LupyAi
Log in Start free

Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how LupyAi, a business of ONLINECAPTAIN ("we", "us") collects, uses and protects information when you use LupyAi at https://lupyai.com, including its web app, REST API, MCP server for AI assistants and Looker Studio connector (together, the "Service").

LupyAi is a reporting tool. You connect your own advertising, analytics, social and store accounts, and the Service fetches reporting data from them so you can view it, send it to your own destinations or query it from AI assistants.

1. Information we collect

Your account

  • Your username, email address and password. Passwords are stored only as a salted hash.
  • Your workspace name, the API key we create for your workspace, and the teammates you invite (their email address and role).

Payments

Paid plans are paid through our payment processor, Razorpay. You enter card, UPI or bank details on Razorpay's checkout, and we never see or store them. We keep your plan, billing period, subscription status, Razorpay subscription and customer IDs, and the invoices Razorpay issues, so we can show your billing history and apply your plan. Razorpay may share with us the name, email address and phone number used for the payment.

AI apps you sign in to

When you connect an AI app such as Claude or ChatGPT by signing in to LupyAi, we store the app's name, the permissions you allowed, and the access and refresh tokens we issue to it, which we keep only as one-way hashes. You can see and disconnect these apps on the API & AI page at any time.

Connected platform credentials

When you connect a platform, we store the access tokens, refresh tokens or API keys it issues to us. These are encrypted at rest and used only to fetch data or perform actions you request. Platforms you can connect include Meta (Facebook and Instagram), Google (Ads, Analytics, Search Console, Merchant Center, YouTube, Sheets, BigQuery), TikTok, LinkedIn, Shopify, WooCommerce and Klaviyo. For Google, we also receive the email address of the Google account you sign in with, so you can tell your connections apart.

Account information from connected platforms

The IDs, names and currencies of the ad accounts, properties, pages, channels or stores you choose to connect.

Reporting data

When you or your tools run a query, we fetch reporting data from the connected platform. Examples include campaign names, spend, impressions, clicks, conversions, revenue, website traffic, search queries and rankings, product listing status, page and post insights, follower counts, email engagement counts and order totals. Store data includes order-level figures and customer IDs. We do not request customer names, email addresses, phone numbers or postal addresses from your store or email platform.

To make reports fast and to avoid asking the platforms for the same numbers again, we store the reporting data your reports use, day by day, for each connected account. Stored data contains only the fields your reports, templates and exports ask for; for stores, that includes order and customer IDs only when a report breaks results down by them. We re-fetch the most recent days regularly, because platforms keep revising them.

Destinations

Settings for the destinations you configure, such as a Google Sheet ID, a BigQuery dataset, database connection details, storage bucket keys, an Airtable token, or a webhook or Slack URL. Destination settings, including all keys, tokens and passwords, are encrypted at rest.

Action logs

If you turn on write actions (for example pausing a campaign, changing a budget or bid, adding keywords or creating an ad), we record each requested action, who or what requested it (web, API or AI assistant), its parameters and its result.

Technical data

Server logs containing IP addresses, request paths, timestamps and error details, used for security and troubleshooting. We use only the cookies needed to keep you signed in and to protect forms (session and CSRF cookies). We do not use advertising or analytics cookies.

2. How we use information

  • To provide the Service: fetch, combine and display your reporting data, and deliver it to the destinations and tools you set up.
  • To run scheduled syncs and perform actions you have explicitly requested and confirmed.
  • To keep the Service secure, prevent abuse and fix problems.
  • To contact you about your account or important changes to the Service.

We do not sell your data, use it for advertising, or use it to train AI models.

3. When information is shared

  • Platforms you connect. We send requests to their APIs on your behalf.
  • Destinations you configure. We write data to the Google Sheets, BigQuery datasets or databases you choose.
  • AI assistants you connect. If you connect LupyAi to an assistant such as Claude, ChatGPT, Gemini or Cursor, the data returned to your queries is sent to that assistant under your own account with that provider. Their privacy policies then apply to that data.
  • Payment processor. Razorpay processes subscription payments; we share your workspace ID, plan and the email address you pay with, so it can charge you and send receipts.
  • Infrastructure providers. Hosting providers that run the servers the Service operates on.
  • Legal requirements. When required by law, or to protect the rights, safety or property of our users or others.

