule in Upcycle, and read channel and video analytics for your reports.

Limited Use disclosure

Upcycle's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google API Services User Data Policy

  • We use Google user data only to provide and improve the features you see in Upcycle that use it.
  • We do not sell Google user data, and we do not use or transfer it for advertising, retargeting, credit-worthiness or lending.
  • We do not transfer Google user data to others, except as needed to provide the features you use, to comply with the law, or as part of a merger or acquisition with your notice.
  • No person at Upcycle reads your Google user data unless you give us permission (for example in a support request), it is needed for security or to investigate abuse, it is required by law, or it is aggregated and anonymised for internal operations.
  • We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. When you use an AI feature, the data is processed only to produce the result you asked for.

3. Google user data and AI

Some Upcycle features use AI on data you bring in from Google, for example sorting the columns of a spreadsheet you import from Google Sheets or Google Drive. These rules apply to all Google user data:

  • Google user data is processed only by our own AI setup: models run through our own Ollama server, hosted models that Ollama provides under a policy of no training on and no retention of the data sent to them.
  • Google user data is never sent to any other AI provider. This includes the backup AI providers our platform can use for other features, and any AI provider or API key a workspace connects in its own settings.
  • If our own AI setup is unavailable, the feature works without AI (for example, a spreadsheet import matches columns by their header names) rather than sending the data elsewhere.
  • Google user data is never used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models, by us or by anyone else. It is processed only to produce the result you asked for.
  • Upcycle's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. YouTube API Services

Upcycle uses YouTube API Services when you connect a YouTube channel. By connecting a channel you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms

Google's handling of your data is described in the Google Privacy Policy: https://policies.google.com/privacy

We use YouTube data only to publish the videos you schedule, show the connected channel and its videos, and show channel analytics in your reports. We store the channel name and id, the video ids and titles we published, and daily analytics numbers. We do not sell or share YouTube data.

You can revoke Upcycle's access at any time from Google's security settings: https://security.google.com/settings/security/permissions, or by disconnecting the channel inside Upcycle. When you disconnect the channel in Upcycle, we delete its access tokens at once. To have the stored YouTube data deleted too, email us or use the data deletion page; we delete it within 30 days.

5. Meta data (Facebook, Instagram, WhatsApp Business)

When you connect Meta, you choose the Pages, Instagram accounts, ad accounts and WhatsApp Business accounts to connect. Depending on what you connect, we access: Page and Instagram profile details, posts, comments, messages and insights; ad accounts, campaigns and performance metrics; lead form submissions (Lead Ads) so new leads appear in your CRM; and WhatsApp Business account details, message templates and conversations.

We use this data only to show your pages, ads and leads in Upcycle, publish and reply when you ask us to, and build your reports. We do not sell it or use it for advertising. You can remove access at any time from Upcycle (Settings → Integrations → Disconnect) or from Facebook (Settings → Business integrations), and request deletion as described below.

6. WhatsApp messaging

When you connect WhatsApp, we link your WhatsApp number as a linked device through our own WhatsApp service, which is part of Upcycle. To send and receive your messages we process: the linked device and phone number, your contacts' phone numbers and names, message content and attachments, and delivery and read status.

This data is stored in your workspace so your team can follow up, and it is used only to deliver and show your messages. You can disconnect the device at any time from the WhatsApp integration.

7. Other connected platforms

If you connect LinkedIn, TikTok, Snapchat, X or Microsoft 365, we access the accounts, ad accounts, performance metrics or mailbox you authorise, only to show them in Upcycle and act on your requests. The same retention and deletion rules below apply.

8. How we use information

  • To provide the platform: dashboards, reports, CRM, messaging and the other features you use.
  • To keep accounts secure, prevent abuse and fix problems.
  • To send service messages such as sign-in codes, invoices and important changes.
  • To provide support when you contact us.

9. Sharing

We do not sell personal data. We share data only with service providers that help us run Upcycle (hosting, payment processing, email and SMS delivery), under contracts that limit their use to our instructions, or when required by law. Data you choose to share with your own clients (for example a client report link) is shared by you.

10. Storage and security

Data is sent over HTTPS. Access tokens from Google, Meta and other platforms are stored encrypted and are used only by our servers. Each workspace's data is kept separate, and staff access is limited and logged.

11. Retention

  • Account and workspace data: kept while your subscription is active. When a workspace is deleted it is held for a 30-day grace period (so it can be restored) and then permanently purged, except records the law requires us to keep, such as invoices.
  • Access tokens from connected platforms: kept until you disconnect the platform, and deleted immediately when you do.
  • Data synced from connected platforms (such as ad and analytics metrics): kept while the connection is active, and deleted within 30 days after you disconnect or ask us to delete it.
  • Backups: kept for up to 6 months on a rolling basis and then overwritten.

12. Disconnecting and deleting your data

  • Disconnect: open Settings → Integrations (or Marketing → Platforms) and click "Disconnect" on the platform. This deletes the stored tokens immediately.
  • Revoke at Google: visit myaccount.google.com/permissions and remove Upcycle. At Meta: Facebook Settings → Business integrations.
  • Delete everything: email support@upcycle-crm.com from your account email and ask us to delete your data. We confirm within 7 days and complete the deletion within 30 days.
support@upcycle-crm.com

13. Your rights

You can access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent at any time. Workspace owners can export and delete their data from Settings. For anything else, contact us at support@upcycle-crm.com.

14. Cookies

We use cookies needed to sign you in and keep the app secure, and, with your consent, cookies that help us understand usage. See our Cookie Policy for details.

Cookie Policy

15. Children

Upcycle is a business service and is not intended for anyone under 18.

16. Changes to this policy

We will post any changes on this page and update the date above. If a change materially affects how we use data from connected platforms, we will notify workspace owners before it takes effect.

17. Contact

Upcycle CRM — Commercial Registration No. 26-20752-061. Questions or requests about privacy: support@upcycle-crm.com.

support@upcycle-crm.com