Privacy Policy

Who we are

Upscela is a sole proprietorship owned and operated by Sumit Sharma, in India. You can reach us at info@upscela.com, and our address and phone number are on the contact page. In this policy "we", "us" and "Upscela" mean that business, and "you" means the person using the site.

This policy explains what we collect, why, how long we keep it and what you can ask us to do about it. It is written to be read, not to be survived.

What we collect

Your email address and a password. The address identifies your account and is where verification links, password links, and receipts and notices about what you have bought are sent. The password is never stored: what we keep is a one-way hash of it, so a stolen copy of our database cannot be turned back into your password and cannot be used to sign in as you.

The images you upload, the prompts you type, and the results. Held only as long as your plan says, then deleted automatically, file names and prompts with them.

What you bought and what you spent. Every credit movement is recorded so your balance can be explained. We need this for our own accounts and to answer a billing question.

Basic technical information that any web server sees: your IP address and the requests you make. We use it to keep the service up and to stop abuse, such as one address creating a hundred accounts for the free credits.

How you found us. The site that sent you here, or the campaign named in the link you followed, and the first page you opened. If you create an account it is kept with the account. It tells us which of our own efforts are working, and it stays with us.

We do not collect your name, your phone number, your location or your date of birth. We have not asked you for them and we do not want them.

We never see your card

Payments are handled by a licensed payment gateway. Your card number, CVV, UPI PIN and bank credentials go to them directly and never reach our servers. We receive only the fact that a payment succeeded and a reference for it.

What happens to your images

Your image is uploaded, queued, processed and returned to you. To perform the upscale we send it to specialist third-party processing providers who act on our instructions and are bound by contract to use it for nothing else.

We do not train anything on your images. We do not sell them, publish them or show them to other customers. One account cannot see another account's files: every request is checked against the account that made it.

Files are deleted automatically when their retention window ends, which depends on your plan: Free 3 days, Starter 1 week, Pro 15 days and Max 30 days. You can delete any job yourself before then, and doing so removes the files with it.

Every sample on our portfolio is our own test image. No customer's picture has ever appeared there and none ever will.

Why we are allowed to hold it

We hold your address, your password hash and your files because we cannot provide the service you asked for without them. We hold your credit and purchase history because we are required to keep records of what we sold. We hold technical logs because we have a legitimate interest in keeping the service working and in preventing abuse.

We do not run advertising, we do not profile you, and we do not sell or share your data with anybody for their own purposes.

Cookies

Our own first. One keeps you signed in for 90 days from your last visit, so that you are not asked to sign in again every time you come back. It is HttpOnly, which means no JavaScript on the page can read it. Two last ten minutes and exist only while you sign in with Google: one so that the answer coming back is the one you asked for, and one so that you land on the page you left. One remembers which half of the Generate tab you left open. Your browser also keeps a note of a finished batch you have cleared, so that it is not shown to you again.

One more remembers how you first found us, as described under What we collect. It lasts ninety days and is sent to this site and nowhere else. A browser that sends the Global Privacy Control signal is not given it.

While you are signed out the page loads Google's own sign-in script, which is what lets it offer Sign in with Google, and Google can see that request. If you sign in that way, Google tells us your email address and that it is verified, and that is all we take from it.

There are no advertising cookies on this site, and no outside measurement service is running on it.

Your chosen language is part of the web address rather than a cookie, which is why a translated page can be bookmarked and shared.

What you can ask for

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write from the address on the account and we will close it, which removes your address, your files and your session. We keep the minimum record of transactions that the law requires us to keep.

Write to info@upscela.com and we will answer within three to four business days. If you are unhappy with how we have handled a request, tell us first and give us a chance to put it right.

How it is protected

Passwords are hashed with PBKDF2-SHA256 and a value unique to each account. Session cookies and the links in our emails are random tokens of which we store only a hash, so even our own database cannot reproduce them. Traffic is served over HTTPS.

No system is perfect. If something goes wrong that affects you, we will tell you rather than hope you do not notice.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. If a change is significant we will put a notice on the site, so you are not the last to know.