Who is responsible for your data, what we store when you visit, send a case, or write to us, which providers process it, and your rights.
The controller for the personal data described here is Florin-Bogdan Alexe, trading as Upglider, Bonn, Germany, reachable at [email protected]. This notice covers the website upglider.com, customer accounts and cases, the contact form, and the blog. The General Data Protection Regulation (GDPR) applies.
When you open a page, the web server records the requested address, the date and time, the status of the request, the amount of data sent, your IP address, and the browser identification your device sends. We use this to deliver the pages, keep the service secure, and investigate faults, on the basis of our legitimate interest in a working and secure website (Article 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest.
To learn which parts of a page are used and where visitors give up, our own server also records page views, clicks (the element and the position within it), how far a page was scrolled, and the steps taken towards sending a case, together with the page address, the referring site and any campaign tags in the link you followed, the screen size and device class, and a random number that changes with every browser tab. To count visitors rather than tabs, the server derives a short code from your IP address, your browser’s identification string and a secret that is replaced every day and then discarded, so the code cannot be traced back or linked from one day to the next. No cookie is set for this, no identifier outlives the day, and the IP address itself is not stored with these records; nothing is shared with anyone. This is our legitimate interest in understanding and improving the site (Article 6(1)(f) GDPR). The records are deleted after 90 days.
The site is served through Cloudflare, which sits in front of our server to protect it and speed up delivery, and is hosted on a server operated by OVHcloud. Both are listed under service providers below.
We use no analytics cookies. Google Ads measurement cookies are optional and are enabled only when you choose “Allow”. You can reject them just as easily and change your choice through “Cookie settings” in the footer. The following cookies are necessary to provide the site or remember a choice you explicitly made (§ 25(2) TDDDG):
Your browser's local storage remembers when that offer was last shown and whether you took it, so we do not show it again for at least 56 hours, or ever again once you have taken it. It contains no identifying data.
When you follow a sign-in link from checkout, your campaign selection and the details you typed are kept in your browser tab’s session storage for up to 30 minutes so you can resume; the password is never included, and the copy is removed when you return or close the tab. When you answer “Not now” to remembering a partner link, that answer is kept in the same session storage so we do not ask again in that tab.
We use Google Ads, provided in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure whether our ads lead to a submitted case. This is a request for review, not a completed purchase. Google's tag runs in Advanced Consent Mode on our live website.
Before you choose, and if you reject, advertising storage and advertising user-data consent remain denied. The tag sends limited cookieless measurement signals, rather than reading or writing advertising cookies, so Google can model conversions. These requests disclose connection information, including your IP address, to Google and may include the page address, timestamp, browser information, and consent state. Cookieless measurement is not the same as no data transmission. We rely on our legitimate interest in measuring our advertising (Article 6(1)(f) GDPR) for this limited processing; you have the right to object.
If you choose “Allow”, we grant advertising storage and advertising user-data consent for measurement (Article 6(1)(a) GDPR and § 25(1) TDDDG). Google may then store first-party _gcl_* cookies to connect ad clicks with conversions, typically for up to 90 days. Ad personalisation and analytics storage remain denied. We do not enable enhanced conversions or send your name, email, billing details, listing, or keywords as conversion fields. A case conversion contains its number, campaign price, and USD currency.
Choosing “Reject” in Cookie settings withdraws cookie consent for future measurement and removes accessible first-party Google Ads cookies. Earlier processing is unaffected, and limited cookieless measurement continues. Google may process data outside the EEA, including in the United States, under applicable transfer safeguards such as the EU-US Data Privacy Framework and standard contractual clauses. See Google's privacy policy and Google's business data information for its processing and retention practices.
When you create an account we store your name, email address, and a salted hash of your password. When you send a case we add the campaign length, the public Etsy listing link, your keywords, any note you write, your billing name and address, your preferred payment method, and every status update, note, and screenshot we post to the case. We also record the version of the campaign terms you accepted, when you accepted them, and when you confirmed that you order as a business.
