Security and data.
Lupee reads private conversations. That deserves a page with no hedging in it. Here is exactly what is read, what is never read, how long anything is kept, and what happens when you press delete.
Scope
What is read.
Opt-in is per channel and it is the only thing that grants access. There is no account-wide switch that quietly turns on everything.
What is read
- Messages in the channels and conversations you opted in to, one at a time
- Thread replies under those messages, so a commitment keeps the context that explains it
- Display names, channel names and timestamps, so the ledger can say who owes what and when
- Permalinks back to the source message on Discord. Slack and Telegram do not hand an app a link we can store, so items from those two carry the channel and the timestamp instead
- Your own confirmations and rejections in the review inbox, which set the state of each item on your list
What is never read
- Any channel, group or direct message you did not opt in to
- Files, images, attachments and their contents
- Voice and video call audio
- Telegram secret chats, which are not exposed to bots at all
- Personal WhatsApp, on any path, because reading it through an unofficial client breaks the WhatsApp terms of service
Before the model call
Redaction comes first.
Extraction runs on a language model. That model is a subprocessor, and the text it receives is trimmed and cleaned before it is sent.
What gets stripped
- API keys and access tokens with a recognisable shape: known provider prefixes, JSON web tokens, and anything assigned to a name like token, secret or password
- Card numbers, checked against the Luhn rule so an ordinary long number is not mangled, and IBANs
- Recovery phrases and seed phrases
- Email addresses and phone numbers, replaced with a fixed placeholder
Redaction is a filter, not a guarantee. It catches known patterns, and a secret with no recognisable shape is a string like any other to it. If your channel routinely contains material that must never leave your systems, do not opt that channel in.
What is sent, and how much
Only the recent window needed to understand a candidate commitment goes to the model, not your history. Forty messages is the window. It carries no billing details and no email addresses, but it does carry what the model needs to say who owes whom: the display names of the people in the conversation and their platform account identifiers.
The model provider is contractually barred from training on content sent through the API. Its retention window for abuse monitoring is set by its own terms rather than by us, and the subprocessor list names every provider in this chain and what each one sees.
Extraction runs on one model rather than a chain of them. A smaller and cheaper model writes the draft messages you can edit before sending yourself. Both run through the same redaction step.
Retention
How long data lives.
| Data | Kept for | Detail |
|---|---|---|
| Raw message text | 30 days | Changing the window is a Team feature today: a Team admin can set it anywhere from 1 day to 12 months, for everyone in the workspace. On Trial, Pro and Founding Lifetime it stays at 30 days. After the window, the text is deleted, not archived. |
| Extracted commitments | Until you delete them, or 12 months after the account closes | A commitment keeps its short description, owner, due date and source link. It survives the deletion of the underlying message text, because the list is the product. The 12 month tail after an account closes is the period the privacy policy sets. |
| Confirmation history | While your account exists | Whether you accepted or rejected a candidate is stored per workspace, and it is what gives each item its state. It is not pooled across customers and it is not used to train third party models. It does not currently feed back into extraction either, and this row will say so when it does. |
| Operational logs | 30 days | Request metadata for debugging and abuse prevention. Message content is not written to logs. |
| Backups | rolling, aged out within 90 days | Encrypted, rolling, and aged out on schedule. The backup store holds an object for at least 35 days and expires it at 90, so 90 is the number to plan around. Backups are restored whole in a disaster, never selectively for a single record. |
Region, roles and rights
Where data sits.
Where the data is stored today
In the EU, in Frankfurt. The API and the workers run on Fly.io in Frankfurt, and the database (Neon) and the job queue (Upstash) sit in the same AWS Frankfurt region. The subprocessor list names each provider and what it sees.
Storage stays in the EU, but processing does not stay entirely inside it: the extraction call leaves the region, because the model provider runs in the United States. The data processing addendum says the same thing and is the reference version.
If processing has to stay inside the EU, write to privacy@lupee.app before buying rather than after. Today the honest answer is that Lupee is not the right fit if every step of processing has to stay in the EU.
Processor, not controller
For workspace data, Lupee acts as a data processor and you are the controller. The data processing addendum sets out the terms and forms part of the agreement.
Access and export requests
Subject access requests are answered within one month, and a complex one can be extended by two further months, in which case we tell you inside the first month. Export gives you your commitments and their source links in a machine readable file. Write to privacy@lupee.app or use the in-app control.
Subprocessors
The full list of subprocessors, what each one does and where it runs, is published and versioned. Every customer gets at least 30 days of notice before a subprocessor is added or replaced, and a business customer can object inside that window under the data processing addendum.
Deletion that deletes
Deleting your workspace removes its messages, commitments, connections and confirmation history from live systems, and the run starts when you press the button rather than on a schedule. The encrypted backups that still contain them age out within 90 days. The deletion screen shows the state of the run, so you can see when the live systems are clear.
Two limits worth stating rather than discovering. Turning a channel off stops it being read and stops anything new being stored from it, but it does not delete what is already there: that text goes on the ordinary retention window, and the way to remove it sooner is a workspace deletion. And if you leave a workspace that other people are still in, your account and your membership go, while the messages and commitments belonging to that shared workspace stay with it, because they are not only yours to delete.
Engineering practice
Still being built.
This section is written the way it is because a security page that only lists finished work is not a security page.
Data is encrypted in transit with TLS and at rest by the storage provider. Connector tokens are encrypted again by us, with AES-256-GCM, before they reach the database. Access to production is limited to the engineers who need it, every provider account requires multi-factor authentication, and access is logged. We do not read your messages as part of running the service. Secrets are held in a managed store and read from the environment at runtime, never committed.
What does not exist yet: a SOC 2 report, a published penetration test, and a bug bounty programme. Those are planned, and this page will name the auditor and the date when each one is real. Until then, treat their absence as a fact about the product rather than an omission from the copy.
If you find a vulnerability, write to privacy@lupee.app with enough detail to reproduce it. We will confirm receipt within two working days and will not pursue anyone who reports in good faith and does not access other people's data.
Know what each connector reads.
Each connector page lists the exact permissions it asks for and the platform limits that apply to it.