Law enforcement requests

1. Purpose and Principles

Upkyo, the trade name of a Limited Liability Company organized under the laws of the State of New Mexico, USA, company number 6867626, respects its customers' privacy and cooperates with authorities within the limits of the law.

We disclose customer data only when the law requires or expressly permits it, based on valid legal process, or in an emergency involving a threat to life. Every request is reviewed individually. We may refuse, challenge or ask to narrow any request that is overbroad, vague, defective or unlawful.

This policy describes our usual practices. It does not create any rights for third parties and does not limit our ability to respond differently when the law or the circumstances require it.

2. What Upkyo Does and Does Not Control

Upkyo provides technical services: hosting, servers, email and domain names. Our customers create, publish and manage their own websites, applications and mailboxes and the data they store in them. Upkyo does not control, monitor or author that content. Customers who manage a server have sole control over it.

To get content removed, the fastest route is often to contact the customer responsible for the site directly. Reports of illegal content can also be sent to us under our Abuse Policy.

3. Legal Process Required in the United States

Our customers' data is protected by the Stored Communications Act, codified beginning at 18 U.S.C. § 2701. In accordance with that law, we require: a subpoena issued in a criminal investigation or proceeding for the basic subscriber information listed in 18 U.S.C. § 2703, subsection c, paragraph 2; a court order issued under 18 U.S.C. § 2703, subsection d, for other non-content records, such as certain connection logs; and a search warrant issued by a court of competent jurisdiction on a showing of probable cause for the contents of communications and stored files, including email, website files and databases.

Legal process must be served on us in accordance with applicable law. As a courtesy, we may accept a request received by email without waiving any objection.

4. What a Request Must Include

To be processed, a request must be on official letterhead or sent from the authority's official email address. It must state: the name of the requesting authority and unit; the name, title, work contact details and, where applicable, badge or ID number of the responsible officer; the legal basis for the request; the specific identifiers involved, such as a domain name, an IP address with date, time and time zone, an email address or an account number; the categories of data requested; the time period covered, as narrow as possible; the requested response date; and whether any order prohibits notifying the customer.

A request that does not identify an Upkyo service, or that concerns data we do not hold, will be returned with an explanation where possible.

5. Foreign Requests

Because Upkyo is a U.S. company, authorities outside the United States should generally use international legal assistance channels, including mutual legal assistance treaties, known as MLATs, and letters rogatory, or any other applicable mechanism, such as an agreement under the CLOUD Act or a European Union electronic evidence instrument where it applies to Upkyo.

Where U.S. law and applicable law allow it, we may respond directly to a foreign authority's request for non-content data after verifying that it is valid and proportionate. The contents of communications and files are disclosed only under an order issued or recognized by a court of competent jurisdiction through those mechanisms.

Because our customers' data is hosted in data centers in the European Union, we also assess whether each request is compatible with European Union law, including Article 48 of the GDPR, and we may challenge a request that would conflict with that law, as permitted by law.

6. Emergency Requests

Under 18 U.S.C. § 2702, subsections b and c, we may disclose data without prior legal process if we believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay.

Emergency requests must be sent to support@upkyo.com with “Emergency Request” in the subject line. They must come from an identifiable authority and describe the nature of the emergency, the person at risk where possible, the data requested and why it would help prevent the harm. They must be signed by the responsible officer. We may verify that the request is genuine and ask for the corresponding legal process afterward.

This channel is reserved for real and imminent danger. Misusing it may be a crime.

7. Data Preservation

Under 18 U.S.C. § 2703, subsection f, an authority may ask us to preserve existing data while it obtains the legal process needed for disclosure. We then keep a copy of the data available on the date of the request for the period provided by law, which may be extended on the same terms.

A preservation request must meet the requirements described above. Preservation covers only data that exists when the request is received. We do not collect future data without an order requiring it. Preserved data is disclosed only upon valid legal process. If no process is received within the statutory period, the data may be deleted under our normal practices.

We review preservation requests from foreign authorities on the same principles where the law allows it.

