1Data Controller

• Company Name: Spinlegacy Unipessoal LDA
• NIF: PT517378108
• Head Office: Aveiro, Portugal
• Email: client@upmlm.com

For the personal data of leads, team members and other people that users enter in the Platform, the user is the controller and we act as a processor on the user’s behalf, as set out in section 10 of the Terms and Conditions.

2Data We Collect

We collect the following data when you create an account:

• Name
• Email address

Additionally, when using the platform, the following optional or functional data may be stored:

• Contacts/leads you input
• Courses you create
• Messages you send via email/WhatsApp/SMS
• Network structures (upload or created manually)
• Planner tasks and notes

When you use the forms on our website, we collect the details you enter (such as name, email, phone and message) and a record of your consent, to reply to you or send you the information you requested. These requests are stored as leads in our own UpMLM account.

We do not collect sensitive personal data unless explicitly provided by you in the platform.

3How We Use Your Data

We use your data for the following purposes, each with its legal basis under the GDPR:

• Creating and running your account, plans and payments — performance of a contract
• Replying to your requests and sending the guide you asked for — your request and your consent
• Sending newsletters and onboarding emails — your consent, which you can withdraw at any time
• Website statistics and advertising measurement with cookies — your consent
• Protecting the website and its forms against spam and abuse (reCAPTCHA, security logs) — our legitimate interest in keeping the service secure
• Invoicing and accounting — legal obligation
• Improving the Platform with aggregated usage statistics that do not identify you — our legitimate interest

We do not sell or share your data with third parties for marketing purposes.

4Data Sharing

We do not sell your personal data or share it with third parties for their own marketing purposes. We only share it with the service providers (sub-processors) we need to run UpMLM and this website, under data processing agreements:

• Stripe — payment processing (Ireland and USA)
• OpenAI and Anthropic — AI features, as described in section 8 (USA)
• Amazon Web Services (Amazon SES) — sending emails, including replies to our website forms (EU)
• Google reCAPTCHA — protecting our website forms from spam and abuse (USA)
• Google Analytics — website statistics, only with your consent (see section 11) (USA)
• Meta (Facebook/Instagram), TikTok and Google Ads — measuring and personalizing our ads, only with your consent (see section 11) (USA and Ireland)

We may also disclose data when required by law.

5International Transfers

Our platform is based in the EU and complies with the GDPR. Some of the providers listed in section 4 are located, or process data, outside the European Economic Area, mainly in the USA. In those cases we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or on the Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of these safeguards at client@upmlm.com.

6Data Retention

We keep personal data only for as long as needed for each purpose:

• Account data: while your account is active, and deleted within 30 days after you delete it, unless the law requires us to keep it longer.
• Requests sent through our website forms: up to 2 years after our last contact with you.
• Newsletter and guide subscriptions: until you unsubscribe; the record of your consent is then kept for 3 years, as proof.
• Cookie choices: 12 months in your browser; the record of each choice is kept on our server for 3 years, as proof of consent.
• Invoices and accounting records: 10 years, as required by Portuguese law.
• Security logs: up to 12 months.

7Data Security

All data is stored securely in encrypted databases.

Access to your content is restricted to your account only.

8AI Features and Data Processing

UpMLM provides AI-powered features designed to assist Users in optimizing their network management, lead engagement, and content creation.

8.1. User-Initiated AI Assistance

When a User explicitly requests suggestions or analysis from the platform’s AI (e.g., for lead categorization, communication templates, or organizational insights), the Platform may process relevant content provided by the User—such as lead profiles, notes, and organizational activity. This processing is performed solely to generate the specific output requested by the User and to personalize the AI’s responses within that User’s organization.

8.2. What Is Sent to AI Providers

To generate a reply, a message or a course, the Platform sends the AI provider (OpenAI or Anthropic) only the content needed for that request — for example your business profile, a lead’s name, language and conversation history, and your instructions. These providers act as our sub-processors: they process the data only to return the result, do not use it to train their models, and keep it only for the limited period set in their terms, after which it is deleted.

This data is encrypted in transit and at rest. It is not anonymized when a feature needs it to work — for example, a lead’s name in a message.

8.3. Third-Party API Data Protection (Limited Use & Compliance)

UpMLM integrates with third-party services, including but not limited to Google, Meta (Facebook/Instagram), and LinkedIn, to provide automated messaging, lead synchronization, and social selling features.

a) Strict Data Separation: Our Platform strictly adheres to the specific developer data policies and “Limited Use” requirements of each provider. Any data obtained through these external APIs (such as email content, private messages, or contact lists) is processed exclusively to provide the specific user-facing features requested by the User (e.g., sending an email or syncing a lead).

b) No Generalized AI Training: We do not use personal or private data obtained from these third-party APIs (Google, Meta, or LinkedIn) to train, retrain, or improve generalized artificial intelligence or machine learning models.

c) Policy Adherence:

• For Google: We comply with the Google API Services User Data Policy.
• For Meta: We comply with the Meta Platform Terms and Developer Policies regarding data processing.
• For LinkedIn: We comply with the LinkedIn Data Processing Agreement and API Terms.

Any data transfer to third-party AI sub-processors (such as OpenAI or Anthropic) is strictly limited to the transient processing required to generate the User’s requested output and is governed by strict confidentiality agreements that prohibit the use of such data for the sub-processor’s own model training.

9Your Rights

You have the right to:

• Access your personal data and get a copy of it
• Correct inaccurate data
• Have your data deleted
• Restrict how we process it
• Receive your data in a portable format
• Object to processing based on our legitimate interest, and to direct marketing at any time
• Withdraw your consent at any time, without affecting the processing carried out before
• Lodge a complaint with a data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt)

To exercise your rights, contact us at: client@upmlm.com

We reply within one month. If your request concerns data that an UpMLM user entered about you (for example, as a lead), we forward it to that user, who is responsible for it, and help them respond.

10Updates to this Policy

We may update this Privacy Policy to reflect platform or legal changes. We will notify users via email or platform notification.

This policy is available in several languages. In case of any discrepancy, the Portuguese version prevails.

11Cookies and Similar Technologies

Our website uses cookies and similar technologies (such as local storage). You choose which optional categories to allow in the cookie banner, and you can change your choice at any time via “Cookie settings” in the website footer.

Essential (always on)

Remember your language and cookie choice, keep the website secure and protect our forms with Google reCAPTCHA. reCAPTCHA is loaded only when you use a form and processes technical data such as your IP address and browser information, under the Google Privacy Policy and Terms of Service.

Analytics (optional)

Google Analytics helps us understand, in aggregate, which pages are visited and how the website is used.

Marketing (optional)

Meta (Facebook/Instagram), TikTok and Google Ads help us measure our advertising and show relevant ads.

Optional cookies are only set after you give your consent. Refusing them does not affect your use of the website.

The full list of cookies, with their provider, purpose and duration, is in the table below.