Support.
Support is email, answered by the people who build the product. There is no phone line, no live chat and no ticket portal, and this page says so rather than leaving you hunting for one that does not exist.
Getting help
Write to us.
One address covers everything about using the product. The specialised addresses further down exist because those messages need to reach a different pair of eyes, not because support is a maze.
Support
If Lupee missed a commitment it should have caught, that is worth sending too. Extraction is a model and models are wrong sometimes. The examples where it was wrong on your channels are more useful to us than any benchmark.
What to put in the message
- What you expected to happen and what happened instead
- Which platform the channel is on: Discord, Telegram or Slack
- Roughly when it happened, with a timezone if you can
- The workspace, server or group name, so we can find the right account
- A screenshot if it helps, with anything sensitive covered up first
What never to put in it
- Passwords. We will never ask for one and we cannot use one
- API keys, bot tokens or access tokens. If you think one leaked, rotate it on the platform first, then tell us
- Card numbers or bank details. Billing is handled by Stripe and we do not hold card numbers
Response times
Response times.
We publish the targets we have actually committed to elsewhere and nothing else. There is no service level agreement behind ordinary support mail, and inventing one here would be a promise with nothing under it.
| What | Target | Where it is written |
|---|---|---|
| Acknowledge a vulnerability report | 2 business days | Security page, response targets |
| Initial assessment and severity of a vulnerability | 5 business days | Security page, response targets |
| Update to the person who reported it | At least every 14 days until it is closed | Security page, response targets |
| Answer a data rights request, including access, export and erasure | Within one month, extendable by two further months for a complex request, and we tell you inside the first month if we extend | Privacy policy, your rights |
| Tell a customer about a security incident affecting data we process for them | Without undue delay, and within 72 hours of becoming aware | Security page and the data processing addendum |
Everything else has no published target. This is a small team, there is no formal on-call rotation outside business hours, and response outside those hours is best effort. Those targets are also targets rather than a contractual service level, and the security page says the same thing in the same words.
Security
Reporting a vulnerability
If you have found a way to reach data that is not yours, this is the address, and it is the only one worth using for it.
Security disclosure
The same address is published at /.well-known/security.txt. Include what you found, where, the steps to reproduce it with any request or payload needed, the impact you think it has, and how you would like to be credited if you would.
What we ask, and what we give back
Give us reasonable time to fix it before telling anyone else. 90 days is the default. Test only against your own account, do not touch anyone else's data, and no denial of service testing, spam, social engineering or physical attacks.
In return we will not pursue legal action over good-faith research that follows those rules, we will keep you informed, and we will credit you if you want it. There is no paid bug bounty programme today, and we would rather say that up front than have you find out after the report.
The full position is on the security page, including which certifications we do not hold.
During an incident
When something breaks.
A published uptime status page is planned and it does not exist today. Saying that is more useful than pointing you at a page that would not be updated.
If the product is down or degraded
Write to the support address. We will tell you what we know at the time, including when the honest answer is that we do not yet know the cause. Until the status page exists, that email is the fastest route to a real answer rather than a guess.
If your data was involved
Where we process data on behalf of your organisation, we notify the organisation that controls it without undue delay and within 72 hours of becoming aware. Where we are the controller, we notify the supervisory authority within 72 hours where the law requires it, and affected people without undue delay where the risk is high.
What you will be told
What happened, what data was involved, what we have done and what you should do. We will not wait until every detail is known before telling you something, and we publish a write-up once the investigation is finished and it is safe to do so.
Your data
Your data rights.
Most of this is self-service in Settings. The rest is one email, and there is no charge for any of it.
Export
Export your data from Settings. If you cannot sign in, or you want a copy of everything we hold rather than what the app exports, write to privacy@lupee.app.
Deletion
The control is in Settings, and there is a route that needs no account on the account deletion page. That page also lists what deletion removes, what is kept, and how long each step takes.
Everything else
Correction, restriction, objection and portability all go to the privacy address. We may ask you to verify your identity first, and we will not ask for more than we need to do that.
Addresses
Which address to use.
Anything to do with using the product: a connector that will not authorise, extraction that is missing things or inventing them, billing that looks wrong, an account you cannot get back into, or a deletion request.
Vulnerability reports and anything that looks like a security weakness. Do not send these to the support address, because the security address is the one that is watched for them.
Data rights requests: a copy of what we hold, correction, restriction, objection, portability, or a question about the transfer mechanism used for a specific subprocessor.
Reporting a use of Lupee that breaks the acceptable use policy, including reading a channel someone had no business reading.
Contract questions, the data processing addendum, and anything from a lawyer.
The legal pack
Every policy, in one place.
Everything is bought on the web today and handled by us, on the terms below. When the phone apps reach the stores, anything bought inside one of them will be refunded by Apple or Google instead, because the store is the seller of record for those.
- Terms of service
The agreement, and how it ends.
- Privacy policy
What is processed, why, and for how long.
- Data processing addendum
The processor terms for an organisation.
- Subprocessors
Every third party, and what each one sees.
- Refund policy
Refunds, cancellations and the withdrawal right.
- Acceptable use policy
What the product may not be used for.
- Security and data handling
Controls, retention and the honest position on certifications.
- Limits and fair use
The token ceilings and the platform limits.
- Billing and plans
Manage a subscription bought on the web.