Privacy Policy

1. Introduction

This Privacy Policy explains how Events Bubble LLC ("Company", "we", "us", or "our") collects, uses, and protects information when you use the UpAndUp platform ("Service"). We are committed to protecting the privacy of both employers (account holders) and candidates who take assessments through the Service.

2. Data We Collect

Employer Data

• Account information: name, email address, company name, password (hashed).
• Billing information: processed and stored by Stripe (we do not store card numbers).
• Assessment content: questions, test configurations, and organizational settings.
• Usage data: feature usage, login history, and platform interactions.

Candidate Data

When candidates take assessments, the following data may be collected depending on test configuration:

• Registration information: name and email address.
• Assessment responses: answers to all question types (multiple choice selections, open text responses, typing test input).
• Video recordings: webcam footage during invigilated assessments.
• Screen recordings: screen share footage during proctored tests.
• Voice data: audio recordings and AI-generated transcripts from AI voice call interviews.
• Typing data: keystroke timing, speed, and accuracy metrics.
• Invigilation data: tab switch counts, fullscreen exit events, and timing information.

3. How We Use Data

• To provide and operate the assessment platform.
• To process payments and manage subscriptions.
• To generate AI-powered assessment questions and scoring.
• To conduct AI voice call interviews.
• To send transactional emails (account setup, test invitations, results).
• To improve the Service and develop new features.
• To enforce our Terms of Service and prevent abuse.

4. Third-Party Services

We use the following third-party services to operate the platform:

5. AI Processing Disclosure

We use OpenAI's GPT-4o-mini model for AI-powered features including question generation, response scoring, and voice call interviews. When using these features:

• Assessment content and candidate responses are sent to OpenAI for processing.
• OpenAI processes this data according to their API data usage policies.
• AI-generated scores are advisory and should be reviewed by a human.
• Voice call audio is processed in real-time and transcribed for scoring purposes.

6. Video Data Storage & Retention

Video and screen recordings are stored on Cloudflare R2 infrastructure. Recordings are retained for as long as the associated assessment submission exists. Employers may request deletion of specific recordings at any time. Upon account termination, all recordings are deleted within 30 days.

7. Cookies

We use essential session cookies required for authentication (Supabase auth tokens), which are strictly necessary and do not require consent. We also use optional analytics cookies (Google Analytics) and advertising cookies (Google Ads) to understand usage patterns and measure advertising effectiveness. These optional cookies are only set after you provide consent via our cookie banner. You can change your cookie preferences at any time — see our Cookie Policy for full details.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest.
• Row-level security policies in our database.
• Rate limiting to prevent abuse.
• Secure password hashing.
• Regular security reviews of our infrastructure.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access your personal data.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing of your data.
• Request data portability.

To exercise these rights, contact us at hello@upandup.tech. Candidates should contact the employer who administered the assessment, as the employer is the data controller for candidate assessment data.

10. Children's Privacy

The Service is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.

11. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to such transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact

If you have questions about this Privacy Policy, please contact us:

Events Bubble LLC
Email: hello@upandup.tech