Privacy

UPGRADED Systems, based at Lange Kruisweg 70D, 2676 BP Maasdijk, Chamber of Commerce 42056807, VAT NL005461247B01, is responsible for processing the personal data described on this page. Questions? info@upgradedsystems.nl.

We only process data you actively share, or that is strictly necessary for the site to function:

• Contact details (name, email, company, phone) — when you reach out, request an account, or ask for a quote.
• Account data — for customer portal accounts: login data and software settings you configure.
• Correspondence — the email you send us and the email we send you, including its full text. See "Customer contact in the customer portal" below.
• Technical data — cookieless visitor statistics (page views, load speed), and only after your consent also product analytics (click events). Plus error reports, which include a masked recording of the session in which the error occurred.

• Contact and quotes — to respond to your request (basis: contract performance / legitimate interest).
• Customer portal — to deliver the software you have an account for (basis: contract performance).
• Visitor statistics — cookieless measurement of page views and load speed (Vercel Analytics and Speed Insights), running on every page view (basis: legitimate interest). No cookies are placed and no profiles are built about you.
• Product analytics — detailed click and usage analysis (PostHog) to improve the site (basis: consent). PostHog is only loaded after you consent via the cookie banner; you can withdraw at any time.
• Error tracking — to detect and fix bugs (basis: legitimate interest). When something goes wrong, we capture a masked recording of that session so we can reproduce the bug. What you type into input fields and the text on your screen are masked: we see what went wrong, not what you entered.

• Contact requests: up to 24 months after the last contact.
• Account data: as long as the account is active. After closure: 30 days, then anonymised or deleted.
• Correspondence in the customer portal: the full text up to 24 months, after which only a brief record remains (see below).
• Analytics and error reports (including masked session recordings): up to 13 months.
• Accounting records: 7 years per Dutch fiscal retention law.

When you (as a visitor of a customer site or of our demo) use a configurator that lets you upload a logo or design, we process that file to turn it into a production-ready design. For quality assurance and support we keep a processing record per upload: the submitted file, the result, and technical processing data (such as recognised text and a quality score).

• Retention: up to 30 days, then deleted automatically.
• Storage: secured, non-public cloud storage (Vercel) within our infrastructure.
• Access: only us and the customer on whose site you uploaded — strictly for quality control and support.
• Uploads are not used for marketing or shared with third parties.

Want an upload removed sooner? Email info@upgradedsystems.nl.

When you email us — or we email you — about a quote, an incident or an ongoing project, that correspondence also ends up in our customer portal. We read our own mailbox automatically and build a timeline per company of every contact moment, so a question does not fall through the cracks and everyone on our side sees the same picture. Chat conversations you hold in the portal will land in that same timeline later on.

• What we keep — sender (name and email address), date, subject, a short summary and the full text of the message. For attachments we only keep the file name, type and size; never the file itself — that stays in the mailbox, and that is where you open it.
• Why — to answer your question and to be able to look up what was agreed (basis: performance of the contract, and beyond that our legitimate interest in customer support and a traceable record).
• How long — the full text for up to 24 months; after that it is emptied automatically and a brief record remains: date, sender, subject and summary. From then on the original message only lives in our mailbox, under the regular retention period for contact requests.
• Who can see it — only we can, as administrators. This overview is currently not visible to customers in their own portal.
• Where it is stored — messages are staged in a private GitHub repository (see the processor list below) and then stored in our Supabase database.

We do not use this correspondence for marketing, and we read no mailbox other than our own. Want us to delete your company's timeline? Email info@upgradedsystems.nl and we will remove it in full.

We never sell your data. We use the following processors — this list is identical to Annex B of our data processing agreement (Dutch):

• Vercel (hosting and cookieless visitor statistics, EU region) — privacy
• Supabase (database and login, EU region) — privacy
• Resend (sending transactional email, EU) — privacy
• Sentry (error tracking and diagnostics) — privacy
• PostHog (product analytics, EU region, only after your consent) — privacy
• Anthropic (the AI model that reads and converts uploaded logos, United States) — privacy
• GitHub (private repository holding customer correspondence and incident alerts before they reach the portal, United States) — privacy
• Mollie (payments for orders placed through our configurators, Netherlands) — privacy
• Stripe (subscription payments for the customer portal) — privacy

Transfers outside the EU. Anthropic and GitHub process data in the United States. Those transfers rely on the European Commission's standard contractual clauses in their data processing agreements. We keep what goes there as small as possible: Anthropic only receives the file that needs processing, and the GitHub repository is private and contains only correspondence that was already in our own mailbox.

We do not process payment details ourselves. Card numbers, IBAN and other payment details are entered directly with the payment provider (Mollie or Stripe), in their own payment environment. All we send there is the amount, a description and — for a subscription — the email address of your account, and all we get back is whether payment succeeded. So we never see or store your payment details.

A data processing agreement is in place with these processors. Mollie and Stripe additionally process payment data as independent controllers, under their own privacy policies.

Without your consent we place a single functional cookie: the customer portal login session (Supabase), and you only get it once you log in. The language you see is derived from the page address (/en/ for English) — there is no cookie for that.

The site also keeps a few preferences locally in your browser (localStorage): your choice in the cookie banner, notices you dismissed, and portal display settings. Those stay on your own device and are not sent to us or to third parties.

The cookieless visitor statistics (Vercel Analytics and Speed Insights) place no cookies, and neither does Sentry. Only PostHog sets a cookie, and only after you consent via the banner.

You can withdraw consent at any time by clearing this site's cookies and locally stored data in your browser; the banner will then reappear.

You have the right to access, correction, deletion, restriction, portability, and to object to processing of your data. Email info@upgradedsystems.nl — we respond within 30 days. Not satisfied? You can file a complaint with the Dutch Data Protection Authority.

We may update this privacy policy. The most recent version is always on this page; the date of the last change is at the top.