Privacy policy
What UpgoLAB collects when you use upgolab.com, what it is used for, how long it is kept, who it is shared with and the rights you hold under Vietnamese law. Updated: 01/11/2026.
1. Scope
This policy covers upgolab.com and every page under it: account registration, image and video upscaling and the Library. The service is operated by the UpgoLAB team. It does not cover third-party sites you open from links on upgolab.com.
2. What we collect
Account: username, email, hashed password, two-step secret if you enable it, account creation time and last sign-in. If you sign in with Google, we receive your name, verified email and Google account identifier. Files: the image or video you upload, the technical details needed to process it (dimensions, duration, codec, size) and the result file. Operations: job history, security events, the IP address used for rate limiting and abuse prevention (administrators see it only in shortened form) and browser type when diagnosing a fault. Measurement and ads: Google Analytics records the pages you view, the referring page, device and browser type, and an approximate location derived from a shortened IP address; Google AdSense records ad impressions and clicks. Neither receives the images or videos you upload.
3. Purpose and basis
We use this data to create and protect your account, carry out exactly the upscaling you ask for, return the result, prevent abuse and fraud, diagnose faults and meet legal obligations. Processing rests on performing the service you requested, your consent when you choose a sign-in method or enable a feature, and duties under Vietnamese law on cybersecurity and personal data protection. We do not use your data for any purpose beyond those listed here.
4. What we never do
We do not sell, rent or trade your data. We do not use your images or videos for advertising, behavioural profiling or model training. We do not make files public and do not share them with other users. We do not exploit the content for anything other than the processing you asked for. No one opens your files to read them unless you request support or the law requires action.
5. Google sign-in
Google sign-in uses Google's standard protocol and asks only for your name, email and account identifier. We never receive your Google password, we do not access your Gmail, Drive or photos, and we do not send your images or videos to Google. You can unlink it in the account's Security section once you have set a password.
6. Retention
Images and videos are processed for you and are not made public. Service infrastructure is used to process, store and deliver results. Originals and results are deleted automatically 24 hours after processing finishes for accounts, or 1 hour for guests. Signing up or signing in before the guest deadline extends retention to 24 hours from the original completion time; the clock does not restart. Job history and security logs are kept longer so you can review results and we can detect abuse, and they hold no file content. When you delete a file in the Library it is removed from storage immediately.
7. Sharing with providers
To run the service, data is processed on our own infrastructure and that of providers: Cloudflare (content delivery, attack protection, browser verification), an object-storage provider (holding originals and results), a hosting provider, and Google for Analytics and AdSense. Infrastructure providers process data only under contract, never for their own purposes; Google itself handles what its measurement and advertising cookies collect under Google's own policy. If you choose Google sign-in, Google receives the sign-in request. Part of this infrastructure sits outside Vietnam, so data may be processed abroad; we transfer only what is needed to run the service. Beyond those cases we disclose data only when a competent authority requires it under Vietnamese law.
8. Cookies and browser storage
A session cookie holds your signed-in state: necessary, HttpOnly, unreadable from JavaScript. Cloudflare sets an anti-bot cookie on forms. Your browser stores the language you chose and whether you dismissed the cookie notice; that is local storage and is never sent to the server. Google Analytics sets cookies that measure visits: pages viewed, how you arrived, device type and an approximate location from a shortened IP address. Google AdSense sets advertising cookies that choose and count the ads the free service depends on, and Google may use them to personalise ads on other sites. Those two are set by Google and governed by Google's own policy; you can block them in your browser or manage personalisation at adssettings.google.com, and the upscaler still works. Blocking the session cookie prevents sign-in; blocking local storage only loses your language preference.
9. Security
Traffic uses HTTPS. The session cookie is HttpOnly and every request that changes data is checked against CSRF. Passwords are hashed one-way, two-step verification is supported, and sign-in attempts and request rates are limited. The machine that processes images and videos runs with restricted permissions, separate from the database. No system is perfectly secure; if an incident affects your data we notify you and the competent authority as the rules require.
10. Your rights
Under Vietnamese personal data protection law you may be informed, give or withdraw consent, access, correct, erase, restrict and object to processing, request a copy of your data and complain. You delete files in the Library, change email or password, sign out individual devices and delete your account in the Account section yourself. For anything else, email [email protected]; we verify the account owner and reply within the period the law sets. You may complain to the authority responsible for cybersecurity and personal data protection if you believe your rights were infringed. Deleting an account erases the account data and any remaining files; minimal logs are kept to meet legal duties.
11. Changes and contact
We update this policy when the way we handle data changes and show the date at the top of the page. Material changes are announced in the app before they take effect. If you disagree with a new version you can delete your files and your account. Questions about personal data: [email protected].