Privacy Policy

What personal data Uppcoder collects, why we collect it, where it is held, how long we keep it, and the rights you have over it.

PRIVACY POLICY

Uppcoder — a service of WEBSSON d.o.o.

Last updated: 15 October 2026 (see Changes to this Policy at the end for what changed)

1. Introduction

WEBSSON d.o.o., trading as Uppcoder ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we collect it, how we use, store, protect and share it, how long we keep it, and how you can have it deleted, when you use the Uppcoder platform (the "Service").

2. Data Controller

The data controller is WEBSSON društvo s ograničenom odgovornošću za usluge (WEBSSON d.o.o.), a company registered in the Republic of Croatia at the Commercial Court in Pazin under registration number (MBS) 130153327, OIB 13733716553, with its registered seat at Voltićeva ulica 9, 52100 Pula, Croatia.

For data protection enquiries, contact privacy@uppcoder.com.

3. Who owns your data, and our role

You own your content. The code, files, repositories and other material you create or upload ("Your Content") belong to you or your licensors, never to us (clause 13.2 of our Terms and Conditions). We use it only to provide the Service to you.
We are the data controller for your account, billing, support and usage data — the data described in section 4 below. This Policy governs it.
We are a data processor for any personal data inside Your Content. There, you are the controller and you decide what is collected and why. The terms on which we process it are in Appendix 1 of our Terms and Conditions, not in this Policy.
Schools and other institutions. Where an institution gives its students and staff access to Uppcoder (directly, or through its learning platform such as Moodle or Canvas), the institution controls its students' data and coursework, and we process it on the institution's instructions. Students should contact their institution first about their data; we will help the institution answer.

4. Data we collect, and how we collect it

From you, when you register or use the Service

Account information — name, email address, and organization (if applicable).
Your Content — code, files and configurations in your workspaces, and, for courses, the work you hand in. We do not access it except as needed to provide the Service or as required by law (see section 3).
SSH public keys you add to reach your workspace, and credentials you store for connected services such as GitHub (stored encrypted, see section 10).
Support requests and messages you send us, through the platform or by email.

From the services you choose to connect

Google or GitHub sign-in — if you sign in with Google or GitHub, they send us your name and email address (and, for GitHub, your username).
Enterprise single sign-on — if your organization uses it, your identity provider sends us your name and email address.
Your learning platform (Moodle, Canvas or another LTI platform) — when you open Uppcoder from it, it sends us your name, email address, your platform user ID, your role in the course (for example student or teacher) and the course you came from. With your institution's agreement it can also send us the course's class list.
Stripe — confirmation of your payments and subscription status. We never receive or store your card number.

Automatically, while you use the Service

Usage data — resource consumption (CPU, RAM, disk), workspace activity and feature usage, for billing and to run the platform.
Technical data — IP address, browser type and device information, for security and to keep the Service working.
Website measurement — on our public marketing pages we count page views and clicks, anonymously and without cookies. See section 13.

5. How we use your data

To provide, maintain and improve the Service
To process billing and manage your subscription
To communicate with you about your account, updates and support
To send grades and hand-in results back to your learning platform, where your institution uses one
To enforce our Terms and Conditions and prevent abuse
To comply with legal obligations

We do not sell your personal data, use it for advertising (section 14), or use Your Content to train AI models.

6. Legal basis (GDPR)

Contract performance – to provide the Service you subscribed to
Legitimate interest – for security, fraud prevention and service improvement, and to contact organizations about Uppcoder (section 15)
Legal obligation – to comply with applicable laws
Consent – for optional marketing communications, which you can withdraw at any time

7. Third parties: who we share data with, and what

We share personal data only with the third parties below, and only what each needs for the purpose shown.

|---|---|---|---|

| Google (Google Ireland Ltd / Google LLC) | Our business email; Google sign-in, if you choose it | Emails you exchange with us and emails we send you; for sign-in, the fact that you are signing in to Uppcoder | European Union / United States |

| Stripe | Payment processing and fraud prevention | Your name, email address, billing address and what you buy; your card details go to Stripe directly | European Union / United States |

| GitHub | Repositories you connect, course repositories; GitHub sign-in, if you choose it | Repository contents your token allows; for sign-in, the fact that you are signing in to Uppcoder | United States |

| Your learning platform | Using the Service inside Moodle, Canvas or another LTI platform | Your grades and hand-in status for its assignments | As determined by your institution |

Our sign-in service (Keycloak) and our website measurement run on our own servers and are not third parties.

Choosing what is shared. Hosting is needed to provide the Service at all, and payment data is shared with Stripe only if you pay. Everything else is optional: if you do not use Google or GitHub sign-in, single sign-on, a learning platform, connected repositories or our AI Features, nothing is shared with those third parties. We never share data with anyone for their own marketing or advertising.

What we require of third parties. We choose providers that commit to protecting personal data, and where they process data for us we put data-processing terms in place that bind them to the same obligations we take on in our Terms and Conditions (Appendix 1). We remain responsible to you for what they do on our behalf.

When the list changes. Before we add a new third party that will process personal data for us, we update this list and tell you by email at least 14 days in advance, as our Terms and Conditions (Appendix 1, section D) also provide.

Artificial intelligence

The AI features we supply run on our own inference infrastructure in the Netherlands. Content you send to them is not passed to any third party model provider, and does not leave the European Economic Area.

If you install your own AI tools or extensions in your workspace, or supply your own credentials for a third party model provider, that processing is yours and not ours — we cannot control or guarantee where that data goes. See clause 4 of our Terms and Conditions.

International transfers

Hosting, our sign-in service and our AI Features run within the EU/EEA. Transfers to the United States (Google, Stripe, GitHub, and Auth0 where used) are safeguarded under the EU–US Data Privacy Framework and/or Standard Contractual Clauses. We do not load fonts, scripts or analytics from third-party CDNs that would transmit your data abroad.

8. Data retention

Your account — kept while your account is active. After you delete your account or cancel your subscription, we keep your data for 30 days, during which you may request an export, and then delete it.
Inactive accounts — if your account is inactive for six months, we may delete your content after giving you at least 30 days' notice by email.
Backups — we keep encrypted backups of our databases: one a day for 30 days, and one a month for 12 months. Data you delete leaves the backups as they expire, so after at most 12 months. We use backups only to recover from a failure, never to bring back data you asked us to delete.
Coursework at an institution — work handed in through a course is kept in the institution's own course storage for as long as the institution keeps it; the institution decides, and can ask us to delete it.
Billing records — kept for as long as Croatian tax and accounting law requires.
Support requests and emails — kept while your account is active, and deleted with it.

9. Deleting your data

You can have your account and personal data deleted entirely. Email privacy@uppcoder.com from the address on your account (or ask your organization's administrator, if your account belongs to an organization). We will confirm your request and delete your account, workspaces and personal data within 30 days. What we cannot delete straight away: billing records the law requires us to keep, and copies in encrypted backups, which expire as described in section 8.

If you used Uppcoder through your institution, it can also ask us to delete its students' data.

10. Data security

Encryption in transit — every connection to the Service uses TLS.
Encryption at rest — the disks holding your workspaces are fully encrypted, our backups are encrypted with a key kept off our servers, and credentials you store with us (for example Git tokens and SSH deploy keys) are encrypted in our database.
Isolation — each workspace runs in its own isolated environment.
Passwords — handled by our sign-in service, stored only as one-way hashes, never in readable form. Passwords must be at least 8 characters.
Two-step sign-in — available by signing in with Google or GitHub, which apply your own two-step verification.
Access — only the staff who need it to run the Service can access production systems, by SSH key only.
Location — all servers are in the European Union.

If you believe your account or data has been compromised, contact privacy@uppcoder.com at once.

11. Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

Access your personal data
Rectify inaccurate data
Request deletion of your data (section 9)
Restrict or object to processing
Data portability
Lodge a complaint with a supervisory authority — ours is the Croatian Personal Data Protection Agency, Agencija za zaštitu osobnih podataka (AZOP), azop.hr. You may also complain to the authority in your own country of residence.

To exercise these rights, contact privacy@uppcoder.com.

12. Cookies & local storage

We use only cookies and browser storage that are strictly necessary to run the Service, or that remember your own preferences. We do not use analytics, advertising or cross-site tracking cookies, and our website measurement (section 13) stores nothing at all on your device. Because of this, no cookie-consent banner is required.