We use this data to assess the case, run the campaign, communicate with you in your dashboard, and issue refunds, on the basis of the contract with you or the steps leading to it (Article 6(1)(b) GDPR). Billing records are also kept to meet tax and accounting duties (Article 6(1)(c) GDPR). Sign-in, sign-up, checkout, and contact submissions are throttled per email address and per IP address to protect the service (Article 6(1)(f) GDPR); those counters live in memory for a short time and are not stored.
Providing your name, email address, listing link, keywords, and billing details is necessary to assess and run a campaign. Without them we cannot accept a case.
Some customers arrive through a partner link such as upglider.com/go/code, or type a referral code at checkout. The code travels in the page address and in the form you submit. It is stored in your browser only if you click “Remember” on a partner link, in the cookie described above. When you create an account, sign in, or send a case with a valid code, we record which partner referred you and when, and we keep that with your account for 12 months of attribution and as part of the billing record afterwards. We use it to calculate and pay the partner's commission (Article 6(1)(b) and (f) GDPR).
When a partner link is opened, we add one to that day's counter for the partner and the link. The counter records nothing about you: no address, browser, or time of day.
Partners see only that a campaign was paid, its length, the date, and their commission. They never see your name, email address, shop, listing, or keywords. If you apply to the partner programme yourself, we store your description of your audience, your payout details, the version of the partner terms you accepted, and the ledger of commissions and payouts, on the basis of the partner agreement (Article 6(1)(b) GDPR) and tax law (Article 6(1)(c) GDPR).
We never see or store card numbers. Card, Apple Pay, and Google Pay payments are made on a payment page run by Whop, Inc., which collects your payment details under its own privacy policy and acts as an independent controller for that data. We receive a confirmation of the payment and the reference you give us.
Some work is paid through a payment link we send you (an address starting with upglider.com/pay/). The checkout there is the same Whop payment page. From Whop we receive your name, email address, billing address, and the payment's amount, status, and reference, which we keep as a client and billing record and use to issue and email your invoice (Article 6(1)(b) and (c) GDPR). When a payment link pays for a ranking campaign, we also open a customer account for you under that email address, with the campaign as a case in it, so you can follow its progress; we give you the login ourselves, and nothing is emailed to you automatically. Other payment links create no account. Payment pages are excluded from our own usage analytics, so your link is never recorded there.
For bank transfers we see what your bank shows us, usually your name, account identifier, and reference. For crypto we see the transaction on the public chain. We keep these details with the case as part of the billing record.
The contact form sends your name, email address, and message as an email to our mailbox so that we can answer you (Article 6(1)(b) or (f) GDPR). The mailbox is hosted by Zoho Mail on servers in the European Union. Messages are kept until your request is dealt with and any follow-up is complete, unless they belong to a case, in which case the case retention applies. Messages are never used for marketing or added to a newsletter.
These companies process data on our behalf or receive it to provide their service:
Beyond these, we share data only where the law requires it, for example with tax authorities or our tax adviser for billing records. We do not sell personal data.
Connections are encrypted with TLS. Passwords are stored only as salted scrypt hashes, and session tokens only as hashes. The database is reachable only from the application server. Daily backups of the database are kept for 14 days.
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict its processing, and to receive it in a portable format (Articles 15 to 20 GDPR). Where processing is based on consent, you can withdraw consent at any time without affecting earlier processing.
To exercise a right, email [email protected] from the address on your account. To delete your account, send the request the same way; we delete everything that is not subject to a retention duty and tell you what remains and for how long. You also have the right to complain to a supervisory authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de); you may also contact the authority where you live.
Where we process your data on the basis of our legitimate interests, which covers server logs, throttling, and answering enquiries, you have the right to object at any time for reasons arising from your particular situation (Article 21 GDPR). We then stop that processing unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise, or defend legal claims. Send an objection to [email protected].
We make no automated decisions about you and do not use personalised advertising. There are no third-party advertising placements on the site. Google receives the measurement data described above. The service is for adults running an Etsy shop; we do not knowingly process data of anyone under 18. Changes to this notice are published on this page with a new date; the campaign terms carry the version you accepted.