Cookie, Google API, DPA & Security Policies
Last updated: May 31, 2026. This single document combines UpRender's Cookie Policy, Google API Limited Use Disclosure, AI processing notice, Data Processing Addendum, Subprocessor List, Data Retention and Deletion Policy, Security Policy, Acceptable Use Policy, Support/SLA terms, and Responsible Disclosure Policy.
Plain-English Summary
Necessary cookies run by default. Analytics, marketing, and similar non-essential cookies load only after consent where required.
Google Search Console and Google Analytics data is used only to provide customer-facing UpRender features and comply with user instructions.
AI audits, metadata suggestions, schema generation, and llms.txt generation support your website optimization. Outputs require customer review.
For customer website content, logs, proxy events, and integration data, UpRender generally acts as a processor/service provider.
We use vetted infrastructure, payment, analytics, support, monitoring, security, and optional AI vendors to operate the service.
We use administrative, technical, and organizational controls, but customers remain responsible for their own domains, DNS, proxy rules, and backups.
This summary is for convenience only. The detailed terms below control if there is a conflict.
Scope and Order of Control
This Compliance Addendum supplements the UpRender Privacy Policy, Terms of Service, Refund Policy, order forms, product documentation, and any separately signed enterprise agreement. It applies to UpRender's website, dashboard, APIs, bot rendering infrastructure, proxy/middleware setup guidance, Google integrations, analytics, AI audit tools, sitemap tools, llms.txt tools, support communications, and security processes.
If a signed enterprise agreement conflicts with this public document, the signed agreement controls for that enterprise customer. If this document conflicts with the Privacy Policy for privacy disclosures, the more privacy-protective term controls.
Customer authority. You must connect only domains, Search Console properties, Analytics properties, content, sitemaps, proxy rules, DNS settings, API credentials, and website data that you own or are legally authorized to manage.
Google API Services and Limited Use Disclosure
UpRender may allow customers to connect Google Search Console, Google Analytics, and related Google API Services to check indexing issues, view search and analytics performance, inspect eligible URLs, submit or manage sitemaps, compare bot-rendering performance with search visibility, and support AI Visibility workflows.
Limited Use commitments
Google API Limited Use. UpRender's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We do not sell Google user data.
- We do not use Google user data for advertising, retargeting, creditworthiness, lending, or unrelated profiling.
- We do not use Google user data to train, fine-tune, or improve generalized AI or machine learning models.
- We transfer Google user data only as necessary to provide customer-facing UpRender features, comply with law, protect security, or with the customer's consent.
- We allow human access to Google user data only when necessary for support, security investigation, legal compliance, or abuse prevention.
Disconnecting Google integrations
Customers may disconnect Google integrations from the UpRender dashboard or by revoking access in their Google account. After disconnection, UpRender will stop new API collection and delete retained integration data according to this document and the Privacy Policy.
AI Audits, Metadata, Schema, Sitemap, and llms.txt Processing
UpRender may use automated analysis and AI-assisted systems to audit pages, score AI visibility, identify missing metadata, suggest or generate titles, descriptions, headings, JSON-LD schema, canonical tags, Open Graph fields, sitemap entries, llms.txt content, topic clusters, and other crawler-facing improvements.
Customer review required
AI outputs may be incomplete, inaccurate, unsuitable for a specific industry, inconsistent with brand guidelines, or legally inappropriate if published without review. Customers are responsible for reviewing, approving, testing, and deploying all generated metadata, schema, llms.txt files, sitemap changes, proxy rules, and rendered HTML behavior.
No ranking or citation guarantees
UpRender may improve crawler readability and provide observability, but does not guarantee search ranking, indexing, traffic, AI citations, inclusion in AI-generated responses, conversion performance, revenue, or compliance with every search engine or AI crawler policy.
Data Processing Addendum
This Data Processing Addendum applies when UpRender processes personal data on behalf of a customer in connection with the services. For that processing, the customer is the controller/business, and UpRender is the processor/service provider or subprocessor.
Processing details
| Item | Description |
|---|---|
| Subject matter | Bot-rendering, proxy, crawler-ready HTML, cache, analytics, AI visibility, sitemap, llms.txt, Google integration, support, billing, and security services. |
| Duration | For the subscription term and any post-termination retention period needed for deletion, export, legal, security, billing, backup, or audit obligations. |
| Nature of processing | Collection, transmission, storage, caching, rendering, analysis, indexing diagnostics, API retrieval, aggregation, display, deletion, de-identification, and backup. |
| Data subjects | Customer administrators, end users if included in website content, website visitors captured in bot/request logs, Google account users, support contacts, billing contacts. |
| Data categories | Account data, contact data, login data, OAuth tokens, domain data, website URLs, page content, rendered HTML, metadata, proxy logs, bot user agents, IP addresses, cache events, performance metrics, support content, invoice data, and integration data. |
International transfers
Where personal data is transferred internationally, UpRender will use legally recognized transfer mechanisms where required, such as adequacy decisions, Standard Contractual Clauses, UK transfer mechanisms, contractual safeguards, or other lawful transfer tools.
Subprocessor List
UpRender may use subprocessors to provide infrastructure, hosting, storage, rendering, caching, payment, email, support, analytics, monitoring, security, AI-assisted features, and Google integrations.
| Category | Purpose | Status |
|---|---|---|
| Cloud hosting / compute | Application hosting, APIs, dashboards, rendering workers, queues, storage, backups. | Required |
| CDN / edge / DNS | Edge delivery, caching, WAF, bot routing, traffic performance, TLS, abuse mitigation. | Required |
| Database / object storage | Persistent storage, logs, configuration, audit trail, rendered snapshots, backups. | Required |
| Payment processor | Subscription billing, invoices, fraud prevention, payment authorization, tax handling. | Required for paid plans |
| Email / notification | Transactional email, security alerts, support notices, billing notices, onboarding messages. | Required |
| Monitoring / observability | Application logs, errors, uptime monitoring, security events, diagnostics. | Required |
| AI provider | AI audits, metadata suggestions, schema suggestions, llms.txt generation, content summarization. | Optional / feature-based |
| Google LLC | Customer-authorized Google Search Console, Google Analytics, OAuth, sitemap, URL inspection, reCAPTCHA services. | Optional / customer-connected |
Data Retention and Deletion Policy
UpRender keeps data only as long as reasonably necessary for the purposes described in this document, customer settings, the Privacy Policy, legal obligations, billing, security, backups, dispute resolution, and abuse prevention.
| Data Type | Default Retention |
|---|---|
| Account and workspace data | For the account term plus a reasonable post-termination period. |
| Domain configuration | For as long as the domain remains connected. |
| Rendered HTML cache | According to plan cache settings, route TTLs, purge actions, and operational needs. |
| Bot request logs | Plan-dependent and configurable where available. |
| Google OAuth tokens | Until integration is disconnected, token expires, access is revoked, or account is deleted. |
| AI audit results | For the account term or until customer deletes the project/domain/version. |
| Billing and tax records | As required by accounting, tax, payment, fraud, and legal obligations. |
UpRender is not your backup system. Customers are responsible for maintaining independent backups of their websites, source code, data, DNS settings, proxy rules, sitemaps, metadata, llms.txt files, analytics exports, and business-critical content.
Security Policy and Technical & Organizational Measures
UpRender uses administrative, technical, and organizational measures designed to protect customer data, Google integration data, rendered HTML, request logs, cached content, OAuth tokens, and account information. Security is a shared responsibility.
Role-based access, least privilege, administrative access review, and account authentication controls.
TLS for data in transit and encryption at rest where supported by infrastructure providers.
Restricted handling of API keys, OAuth tokens, service credentials, webhook secrets, and environment variables.
Security, audit, application, error, render, cache, and access logs to support monitoring and investigation.
Dependency updates, risk-based patching, code review, and remediation tracking based on severity.
Investigation, containment, remediation, customer notification where required, and post-incident improvement.
Customer security responsibilities
- Use strong passwords, MFA where available, and least-privilege user access.
- Keep DNS, CDN, Nginx, middleware, edge functions, server configuration, and API keys secure.
- Verify that proxy rules serve accurate rendered content and do not expose private routes.
- Protect Google accounts and properties connected to UpRender.
- Promptly report suspected security issues to [email protected].
Acceptable Use Policy
Customers must use UpRender lawfully, safely, and in a way that does not harm UpRender, other customers, crawlers, search engines, AI systems, third parties, or the public internet. Prohibited uses include:
- Connecting domains, Google properties, APIs, or content you do not own or lack authority to manage.
- Using UpRender for phishing, malware, spam, credential theft, fraud, impersonation, or deceptive activity.
- Serving materially misleading, hidden, illegal, or deceptive content to bots or search engines.
- Using bot rendering for cloaking, search manipulation, fake reviews, doorway pages, or malicious redirects.
- Rendering or caching private, authenticated, paywalled, or sensitive data for crawlers without proper authority.
- Attempting to scan, overload, disrupt, reverse engineer, scrape, or bypass UpRender systems without written authorization.
- Exceeding quotas, rate limits, fair-use limits, cache limits, or support boundaries.
SLA and Support Policy
| Plan | Support Target | Scope |
|---|---|---|
| Free | Best effort | General product access and basic documentation. |
| Starter | Within 48 business hours | Basic product and integration support. |
| Pro | Within 12 business hours | Product support, AI Visibility questions, dashboard/integration assistance. |
| Enterprise | Priority, as stated in order form | Dedicated onboarding, custom governance, private hosting, and agreed support channels. |
Responsible Disclosure Policy
Security researchers may report suspected vulnerabilities to [email protected]. Reports should include affected URLs, technical details, reproduction steps, impact, screenshots or logs where safe, and contact information.
Safe harbor
UpRender will not pursue legal action against good-faith research that follows this policy, avoids privacy harm, avoids service disruption, and gives UpRender a reasonable opportunity to investigate and remediate before public disclosure.
Out-of-scope reports
- Missing security headers without exploitable impact.
- Clickjacking on pages with no sensitive actions.
- Rate limits that do not cause security impact.
- Reports based solely on automated scanner output without verification.
- Known vulnerable libraries without a reachable exploit path.
Privacy Rights and Customer Assistance
Depending on location and role, individuals may have rights to access, correct, delete, restrict, port, object to, or withdraw consent for certain personal data.
How to submit requests
- Privacy and data rights: [email protected]
- Legal notices and DPA requests: [email protected]
- Security reports: [email protected]
- Billing and cancellation: [email protected]
- General support: [email protected]
Changes, Records, and Contact
UpRender may update this Compliance Addendum as the service, vendors, Google integrations, AI tools, cookies, laws, security practices, or enterprise requirements change. Material changes will be posted on this page.
Legal operator: UpRender
Legal contact: [email protected]
Privacy contact: [email protected]
Security contact: [email protected]