Privacy Policy

1. Introduction

DeepLight ("we," "our," or "us") operates the UpSight platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the UpSight platform and related services (collectively, the "Service").

By using our Service, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, company name, job title, and phone number when you register for an account.
• Audio and Video Content: Interview recordings, meeting recordings, and other audio/video content you upload or record through our Service.
• Transcripts and Analysis: Text transcriptions and AI-generated analysis of your audio/video content.
• Payment Information: Billing address and payment details (processed securely through our payment processor).
• Communications: Information you provide when contacting our support team or participating in surveys.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service, and actions taken.
• Device Information: IP address, browser type, operating system, device identifiers, and screen resolution.
• Cookies and Tracking Technologies: Session cookies, analytics cookies, and similar technologies (see Section 8).

2.3 Information from Third Parties

• Integration Data: Information from services you connect to UpSight (e.g., calendar integrations, CRM systems).
• Single Sign-On: Basic profile information from identity providers if you use SSO.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process and transcribe your audio/video content
• Generate AI-powered insights and analysis from your content
• Process payments and manage your subscription
• Send transactional emails and service notifications
• Respond to your requests and provide customer support
• Analyze usage patterns to improve user experience
• Protect against fraud, abuse, and security threats
• Comply with legal obligations

Important: We do NOT use your audio recordings, transcripts, or customer data to train our AI models. Your content remains yours and is only processed to provide the Service to you.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With trusted third-party vendors who assist in operating our Service (e.g., cloud hosting, payment processing, analytics).
• Within Your Organization: With other members of your team or organization as configured in your account settings.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections.
• Legal Requirements: When required by law, legal process, or government request.
• Protection of Rights: To protect the rights, property, or safety of DeepLight, our users, or the public.
• With Your Consent: For any other purpose with your explicit consent.

5. Google API Services & Workspace Data

UpSight's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

• What we access: If you connect Google Workspace, we request send-only Gmail access (gmail.send) to send messages you compose and approve from your own address — we cannot and do not read your mailbox — and access to events on calendars you own (calendar.events.owned) to show your upcoming meetings and help you prepare for them.
• AI/ML — strictly no training: Google user data — raw, aggregated, or derived — is never used by us, and is never transferred to any third party, to create, train, or improve machine learning or artificial intelligence models, foundational or otherwise. Limited calendar fields (event title, start time, and attendee names) may be processed by the OpenAI API solely to generate your pre-meeting briefings; this is a paid API service whose terms prohibit training on customer API data. Gmail message content is never transmitted to any AI model — our Gmail access is send-only and cannot read messages.
• No advertising, no sale: Google user data is never sold and is never used for advertising purposes.
• Deletion: Disconnecting Google Workspace in Settings revokes our access and deletes the stored connection credentials.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account Information: Retained while your account is active and for a reasonable period after closure for legal and business purposes.
• Recordings and Transcripts: Retained according to your account settings. Default retention is 3 years, with options for shorter periods available.
• Usage Data: Retained for 24 months for analytics purposes.
• Deleted Content: Recoverable from trash for 30 days before permanent deletion.

Enterprise customers may configure custom retention policies. Upon account termination, you may request data export within 30 days.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information (subject to legal retention requirements).
• Portability: Request a machine-readable copy of your data.
• Objection: Object to certain processing of your information.
• Restriction: Request restriction of processing in certain circumstances.
• Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for the Service to function properly (e.g., authentication, security).
• Analytics Cookies: Help us understand how visitors interact with our Service to improve user experience.
• Preference Cookies: Remember your settings and preferences.

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

9. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Row-level security enforcing account and project isolation at the database layer
• Access controls and multi-factor authentication support
• Infrastructure hosted on providers with SOC 2 Type II certification (see our Security page)
• Ongoing security review and vulnerability management

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all subprocessors
• Compliance with applicable data protection frameworks

11. Recording Consent

If you use UpSight to record conversations, you are responsible for obtaining appropriate consent from all participants in accordance with applicable laws. Many jurisdictions require all-party consent for recording conversations. UpSight provides tools to help you obtain and document consent, but the legal responsibility remains with you.

12. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected and how it's used
• Right to delete personal information (with certain exceptions)
• Right to opt-out of the sale or sharing of personal information
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information as defined under CCPA/CPRA.

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on contract performance, legitimate interests, legal obligations, or your consent.
• Data Protection Authority: You have the right to lodge a complaint with your local supervisory authority.
• Data Protection Officer: You may contact our DPO at [email protected]

14. Children's Privacy

Our Service is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a person under 18, we will delete it promptly. If you believe we have collected such information, please contact us at [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we will provide additional notice via email or through the Service.

Your continued use of the Service after any changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: