Privacy Policy

This Privacy Policy explains how UpToNova ("UpToNova", "we", "us", or "our") collects, uses, discloses, and safeguards personal information when you visit formation.uptonova.com (the "Site") or use our company-formation, Employer Identification Number (EIN), registered-agent, document, and compliance services (collectively, the "Services"). By using the Site or Services, you agree to the practices described here. If you do not agree, please do not use the Services.

1. Who this policy applies to

This policy applies to founders, business owners, their representatives, and visitors who interact with the Site or Services, including non-US residents who use UpToNova to form a US company. Where we act on your instructions to prepare and submit filings, we process your information as part of providing the Services you request.

2. Information we collect

We collect the following categories of personal information:

• Account information — your name, email address, password (stored hashed), and account preferences.
• Company and formation information — proposed company name, entity type, state of formation, business description and activity, principal address, management structure, and member or owner details, including names, nationality, country of residence, ownership percentages, and identification details you provide for your filings.
• Identity and compliance information — information required to prepare government filings and to meet identity-verification, anti-money-laundering (AML), and "know your customer" (KYC) obligations, which may include passport or identity-document data and supporting documents you upload.
• Order and billing information — the Services you purchase, order status, and billing records. Card payments are processed by our payment processor (Stripe); we do not store full card numbers on our servers.
• Documents — formation documents, operating agreements, EIN letters, state filings, and other files we generate, receive, or store on your behalf, including electronic-signature records and audit metadata (signer name, email, IP address, timestamp, and document hash).
• Communications — support tickets, requests, replies, and any attachments you send us.
• Usage and device data — log data, IP address, browser and device information, and basic analytics about how the Site is used.

3. How we use your information

We use personal information to:

• provide, operate, and improve the Services, including preparing and submitting formation, EIN, registered-agent, and compliance filings;
• verify identity and carry out AML/KYC and fraud-prevention checks, and review businesses for prohibited or high-risk activity;
• process payments and manage your account and orders;
• generate, deliver, and store your documents, and provide in-app electronic signing;
• communicate with you about your orders, required actions, deadlines, and support;
• maintain records, comply with legal and regulatory obligations, and enforce our terms; and
• protect the security and integrity of the Site, Services, and our users.

4. Legal bases for processing

Where data-protection laws such as the EU/UK GDPR apply, we rely on the following legal bases: performance of a contract (to provide the Services you request); compliance with a legal obligation (including identity, tax, and AML requirements); your consent (where required, for example for certain communications); and our legitimate interests in operating, securing, and improving the Services, balanced against your rights.

5. How we share information

We do not sell your personal information. We share it only as needed to provide the Services and as described below:

• Government agencies — state filing offices (e.g., the Secretary of State) and the US Internal Revenue Service, to make the filings you request.
• Service partners — our registered-agent and filing partners who fulfil registered-agent and state-filing services on your behalf.
• Payment processor — Stripe, to process payments securely.
• Infrastructure and tooling providers — hosting, email delivery, document storage, and security providers who process data on our behalf under appropriate confidentiality and data-processing terms.
• Professional advisers — where you ask us to connect you with cross-border tax or legal support, with your direction.
• Legal and safety — where required by law, regulation, legal process, or to protect the rights, property, or safety of UpToNova, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

6. International data transfers

UpToNova forms US companies, so your information is processed and stored in the United States and may be accessed from other countries where we or our providers operate. Where we transfer personal data internationally, we use appropriate safeguards as required by applicable law.

7. Data retention

We retain personal information for as long as your account is active and as needed to provide the Services, and afterwards for as long as required to comply with legal, tax, accounting, and recordkeeping obligations, to resolve disputes, and to enforce our agreements. Formation and filing records are typically retained for an extended period because they relate to a legal entity and may be needed for compliance.

8. Security

We use administrative, technical, and organisational measures designed to protect personal information, including encryption in transit, access controls, and audit logging for sensitive actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your account credentials confidential.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, update, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising those rights. To exercise any right, contact us using the details on our Support page. We may need to verify your identity, and some information must be retained where required by law (for example, completed government filings).

10. Cookies and analytics

The Site uses cookies and similar technologies that are necessary for it to function (such as keeping you signed in) and, where applicable, limited analytics to understand and improve usage. You can control cookies through your browser settings; disabling some cookies may affect Site functionality.

Consent. Analytics and advertising cookies are switched off by default and are only set after you accept them in the consent banner shown on your first visit. Until you choose, Google's tags run in a restricted mode that stores nothing on your device. You can change your decision at any time by clearing this site's data in your browser, which makes the banner appear again. We ask again every six months.

Advertising measurement. If you consent, we share a limited set of details about completed orders with Google (Google Analytics and Google Ads) so we can measure which advertising actually leads to sales. This may include the advertising click identifier that brought you to the Site, the order value and currency, and — for order matching only — your email address, phone number, name and postal address in hashed form. Hashing converts each value into an irreversible code before it leaves our servers, so Google receives the code rather than your actual details, and can only use it to check whether it matches an existing Google account. We never share payment card details, and we never send your name, email, phone or address to Google Analytics in readable form.

If you do not consent, none of this advertising data is shared. This processing relies on your consent as the legal basis, and you may withdraw it at any time (see "Your rights and choices" below). Google acts as an independent controller for this data; see Google's own privacy policy at policies.google.com/privacy.

11. Children

The Services are intended for adults forming a business and are not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can delete it.

12. Third-party sites and services

The Site may link to third-party websites and services (for example, banks, payment platforms, or government pages). We are not responsible for their privacy practices. Please review their policies before providing information.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this Privacy Policy or how we handle your information, please reach us through our Support page.

This Privacy Policy provides general information about our data practices and is not legal advice.