Privacy policy

Updated September 25, 2026

This policy describes Lup's information site, waitlist, and private pilot app, with email identification and controlled tests of Meta and Shopify connections. The project owner is Diego Guala. Contact: jjun.w.19@gmail.com.

What information we process

• When you visit this site: the hosting provider, Vercel, may process technical request information, such as your IP address, browser, requested path, and security logs. We do not add advertising analytics or tracking pixels.
• When you join the waitlist: we store the email address you submit and the time of submission in Supabase. We use it only to contact you about Lup invitations. Joining the waitlist does not create an account or grant access to the app. We do not send a confirmation email when you submit the form. You can ask us to remove your address at any time using the contact email below.
• When you identify yourself in the app: Supabase processes your email, access code, user identifier, and the information needed to manage and secure your session. The app uses session cookies required for access; they are not advertising tracking cookies. We store memberships and roles that determine which Workspace you can access. Creating a personal identity does not grant access to a Workspace or its accounts.
• If you write to us: your email, message content, and the data you provide so we can respond.
• In authorized Meta tests: identifiers and names of accessible ad accounts, the identifier of the user authorizing the connection, permissions and authorization expiration, the selected account, and queried campaign and ad data. We store the Meta token encrypted on server storage and records needed to check connection attempts and revocations. The token is used on the server for queries and is not sent to the browser. Scope depends on the permissions granted and the resources you can access.
• When connecting Shopify: we query products, variants, prices, images, and their metadata with read permission. We store the store domain, its Workspace, permissions, expiration times, and encrypted access and renewal tokens on the server. The catalog is queried live; we do not store persistent copies of products or images. We do not request orders, customers, or permissions to modify the catalog.

The information site does not request passwords or tokens and does not let you connect an account. In the pilot app, identification uses a code sent by email with Supabase. Only an Owner of an enabled Workspace can authorize its Meta connection, select an account, or disconnect it; authorized Members can query available data. Visitors cannot connect accounts openly.

An active Owner connects Shopify so Workspace Members can query the catalog and store images. Shopify processes authorization and queries. Uninstall and privacy notices are validated on the server; we do not retain customer data payloads. Disconnecting Shopify removes local tokens and cancels pending attempts. Uninstalling Lup in Shopify also revokes access there.

How we use information

We use information to manage the waitlist and send invitations, respond to questions, manage identities and sessions, control Workspace access, maintain security, and verify the integration by querying accounts, campaigns, and ads. This pilot does not create or activate advertising or change budgets. Technical permissions do not equal unlimited authorization to publish or spend. We do not sell personal data or use Meta data for purposes unrelated to these features.

Who we share with

Meta processes authorization and queries sent to its platform. Vercel hosts the site and app. Supabase provides authentication and stores waitlist addresses, identities, memberships, encrypted connections, and pilot control logs. Access email is delivered through the mail service configured for Supabase Auth. The contact email provider processes correspondence you send us. These providers may process information in other countries under their terms and applicable safeguards. We do not publish tokens or private account information on this site.

Future AI generation and automation features are not offered by this site. Before adding new data uses or providers to tests, we will update the relevant information and request authorization when appropriate.

Retention and security

We retain information under our control only as long as needed for authorized testing or to handle your request. When that purpose ends or we receive a valid request, we delete data that is no longer needed, except information that must be retained by law or to resolve a security incident. If an exception applies, we will explain its reason and scope. Records managed by providers are subject to their own retention policies.

Pilot access is checked through session, membership, and role. Meta tokens are encrypted and queries happen on the server. Disconnecting Meta removes the local credential and pending attempts for that Workspace; it does not remove the access identity, other retained data, or Lup's global permission in Meta. Credentials and access codes must not be shared by email or included in public resources.

Your choices and rights

You can request information about your data, access, correction, or deletion, and withdraw your authorization by writing to jjun.w.19@gmail.com. We will verify your relationship to the account with the minimum necessary information. You can also revoke Lup's access from Meta's app settings or business integrations.

See the instructions for deleting your data. Revoking access alone does not delete existing copies or pause Meta ads. This policy does not limit rights granted to you by applicable law.

Changes and contact

We will publish changes on this page with their update date. We will communicate material changes to test participants when appropriate. For questions: jjun.w.19@gmail.com.