Privacy Policy

Last updated: October 4, 2026

1. Introduction

Upstep (“Upstep”, “we”, “our”, or “us”) operates the Upstep service available at https://www.upstepasia.com/ (the “Service”). Upstep is an online mentorship platform that helps users connect with mentors and access mentorship-related information.

This Privacy Policy describes how we collect, use, store, and share personal information when you use the Service. By using the Service, you acknowledge the practices described in this policy.

2. Information We Collect

We may collect the following information when you use the Service:

  • Name
  • Email address
  • Account identifier
  • Profile information you choose to provide, such as your role, background, or areas of interest
  • Information required for authentication and account security, such as your password (stored in hashed form by our authentication provider), email verification status, and sign-in records
  • Basic service information generated when you use the Service, such as the pages you visit and the actions you take within your account

We collect only the information reasonably needed to create and secure your account and to provide the Service.

3. Google Sign-In

You may choose to sign in to Upstep with your Google account. When you do, Upstep may receive the following information from Google:

  • Google account identifier
  • Name
  • Email address
  • Email verification status
  • Basic profile information, such as your profile picture

Google Sign-In only requests the basic scopes: openid, email, and profile. Sign-in never gives Upstep access to your Gmail, Google Drive, Google Calendar, contacts, or any other Google data. Mentors can separately choose to connect Google Calendar, described in section 4.

Google user data is used solely for authentication, account creation, and account management. Upstep does not sell Google user data, and Upstep does not use Google user data for advertising.

Upstep’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Google Calendar (Mentors, Optional)

Mentors may choose to connect their Google Calendar on their Availability page so that approved mentoring sessions booked as Google Meet are added to their calendar with a Google Meet link. This is optional; mentors who don't connect Google Calendar can share their own meeting link instead.

When a mentor connects Google Calendar, Upstep requests the scope https://www.googleapis.com/auth/calendar.events.owned (see, create, change, and delete events on calendars you own), together with openid and email to identify the connected account. With this access, Upstep only:

  • Creates one calendar event on the mentor's own primary calendar when the mentor approves a session booked as Google Meet, including a Google Meet link, the session time, and the mentee as a guest (Google sends the mentee the invitation)
  • Deletes that same event if the session is later cancelled

Upstep does not read, list, or change any other events or calendars, and does not use calendar data for any other purpose. We store the connected Google account's email address and an OAuth refresh token, which is encrypted with a dedicated encryption key (AWS Key Management Service) before it is stored. We also store the ID and Meet link of each event Upstep created, so it can be removed if the session is cancelled.

A mentor can disconnect Google Calendar at any time from their Availability page. Upstep then revokes its access with Google and deletes the stored token. Access can also be removed from the Google Account's security settings (Third-party apps & services).

Google user data obtained through Google Calendar is used only to provide this feature. It is not sold, not used for advertising, not transferred to others except as needed to provide the feature or to comply with law, and not read by humans except with the mentor's consent, for security purposes, or to comply with law. Upstep's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Upstep does not use Google user data, including data obtained through Google Workspace APIs such as Google Calendar, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models, and does not transfer Google user data to any third-party AI or machine learning service. Upstep does not use any AI or machine learning models to process Google user data.

5. How We Use Information

We use the information we collect to:

  • Create your account and authenticate you when you sign in
  • Provide, operate, and maintain the Service
  • Create and manage your user profile
  • Send account-related communications, such as sign-up confirmations and security notices
  • Verify your email address
  • Process password reset requests
  • Detect, prevent, and respond to fraud, abuse, and security issues
  • Maintain and improve the Service

6. Infrastructure and Service Providers

Upstep relies on third-party service providers to operate the Service. These providers process personal information on our behalf and only as needed to provide their services to us. They include:

  • Amazon Web Services (AWS), which hosts the Service and its infrastructure
  • Amazon Cognito, which provides user authentication and account management
  • Amazon DynamoDB, which may store user profile and application data
  • Amazon Simple Email Service (Amazon SES), which may send transactional emails such as verification and password reset messages
  • Google authentication services, when you choose to sign in with Google
  • Google Calendar and Google Meet, when a mentor chooses to connect Google Calendar
  • AWS Key Management Service, which encrypts stored Google Calendar access tokens
  • Google Analytics, which measures how the Service is used

7. How We Share Information

We may share personal information with the service providers described above to the extent required to operate the Service. We may also disclose personal information when we believe in good faith that doing so is required by applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Upstep, our users, or others.

We do not sell personal information.

8. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary to operate the Service, to comply with our legal obligations, to maintain security, and to resolve disputes.

You may request deletion of your account and associated personal information at any time by contacting us at upstep.org@gmail.com. We will respond to your request within a reasonable period. Some information may be retained where required by law or for legitimate security or dispute-resolution purposes.

9. Cookies, Authentication Storage and Analytics

The Service may use cookies or similar browser storage technologies to keep you signed in, protect your account, remember your preferences, and support the normal operation of the Service. You can control cookies through your browser settings, but disabling them may prevent you from staying signed in or using certain features.

We use Google Analytics to understand how visitors use the Service so we can improve it. Google Analytics sets cookies and collects usage information such as the pages you view, how you arrived at the Service, your approximate location, and your device and browser type. This information is processed by Google under its own privacy policy. You can opt out by installing the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout) or by blocking cookies in your browser.

10. Security

We use reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, loss, or misuse. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. Please keep your sign-in credentials confidential and notify us if you suspect unauthorized access to your account.

11. Third-Party Services

The Service may contain links to, or allow you to sign in through, services operated by third parties such as Google. These third-party services are governed by their own terms and privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policies of any third-party service you use in connection with Upstep.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we may also provide additional notice, such as by email or through a notice on the Service. Your continued use of the Service after an updated policy takes effect means you acknowledge the updated policy.

13. Contact

If you have questions about this Privacy Policy or how we handle personal information, please contact us:

  • Upstep
  • https://www.upstepasia.com/
  • upstep.org@gmail.com