Privacy Policy

Upholstr is operated by Kleopatra AS ("we", "us", "our"), a company registered in Norway under organisation number 923 888 071. Our registered address is Listuveien 15, 1359 Eiksmarka.

Kleopatra AS is the data controller ("behandlingsansvarlig") for the personal data described in this policy. If you have questions about this policy or wish to exercise any of your rights, contact us at privacy@upholstr.app.

We collect only what we need to provide the service:

• Account information — email address, name, and authentication credentials (via email/password or Google Sign-In)
• Work order data — furniture items, customer names, phone numbers, email addresses, descriptions, status updates, and photos you add to work orders
• Fabric inventory data — fabric names, quantities, labels, and AI-scanned label information
• Internal employee records — if your organisation's admin or owner adds internal employees for time-tracking purposes, we store their name. Internal employees do not have their own login and do not provide any data to us directly
• Device information — device model, operating system version, and app version, used for diagnostics
• Push notification tokens — issued by Apple or Google when you enable notifications, used only to deliver app notifications about your work orders
• Usage data — basic interaction data to help us improve the app

• To provide and improve the Upholstr service
• To authenticate you securely via Firebase Authentication
• To process payments for paid subscriptions, via Stripe
• To send transactional emails (invitations, notifications) via Resend
• To send push notifications about work order updates
• To scan and identify fabric labels using AI

We do not sell your personal data to third parties, ever.

We use a limited number of trusted third-party services to provide Upholstr:

• Firebase (Google) — authentication and database, hosted in the EU (europe-north1, Finland). See Google's Privacy Policy
• Google Sign-In — optional authentication method. See Google's Privacy Policy
• Stripe — payment processing for paid subscriptions. Stripe receives your billing address and payment details directly; we never see or store your full card number. Stripe is based in the United States and processes data under Standard Contractual Clauses for international data transfers. See Stripe's Privacy Policy
• Anthropic — when you use the fabric label scanning feature, the photo you take is sent to Anthropic's Claude AI API to read and interpret the label. Anthropic processes the image to return the result to Upholstr and does not permanently store it. See Anthropic's Privacy Policy
• Resend — transactional email delivery. See Resend's Privacy Policy
• Apple Push Notification service (APNs) — push notifications on iOS devices. See Apple's Privacy Policy
• Firebase Cloud Messaging (FCM) — push notifications on Android devices, provided by Google. See Google's Privacy Policy

Our database (Firestore) is hosted in the EU (europe-north1, Finland). Some of the background functions that power Upholstr — including payment processing and AI fabric label scanning — currently run on Google Cloud servers in the United States (us-central1) rather than in the EU. This is covered by our subprocessors' standard contractual clauses for international data transfers, and we are evaluating migrating these functions to an EU region in the future.

Your data is stored securely in Google Firebase Firestore, hosted in the EU (europe-north1 — Finland). All data is encrypted in transit (TLS) and at rest.

We process your data on the following bases:

• Contract — to provide the Upholstr service you signed up for
• Legitimate interest — to improve the app, fix bugs, and prevent misuse
• Consent — where required, such as for push notifications

Under EU/EEA data protection law (GDPR), you have the right to:

• Access a copy of your personal data
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority — in Norway, the Norwegian Data Protection Authority (Datatilsynet)

To exercise any of these rights, email us at privacy@upholstr.app.

We retain your data for as long as your account is active. You can permanently delete your own account at any time, without contacting us, from within the app under Settings → Danger Zone → Delete account. This requires you to type a confirmation phrase before it takes effect. If you're unable to access the app, you can also request deletion by emailing privacy@upholstr.app.

Deleting your account permanently and irreversibly removes your own membership and login from Upholstr. It does not delete your organisation's business data — jobs, customers, fabrics, and projects belong to your organisation's workspace and remain available to its other members.

Billing and accounting records (invoices, payment records) are kept for a minimum of 5 years regardless of account deletion, as required by the Norwegian Bookkeeping Act (bokføringsloven).

Upholstr does not use analytics, advertising, or tracking cookies on this website or in the app. We only use strictly necessary local storage (via Firebase Authentication) to keep you signed in — this is required for the service to function and isn't used to track you across other websites or apps.

Upholstr is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with data, please contact us and we will delete it promptly.

We use industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest. However, no method of electronic transmission or storage is 100% secure.

We may update this policy from time to time. If we make material changes, we will notify you via the app or by email. Continued use of Upholstr after changes constitutes acceptance of the updated policy.

privacy@upholstr.app