I had also started working on one, pre-amadeus but gave up when everything changed over.
One thought around getting around PII/CCPA/GDPR would be using the browser push-notification system so that the E-UP reminder was tied to the PNR but no PII. When the user pulls the PNR, they could opt into the upgrade reminder and then just schedule the push notification for a later time. This would break if the booking changes but would largely solve the problem.