What We Collect
We collect only the information needed to provide the First Officer advisory service. This includes:
- Your name, email address, and phone number
- Names of your credit cards and loyalty programs (not card numbers)
- Loyalty program point and mile balances
- Travel preferences, goals, and dates
- Conversation history with First Officer via WhatsApp
- If you connect your email (Level 2): the travel, rewards and expense messages in that mailbox, so bookings, transfers and expiring credits can be tracked. We do not read the rest of your inbox and we never send mail as you.
- If you connect a card or account through Plaid (Level 3): read-only transaction and balance data, so spend can be routed to the right card. Never your login, your full card number or your account credentials.
Both connections are optional, read-only, and revocable at any time from your email provider, your bank or Plaid, without telling us first. The Trust page sets out exactly what each level can and cannot see.
How We Use Your Data
We use your information to:
- Provide the advisory service: generating personalized card routing recommendations, alerts, and strategy
- Send proactive alerts about expiring credits, transfer bonuses, and award availability
- Personalize recommendations based on your specific cards, balances, and travel goals
- Improve the accuracy and quality of our AI-generated advice
How Your Conversations Improve the Service
Every client conversation helps sharpen First Officer's recommendations for the next one. We do this through a three-layer architecture:
- Never collected. Your passwords, full card numbers, bank account numbers, Social Security numbers, credit scores, and income data are never collected by our software or AI tools under any circumstance.
- Private to you. Your name, phone, email, card names, loyalty program names, balances, travel goals, and conversation history are stored in your isolated row. They are never visible to other clients.
- Anonymized patterns. Aggregated, de-identified patterns: question and answer structures, vendor MCC behavior observations, transfer route outcomes, all flow into the shared knowledge base that informs future recommendations for all clients. Your identity, specific portfolio, and individual history never enter this layer.
You can request deletion of your private layer at any time via email to compliance@upnonstop.com or through the Do Not Sell My Info section below.
Third-Party Processors
We work with a small number of trusted third-party processors to deliver the service:
- Supabase: database and application hosting, on managed Postgres infrastructure in the United States, encrypted at rest and in transit
- Stripe: payment processing for subscriptions and award search fees
- Anthropic / Claude: AI processing to generate personalized recommendations
- Meta / WhatsApp: message delivery for the advisory service
- Plaid: read-only card and bank connections, when you choose Level 3. Your credentials go to Plaid and your bank, never to us. Plaid processes that data under its own End User Privacy Policy.
- Resend: transactional email, for receipts and account mail when the message thread is not the right channel
Each processor operates under its own privacy policy and is contractually required to protect your data.
Data Retention
Your data remains active for the duration of your subscription. After cancellation, all personal data is deleted within 30 days.
Raw emails forwarded to First Officer (for statement parsing or balance updates) are deleted within 24 hours. Only the structured data extracted from those emails, such as point balances and transaction categories: is retained.
Data Security
All client data is stored with row-level isolation in Supabase, meaning your data is completely separated from every other client at the infrastructure level. We use encryption in transit and at rest.
Your Rights Under CCPA (California)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used
- Delete your personal information upon request
- Opt out of the sale of your personal information, though we want to be clear: we do not sell your data to anyone, ever
- Non-discrimination: we will not treat you differently for exercising your privacy rights
Where We Operate, and Your Rights Wherever You Live
First Officer is sold to businesses and residents of the United States. We operate from the United States and our processors store data there, so if you use the service your information is processed in the United States.
Your rights do not depend on your passport. Whatever your citizenship, and wherever you live, you can ask us what personal information we hold about you, ask us to correct it, and ask us to delete it. We verify the request, act on it, and confirm in writing within 45 days, and we will never treat you differently for asking. That is the same commitment we make to California residents, extended to everybody, because splitting it by nationality would be both harder to administer and worse.
If you are physically in the European Economic Area or the United Kingdom while using the service, European data protection law may apply to that processing, and the rights above are how you exercise it. Write to compliance@upnonstop.com and we will handle it on the same terms.
Cookies
We use minimal cookies. Stripe sets what it requires for secure checkout processing, and we use Google Analytics 4 to understand how the site is used, which sets analytics cookies and collects a truncated IP address, pages viewed, and general device information. We do not use advertising cookies or advertising tracking pixels, we do not sell or share this data, and we do not use it to build advertising profiles. You can opt out of Google Analytics entirely with Google's browser add-on, or by using your browser's Do Not Track or cookie controls.
Children
First Officer is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the revised policy.
Contact
Questions about your data or this policy? Reach us at compliance@upnonstop.com or message us on WhatsApp.