8. Notice to Customers

Our practice is to notify the affected customer before disclosing their data so they can protect their rights, including by challenging the request in court.

We do not provide notice when the law prohibits it, for example when there is a nondisclosure order under 18 U.S.C. § 2705, subsection b, or an equivalent order; in an emergency involving a threat to life; when notice could endanger someone or make child abuse worse; or when the account has been compromised and notice would reach the wrongdoer rather than the customer.

Once a prohibition ends or an emergency has passed, we may notify the customer after the fact. A request not to notify must rely on a specific order or statute. A simple request for discretion does not prevent us from notifying the customer.

9. Categories of Data That May Be Available

Depending on the service, the time period and our retention practices, we may hold some of the following categories of data: information provided by the customer at sign-up, such as name, organization, email address, mailing address and telephone number, along with the account creation date and the list of services subscribed to; billing and payment history, noting that Upkyo does not store card numbers, which are processed by Stripe and PayPal; IP addresses used to log in to the client area and certain technical logs; domain name registration data; and content stored by the customer, such as files, databases and email, and backups of that content.

We do not guarantee that this data exists, is accurate or is still available. Information is provided by customers and is not always verified; logs and backups are kept for a limited time; and the customer may have deleted or encrypted their data. We do not create data we do not hold, and we do not decrypt data the customer has encrypted.

10. Processing Fees

Under 18 U.S.C. § 2706 and other applicable laws, Upkyo may seek reimbursement of reasonable costs directly incurred in searching for, assembling, reproducing or preserving the requested data. Where possible, the amount is communicated to the authority before processing. We may waive these fees, particularly in emergencies or cases involving child abuse.

11. Civil and Private Requests

Upkyo does not disclose customer data to an individual, a business or an attorney simply because they ask. In civil litigation, we require a valid subpoena or court order issued by a court of competent jurisdiction and properly served. We notify the affected customer and give them a reasonable time to object, unless the law prohibits it.

The Stored Communications Act prohibits disclosing the contents of a customer's communications in civil proceedings. Requests for content must be directed to the customer. Processing fees for civil requests may be charged to the requesting party.

To have content removed, use our Abuse Policy or our Copyright Policy. For a domain name dispute, see our Domain Registration Agreement, which describes the UDRP and URS procedures.

12. Domain Name Requests

Domain name registration data is held by the ICANN-accredited partner registrar and by the registry for the extension. Requests for access to redacted data may be sent to the registrar through its own procedures, which we can point you to, or to Upkyo under this policy.

An order to suspend, block or transfer a domain name is carried out in accordance with ICANN, registrar and registry rules. Some orders must be sent directly to the registry for the extension.

13. Challenging Requests

We may challenge a request, ask for it to be narrowed or seek clarification when we believe it is overbroad, insufficiently supported, addressed to the wrong entity, contrary to applicable law or inconsistent with our obligations to our customers or under European Union law. We disclose only the data strictly necessary to respond to a valid request.

14. How to Submit a Request

Requests from authorities may be sent by email to support@upkyo.com with “Law Enforcement Request” in the subject line, or “Emergency Request” for situations involving a threat to life, or by mail to: Upkyo, Attn: Legal Department, 1178 Broadway, 3rd Floor #1249, New York, NY 10001, USA.

This channel is reserved for official requests. Customers and members of the public who want to contact us for another reason can write to the same email address or open a ticket from the client area.

15. Transparency Report

Upkyo may publish a transparency report showing, in aggregate form, the number of requests received and how they were handled, to the extent permitted by law. Upkyo makes no commitment regarding the publication, frequency or content of any such report.

16. Personal Data

Personal data contained in requests, and data we disclose in response, is processed in accordance with our Privacy Policy and applicable data protection laws. We keep a record of the requests we receive and our responses so that we can account for them.

17. Changes and Language

We may update this policy at any time, in particular to reflect changes in the law. The version in effect is the one published on upkyo.com. This policy is published in several languages, and the English version controls if there is any inconsistency.