4. Google user data

LupyAi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

We only request access to the Google products you choose to connect, and each permission is used only for the purpose below.

  • Google Ads (Google Ads API): the ad accounts you can access, and campaign, ad group and budget details with their performance metrics, to show reports. If you turn on write actions, we also use this access to make the changes you request and confirm, such as pausing, enabling or removing campaigns, changing budgets and bids, managing keywords, or creating campaigns, ad groups and ads.
  • Google Analytics (read-only): the GA4 accounts and properties you can access, and their traffic, engagement, conversion and revenue reports.
  • Google Search Console (read-only): the sites you can access, and their search performance (queries, pages, clicks, impressions, click-through rate and position).
  • Google Merchant Center: the Merchant Center accounts you can access, and their product listings, product status and performance, to show reports.
  • YouTube (read-only): your channels and their analytics reports.
  • Google Sheets and BigQuery: to write the data you choose into the sheets and datasets you set as destinations.
  • Your Google account email: to label the connection in your workspace.

How we share Google data

We transfer Google data only to provide the features you use, at your direction: to the destinations you set up (such as Google Sheets, BigQuery, Looker Studio, or a database, storage bucket, Airtable base, Slack channel or webhook you name), to your API clients, and to AI assistants you connect, such as Claude, ChatGPT or Gemini, when you or that assistant run a query. We do not transfer Google data to anyone else, except to comply with the law or as part of a merger or acquisition with your notice.

What we never do with Google data

  • We do not sell it, and we do not use or transfer it to serve advertising, including retargeting or personalised ads.
  • We do not use it to determine creditworthiness or for lending purposes.
  • We do not use it to develop, improve or train generalised AI or machine learning models.
  • No person at LupyAi reads it unless you give us permission for specific data (for example, for support), it is needed for security, such as investigating abuse, or it is required by law.

Storage, retention and deletion

Google tokens are encrypted at rest. Google reporting data that your reports use is stored day by day on our servers, only to provide your reports, exports and AI answers faster, and it is never used for anything else listed above. It is kept while the account stays connected, deleted after 90 days in which no report uses it, and deleted immediately, together with the tokens, when you click Remove on a Google connection. You can also revoke access at any time from your Google Account permissions, and request deletion of everything else as described on our Data Deletion page.

5. Meta platform data

Data received from Meta (Facebook and Instagram) is processed in line with the Meta Platform Terms and is used only to provide reporting and, if you enable it, the campaign actions you request. You can remove LupyAi's access at any time in Facebook under Settings → Business Integrations. See our Data Deletion page for details.

6. Storage and security

  • Credentials and database connection details are encrypted at rest.
  • Traffic to the Service is served over HTTPS in production.
  • Reporting data your reports use is stored per account and day on our servers, so reports are fast and platform APIs aren't asked for the same data twice. Data you send to a destination is stored there under your control.
  • Each workspace can only access its own connections and data.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you without undue delay.

7. Retention

  • Connected platform tokens and account selections are kept until you disconnect the source. They are deleted immediately when you do.
  • Stored reporting data is kept while its account is connected. Data no report has used for 90 days is deleted automatically, and all of an account's stored data is deleted immediately when you disconnect it.
  • Your account, workspace, destinations and action logs are kept until you ask us to delete your account.
  • Billing records (plans, payments and invoices) are kept for as long as tax and accounting laws require, even after your account is deleted.
  • Server logs are kept for a limited period for security and troubleshooting.

8. Your choices and rights

  • Disconnect any source at any time from the Sources page (the Remove button).
  • Revoke access from the platform itself, for example in Facebook Business Integrations or your Google Account permissions.
  • Access, correct or delete your data by contacting us. Follow the steps on our Data Deletion page.

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 or the EU/UK GDPR, you may have additional rights. Contact us to use them.

9. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above, and for significant changes we will notify you in the Service.

11. Contact and Grievance Officer

For questions about this policy or your data, contact LupyAi at info@lupyai.com.

Grievance Officer, LupyAi, a business of ONLINECAPTAIN, 95, NANDANVAN ROW HOUSE, MADHAVBAUG, PARVAT PATIYA, SURAT. 395010, email info@lupyai.com, phone +91 9104515704. We acknowledge complaints within 24 hours and resolve them within 15 days.