Privacy Policy

Last updated September 25, 2026

This Privacy Policy explains how UpSunday LLC, a Delaware limited liability company ("UpSunday", "we", "us" or "our") collects, uses and protects personal information when you visit upsunday.co (the "Site"), contact us or book a call. It also covers the business contact details of clients and suppliers we work with.

1. Who We Are

UpSunday is the data controller for the personal information described in this policy. This means we decide how and why it is used.

• Company: UpSunday LLC, a Delaware limited liability company
• Address: UpSunday LLC, c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA
• Email: project@upsunday.co

We are a small studio and haven't appointed a Data Protection Officer. Any privacy question goes straight to our founder.

2. Information We Collect

When you use the contact form

The form asks for different details depending on what you're reaching out about:

• Every message: your name, email address, your message and the topic you chose.
• Starting a project: your company name (optional) and the services you're interested in.
• Joining UpSunday: your role, a portfolio link (optional) and an optional PDF or MP4 file of up to 4MB.

Your submission is sent to our inbox as an email. The website doesn't store it in a database.

When you book a call

Our booking calendar is provided by Calendly. When you book, Calendly collects your name, email address, your chosen time and any answers you give to the booking questions, and shares them with us so we can hold the call. Calendly handles this data under its own privacy policy, and it also collects technical data about your visit to the calendar (see our Cookie Policy).

When you email, message or call us

If you email us, message us on WhatsApp or social media, or join a call, we receive whatever you choose to share, along with your contact details. WhatsApp and the social networks process those messages under their own privacy policies.

When you work with us

If you become a client or supplier, we keep the business contact details, agreements, project communications and files needed to deliver and administer the work.

Technical data

Like any website, the Site's hosting provider (Vercel) automatically processes technical data when you visit, such as your IP address, browser and device type, the page requested, the referring page and the time of the request. This data is used to deliver pages, keep the Site secure and fix problems. We don't use it to build a profile of you.

The Site stores a single item in your browser to remember your cookie choice. We don't use advertising cookies. We measure visits and page speed with Vercel Web Analytics, which is cookieless and doesn't identify you. If you accept cookies, we also use Google Analytics and Microsoft Clarity to understand how the Site is used, which process data such as pages viewed, clicks, scrolling, device and approximate location. Our Cookie Policy has the details.

We don't ask for sensitive information, such as health, financial account or government ID details. Please don't include it in messages or files you send us.

3. How We Use It and Why

We use personal information only for the purposes below. Where the EU or UK GDPR applies, each purpose relies on a legal basis:

• Replying to enquiries: Reading and answering your message, and preparing for a call you've booked. Legal basis: our legitimate interest in responding to people who contact us, or steps you've asked us to take before entering into a contract.
• Delivering projects: Running a project, communicating with you, invoicing and handing over work. Legal basis: performing our contract with you.
• Reviewing applications: Considering people who apply to work with us. Legal basis: steps taken at your request before any engagement, and our legitimate interest in building our team.
• Running the Site: Hosting, securing and fixing the Site, and preventing spam and abuse. Legal basis: our legitimate interest in a safe, working website.
• Keeping records: Accounting, tax and legal records. Legal basis: compliance with our legal obligations.
• Legal claims: Establishing, exercising or defending legal claims. Legal basis: our legitimate interests.

We won't add you to a mailing list or send you marketing just because you contacted us. We don't make decisions about you using only automated processing.

4. Who We Share It With

We don't sell personal information. We share it only with service providers that help us run the studio, and only as far as they need it to do their job:

• Vercel: Vercel Inc. hosts the Site and runs the contact form. United States.
• Resend: Resend delivers contact form submissions to our inbox. United States.
• Calendly: Calendly LLC runs our booking calendar. United States.
• Google Analytics: Google LLC provides site analytics, only if you accept cookies. United States.
• Microsoft Clarity: Microsoft Corporation provides usage analytics and session replays, only if you accept cookies. United States.
• Google Workspace: Google LLC hosts our business email (including project@upsunday.co), where contact form messages and replies are kept. United States.

We may also share information with professional advisers such as accountants and lawyers, with authorities where the law requires it, or with a buyer or successor if our business is ever sold or reorganized. In that case your information will remain protected by this policy.

5. International Transfers

UpSunday is based in the United States, and our providers mainly process data there. If you contact us from the EEA, the UK or Switzerland, your information will be transferred to the US. Where required, we rely on appropriate safeguards for those transfers, such as the EU–US Data Privacy Framework (and its UK and Swiss extensions) where a provider is certified, or the European Commission's Standard Contractual Clauses and the UK Addendum. Contact us if you'd like more detail.

6. How Long We Keep It

We keep personal information only for as long as we need it:

• Enquiries that don't become projects: up to 24 months after our last contact.
• Job and collaboration applications: up to 12 months, unless you ask us to keep them longer.
• Client and supplier records: for the length of the relationship, then as long as tax and accounting law requires, usually up to 7 years.
• Hosting logs: kept by Vercel for a short period under its own retention settings.

When a retention period ends, we delete the information or make it anonymous.

7. Keeping It Secure

The Site is served only over HTTPS. The contact form checks what it receives and filters out spam, and access to our inboxes and tools is limited to our team and protected with strong authentication. No system is completely secure, but if a breach ever affects your information, we'll notify you and the relevant authorities as the law requires.

8. Your Rights

Wherever you live, you can ask us to:

• Access: tell you what personal information we hold about you and give you a copy.
• Correction: fix information that's wrong or incomplete.
• Deletion: delete your information, unless we need to keep it for legal reasons.
• Portability: send you your information in a common, machine-readable format.
• Objection: stop using your information where we rely on legitimate interests.
• Restriction: pause our use of your information while a concern is being resolved.
• Withdrawal: withdraw any consent you've given, at any time.

EEA, UK and Swiss residents

These rights come from the GDPR, the UK GDPR and Swiss law. You can also complain to your local data protection authority, such as the Information Commissioner's Office in the UK, although we'd appreciate the chance to resolve your concern first.

California and other US states

Depending on where you live, laws such as the California Consumer Privacy Act (as amended by the CPRA) may give you rights over your personal information. Some of these laws only apply to larger businesses, but we offer the same rights to everyone. Over the past 12 months, we have collected identifiers and contact details, the content of your messages and bookings, professional information you choose to share, and internet or network activity data, all from the sources and for the purposes described above.

We don't sell personal information or share it for cross-context behavioral advertising, and we haven't done so in the past 12 months. We don't use sensitive personal information to infer characteristics about you. Because we don't sell or share, a Global Privacy Control signal has nothing to opt you out of on this Site. You can use an authorized agent to make a request for you, you can appeal a decision we make about your request, and we will never treat you differently for exercising your rights.

9. Making a Request

To exercise any of these rights, email project@upsunday.co. We may need to confirm your identity before we act, usually by replying from the address we have on file. We'll respond within one month, or within 45 days where US state law applies. If a request is complex, we may extend this as the law allows, and we'll tell you if we do.

10. Children

The Site is for businesses and professionals and isn't meant for anyone under 16. We don't knowingly collect personal information from children. If you think a child has sent us information, please contact us and we'll delete it.

11. Other Websites

The Site links to other services, including Calendly, WhatsApp, Instagram, LinkedIn and X. Their privacy practices are their own, so please read their policies when you use them.

12. Changes to This Policy

We'll update this policy when our practices change, for example if we add a new tool. The "Last updated" date at the top shows when it last changed. If a change is significant, we'll make it clear on the Site.

13. Contact

Questions about your privacy? Email project@upsunday.co or book a call. You can also write to us at UpSunday LLC, c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA.