What We Collect
We collect only the information needed to provide the First Officer advisory service. This includes:
- Your name, email address, and phone number
- Names of your credit cards and loyalty programs (not card numbers)
- Loyalty program point and mile balances
- Travel preferences, goals, and dates
- Conversation history with First Officer via WhatsApp
- If you ask us to call you through the site: your answers on that form, and the technical details your browser sends with it (browser and device type, screen size, time zone, the page you came from and, unless Do Not Track or Global Privacy Control is on, how you first arrived on the site). They are kept in a Google Sheet and emailed to the desk, and we use them only to handle the request and to keep the form free of spam. None of your answers go to Google Analytics.
- If you connect your email (Level 2): the travel, rewards and expense messages in that mailbox, so bookings, transfers and expiring credits can be tracked. We do not read the rest of your inbox and we never send mail as you.
- If you connect a card or account through Plaid (Level 3): read-only transaction and balance data, so spend can be routed to the right card. Never your login, your full card number or your account credentials.
Both connections are optional, read-only, and revocable at any time from your email provider, your bank or Plaid, without telling us first. The Trust page sets out exactly what each level can and cannot see.
How We Use Your Data
We use your information to:
- Provide the advisory service: generating personalized card routing recommendations, alerts, and strategy
- Send proactive alerts about expiring credits, transfer bonuses, and award availability
- Personalize recommendations based on your specific cards, balances, and travel goals
- Improve the accuracy and quality of our AI-generated advice
How Your Conversations Improve the Service
Every client conversation helps sharpen First Officer's recommendations for the next one. We do this through a three-layer architecture:
- Never collected. Your passwords, full card numbers, bank account numbers, Social Security numbers, credit scores, and income data are never collected by our software or AI tools under any circumstance.
- Private to you. Your name, phone, email, card names, loyalty program names, balances, travel goals, and conversation history are stored in your isolated row. They are never visible to other clients.
- Anonymized patterns. Aggregated, de-identified patterns: question and answer structures, vendor MCC behavior observations, transfer route outcomes, all flow into the shared knowledge base that informs future recommendations for all clients. Your identity, specific portfolio, and individual history never enter this layer.
You can request deletion of your private layer at any time via email to compliance@upnonstop.com or through the Your Rights section below.
Third-Party Processors
We work with a small number of trusted third-party processors to deliver the service:
- Supabase: database and application hosting, on managed Postgres infrastructure in the United States, encrypted at rest and in transit
- Stripe: payment processing for subscriptions and award search fees
- Anthropic / Claude: AI processing to generate personalized recommendations
- Meta / WhatsApp: message delivery for the advisory service
- Plaid: read-only card and bank connections, when you choose Level 3. Your credentials go to Plaid and your bank, never to us. Plaid processes that data under its own End User Privacy Policy.
- Resend: transactional email, for receipts and account mail when the message thread is not the right channel
- Google Calendar and Google Meet: scheduling and the video call for the Found Money Call, when you choose to pick a time. Google Calendar receives the name, email and any note you enter when you book, sends the invite and reminder emails, and adds a Google Meet video link
Each processor operates under its own privacy policy and is contractually required to protect your data.
Data Retention
Your data remains active for the duration of your subscription. After cancellation, all personal data is deleted within 30 days.
Raw emails forwarded to First Officer (for statement parsing or balance updates) are deleted within 24 hours. Only the structured data extracted from those emails, such as point balances and transaction categories: is retained.
Data Security
All client data is stored with row-level isolation in Supabase, meaning your data is completely separated from every other client at the infrastructure level. We use encryption in transit and at rest.
Your Rights, and Do Not Sell My Info
We do not sell your personal information and we do not share it for cross-context behavioral advertising. You can still exercise every right below, at any time, in one email.
- Know: ask what personal information we hold about you, where it came from, and what it is used for. We answer in plain language.
- Correct: if anything we hold is inaccurate, tell us and we correct it.
- Delete: ask us to delete your personal information. We delete all of it within 30 days and confirm in writing what was removed.
- Opt out of the sale or sharing of your personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising. If that ever changed, this is where you would opt out first. You can register the request now and it stands.
- Non-discrimination: we will not treat you differently for exercising your privacy rights.
If you are a California resident, these are your rights under the CCPA.
How to make a request
One email, no forms, no portal. Send your request to compliance@upnonstop.com from the email or phone number on your account, and say what you want: know, correct, delete, or opt out. We verify it is you, act on it, and confirm in writing within 30 days.
Where We Operate, and Your Rights Wherever You Live
First Officer is sold to businesses and residents of the United States. We operate from the United States and our processors store data there, so if you use the service your information is processed in the United States.
Your rights do not depend on your passport. Whatever your citizenship, and wherever you live, you can ask us what personal information we hold about you, ask us to correct it, and ask us to delete it. We verify the request, act on it, and confirm in writing within 30 days, and we will never treat you differently for asking. That is the same commitment we make to California residents, extended to everybody, because splitting it by nationality would be both harder to administer and worse.
If you are physically in the European Economic Area or the United Kingdom while using the service, European data protection law may apply to that processing, and the rights above are how you exercise it. Write to compliance@upnonstop.com and we will handle it on the same terms.
Cookies
We use minimal cookies. Stripe sets what it requires for secure checkout processing, and we use Google Analytics 4 to understand how the site is used, which sets analytics cookies and collects a truncated IP address, pages viewed, and general device information. We do not use advertising cookies or advertising tracking pixels, we do not sell or share this data, and we do not use it to build advertising profiles. You can opt out of Google Analytics entirely with Google's browser add-on, or by using your browser's Do Not Track or cookie controls.
Children
First Officer is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the revised policy.
Contact
Questions about your data or this policy? Reach us at compliance@upnonstop.com or pick any channel on our booking page.