Privacy Policy

Upbeat Sales (“Upbeat”, “we”) is an SMS follow-up tool for booking-driven businesses — gyms, yoga studios, music schools, salons, tutoring, coaching, and similar. We're the “controller” of data your business provides to us and the “processor” of data about your leads that you push into our system.

From your school's account:

• Account details: email address, password (hashed), organization name, timezone.
• Billing: a Stripe customer ID and subscription status. We do not store credit-card numbers.
• Integration credentials: API keys for services you connect (e.g., Quo, Mindbody, Klaviyo). Stored encrypted at rest.
• Settings you fill in: your school description, trial pricing, voice/tone guidance, sales funnel notes.

About your leads (people who inquire about your school):

• Name, phone number, and email address (whatever your contact form, CRM, or CSV import provides).
• Conversation history: SMS messages we send on your behalf and replies received.
• Stage transitions and notes you record manually.
• Limited metadata for analytics: when leads were created, when they converted, what source they came from.

• To run the service you signed up for: drafting and sending SMS messages, evaluating which leads to follow up with, showing you analytics.
• To process payments for your subscription.
• To diagnose problems and improve the product.
• To send you account-related emails (sign-in confirmations, billing, important account notices).

We do not sell your data, your leads' data, or message content. We do not show ads.

Upbeat lets you create an account and sign in using your Google account. When you choose “Sign in with Google”, Google shares the following information with us, with your consent:

• Your email address.
• Your basic profile information: full name and profile picture URL.
• A stable Google account identifier (used internally to recognize you on return visits).

We use this information only to:

• Authenticate you and create or unlock your Upbeat account.
• Display your name and profile picture inside the Upbeat dashboard.
• Send you account-related email (sign-in confirmations, billing, account notices) at the address you signed up with.

We do not request access to your Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service. We use only the basic openid, email, and profile scopes. We do not sell, rent, or share your Google profile data with third parties for advertising, and we do not use it to train machine-learning models.

Google profile data is stored alongside your other Upbeat account data and follows the same retention rules described in “Data retention” below: it is deleted within 30 days of account closure. You can disconnect Google sign-in at any time by revoking access in your Google Account permissions page or by deleting your Upbeat account from /dashboard/settings.

Upbeat's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Upbeat is built on top of services that process data on our behalf. Each is contractually bound to use that data only to provide service to us:

• Supabase — authentication and database hosting.
• Stripe — payment processing and subscription billing.
• Quo (OpenPhone) — SMS delivery and message history.
• Anthropic — large-language-model inference for drafting SMS messages. Lead and conversation context is sent at evaluation time; Anthropic does not retain inputs to train on per their API terms.
• Resend — transactional email delivery.
• Klaviyo — only when your business chooses to connect Klaviyo. Lead profiles are pushed to your Klaviyo account; we do not share data across customers.
• Vercel — application hosting and CDN.
• PostHog — product analytics. Receives pageview and event data from your sessions when you use upbeatsales.com (the marketing site and dashboard). See "Analytics and advertising" below.
• Meta (Facebook) — advertising conversion tracking via the Meta Pixel on our marketing pages. See "Analytics and advertising" below.
• Google — Google Analytics 4 for site measurement and Google Ads for advertising conversion tracking, both loaded via the Google tag on our pages. See "Analytics and advertising" below.

We use a small number of third-party tools to measure how people find and use Upbeat:

• PostHog — product analytics covering page views, button clicks, signup completion, and which features get used after signup. PostHog assigns an anonymous identifier (stored in a cookie and localStorage) on your first visit; once you create an Upbeat account, that identifier is tied to your user ID so we can measure the full visit-to-signup-to-active-customer funnel. PostHog is used for product improvement and is not shared with advertisers.
• Meta Pixel — Meta's advertising conversion tracker, loaded on our marketing and signup pages. It records page views and signup completions so we can measure the return on Meta (Facebook/Instagram) ad spend and optimize ad targeting. The pixel uses cookies and sends data to Meta. If you signed up from a Meta ad, Meta will associate your signup with that ad campaign.
• Google Analytics 4 — site measurement covering page views and the same product events described above, used to understand which channels and pages bring people to Upbeat. It uses cookies and sends data to Google.
• Google Ads — advertising conversion tracking, loaded by the same Google tag as Analytics. It records signup and checkout events so we can measure the return on Google ad spend. If you arrived from a Google ad, we store that ad's click identifier with your organization record and, if you later become a paying customer, report that conversion and its value back to Google so the ad account can be measured against real revenue. To improve matching when cookies are unavailable, a one-way cryptographic hash of your email address may be sent with a conversion; the address itself is never sent.
• Core Web Vitals — a sample of page-performance measurements (load time, responsiveness, layout stability) recorded with the page path, so we can find and fix slow pages. These carry no personal data.

None of these tools is used to read message content, lead data, or anything inside your dashboard beyond the events we explicitly fire (pageviews, signup completion, and feature usage). If you'd prefer not to be tracked, browser-level controls like Do Not Track, content blockers (uBlock Origin, etc.), or Meta's own opt-out at facebook.com/help/568137493302217 will prevent collection without affecting Upbeat's functionality. Google's own opt-out is available at tools.google.com/dlpage/gaoptout.

We do not record your screen. No session-replay or screen-recording tool is enabled on Upbeat.

• Your account, leads, messages, and analytics persist until you delete them or close the account.
• Closing the account deletes the organization and all dependent records (leads, messages, integrations) within 30 days. Authentication identity is preserved separately so you can sign back in.
• Logs that include identifiers (e.g., HTTP access logs) are retained for up to 30 days for security and debugging, then rotated out.

You can access, correct, export, or delete your account data at any time from /dashboard/settings. You can disconnect third-party integrations at any time from /dashboard/integrations — credentials are removed when you disconnect.

For requests we can't self-serve, email support@upbeatsales.com. We respond within 30 days.

All data is encrypted in transit (TLS) and at rest. Integration credentials are encrypted with a per-installation key before being written to the database. Tenant isolation is enforced at the database layer via row-level security — your data is never queryable by another customer's session.

Your leads are people who contact your business. You're responsible for ensuring you have a lawful basis to message them (e.g., they filled out your contact form, booked through a tool you connected to Upbeat, or are existing customers). Upbeat enforces some technical guardrails — STOP-keyword opt-outs, quiet hours (9pm–9am local), 8-hour frequency caps — but the legal obligation to message responsibly stays with you.

Upbeat is not intended for users under 18. Business owners do not create Upbeat accounts on behalf of children; only adult inquirers (or parents/guardians on behalf of children) are messaged.

When we change this page we update the “Last updated” date at the top. Material changes are also announced via email to the school owner.

Questions, requests, or concerns: support@upbeatsales.com.