Data Retention & Deletion Notice

This notice describes YupUp’s target retention periods. Actual retention may be shorter or longer based on account configuration, Merchant instructions, legal holds, disputes, security needs, backup cycles, and applicable law. “Deletion” may mean secure erasure, irreversible deidentification, or isolation until backup expiration.

Target retention periods

• Merchant account and configuration — Target period: Active term + 3 years. Notes: May retain contract and audit evidence longer.
• Contracts, orders, invoices, tax and accounting — Target period: 7 years. Notes: Or longer if legally required.
• SMS marketing consent and disclosure evidence — Target period: 5 years after last message or opt-out. Notes: Preserve exact disclosure and withdrawal evidence; counsel may adjust.
• Suppression / do-not-contact record — Target period: As long as needed to honor the request. Notes: Use minimal data, such as protected or hashed number where feasible.
• Message content — Target period: 90 days by default. Notes: Merchant may configure shorter; legal hold and abuse exceptions.
• Message metadata and delivery events — Target period: 2 years. Notes: Sender, recipient, template, timestamps, status, opt-out processing.
• Support records — Target period: 3 years after closure. Notes: Longer for disputes/security.
• Security and access logs — Target period: 12-24 months. Notes: Based on risk and system capability.
• Backups — Target period: Rolling 35 days. Notes: Deleted through normal rotation unless legal hold.
• Website analytics identifiers — Target period: Up to 13 months. Notes: Subject to consent and vendor configuration.
• Cookie consent records — Target period: Up to 5 years. Notes: To demonstrate preference history.
• Privacy requests — Target period: 3 years after closure. Notes: Verification and response evidence.
• Prospect marketing records — Target period: 2 years after last meaningful interaction. Notes: Earlier upon opt-out or deletion request where applicable.
• Employee/contractor records — Target period: Employment + 7 years. Notes: Local law and benefits may require more.

Account deletion

A Merchant may request deletion or export through the service or support. Before deleting an account, YupUp may verify authority, collect outstanding charges, preserve legally required records, maintain suppression evidence, and allow a limited recovery period. Merchant-directed data will be returned or deleted according to the Data Processing Addendum and Order Form.

Legal holds and exceptions

Records may be preserved for litigation, investigation, fraud prevention, safety, contractual claims, or legal duties. Access will be restricted and the hold reviewed periodically. Aggregated or deidentified information that cannot reasonably identify a person may be retained for analytics and service improvement.

Contact

Privacy: privacy@yupup.ai | Legal: legal@yupup.ai | Support: support@yupup.ai | Security: security@yupup.ai. Mailing address: YupUp, Inc., 41111 Mission Blvd, Suite #121, Fremont, CA 94539.