Strictly necessary

access_token – keeps you signed in (expires after about 24 hours)
_gate_session – secure (HttpOnly) session cookie used by our access gateway
Keycloak session cookies – set by our sign-in service during sign-in
LTI cookies – only when the Service is embedded inside a learning platform (e.g. Canvas, Moodle), to maintain the session inside the iframe

Functional (stored in your browser only, never transmitted)

Display preferences such as light/dark theme and menu state
Authentication refresh and device tokens used to keep you signed in

Third-party

When you make a payment, Stripe sets its own cookies for fraud prevention and to process the transaction. These are used only on the checkout flow.

13. Website analytics

On our public pages (the home page and the Education, Developer and Enterprise pages) we record which pages are viewed, which buttons and links are clicked, and whether a product film is played. We do this ourselves, on our own servers in the EU. We do not use Google Analytics, or any other third-party analytics service, and no data about your visit is sent to any other company.

What is recorded

The page path (for example /education) – never the query string
The name of the button or link clicked, and whether a film was played
The website that referred you, and any campaign tag in the link you followed
Your browser family, operating system family, and desktop / tablet / phone

What is not recorded

No cookies, and no browser storage of any kind. Nothing is written to your device
No IP address. It is used only, in the instant of the request, as an input to an irreversible hash, then discarded
No account link. These records contain no user ID, email address or name, and are never joined to your account
No full User-Agent string, no device fingerprint, and no cross-site tracking

How visits are counted without identifying you

So that one person reading three pages counts as one visit rather than three, each visit gets a short code derived from your IP address and browser type combined with a random secret we generate daily and destroy after two days. Once destroyed, the code cannot be recalculated or traced back to an IP address by anyone, including us — and the same visitor on two different days appears as two unrelated codes.

Legal basis, retention and opt-out

This runs under our legitimate interest (GDPR Art. 6(1)(f)) in knowing which pages and referral sources work. With no cookies or device storage and no personal identifiers, it does not require consent under the ePrivacy Directive. Individual records are deleted after 180 days; only anonymous daily totals are kept beyond that. If your browser sends a Do Not Track or Global Privacy Control signal we record nothing at all — no request is even sent.

14. Advertising

No advertisements are shown anywhere in the Service.
You are not targeted for advertising, and we build no advertising profile of you.
No third party tracks you or collects information through the Service or our website for advertising, and we use no web beacons, pixels or other tracking methods for advertising.
Nothing is shared with advertisers, so there is nothing to opt out of. Links in our own emails may carry a campaign tag so that we can count visits to our website; that tag is not shared with anyone.

15. People we contact about Uppcoder

We sometimes email people at schools, training providers and companies whose work suggests Uppcoder could help them. If we contacted you this way:

Where your address came from — a public source such as your organization's website or a public event listing. We use work addresses only.
What we keep — your name, organization, role, work email address, where we found them, and the emails we exchange with you.
Why — our legitimate interest in telling organizations about Uppcoder (GDPR Art. 6(1)(f)).
Stopping it — reply "no thanks" or "unsubscribe", or email privacy@uppcoder.com, and we will not contact you again. We keep only what is needed to make sure of that, and delete the rest on request.

16. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect data from children. Educational accounts for minors must be set up by an authorized educator or institution, which is responsible for obtaining any consent required. See clause 8 of our Terms and Conditions.

17. Changes to this Policy

We will tell you about material changes by email, and on the platform, at least 30 days before they take effect.
If a change would use your personal data for a new purpose, we will ask for your consent first where the law requires it.
The date at the top shows when this Policy last changed, and the list below says what changed.

Change history

15 October 2026 — Added what we share with each third party and how to opt out; named Google (email and sign-in); data ownership; how to delete your data; backup retention; security measures in detail; advertising; people we contact about Uppcoder; how changes are made.
30 August 2026 — Previous version.

18. Contact

For privacy-related questions, or to exercise your data rights, contact privacy@uppcoder.com.

WEBSSON d.o.o., Voltićeva ulica 9, 52100 Pula, Croatia.