Privacy Policy
Version 2026-11-09 · Controller: [Company name]
This policy explains how [Company name], [registered address] ("we", "us") handles personal data when you use UpTimeLine (the "Service") and visit our website. It applies to the data for which we decide the purposes and means (we are the controller). Where we process personal data on behalf of a customer, for example the contact details a customer enters to receive alerts, we act as a processor and the Data Processing Addendum applies.
Contact for privacy matters: [privacy email]. We have not appointed a Data Protection Officer because we are not required to; the contact above handles all requests.
1. What data we process and why
| Data | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account data | name, email, optional phone number, language, password (stored only as a salted hash), Google account identifier if you sign in with Google | create and run your account, authenticate you, contact you about the Service | performance of the contract (Art. 6(1)(b)) |
| Terms acceptance record | version of the Terms and Privacy Policy accepted, date and time | prove what you agreed to | legitimate interest (Art. 6(1)(f)); legal claims |
| Service configuration | monitors (addresses, types, intervals), alert settings, team members and roles, maintenance windows, status page settings | provide the Service | contract (Art. 6(1)(b)) |
| Monitoring results | status, response time, status code, error message, DNS records observed, incidents | provide the Service, reports, status pages | contract (Art. 6(1)(b)) |
| Alert destinations | email addresses, webhook addresses, chat identifiers you enter | deliver alerts you configured | contract (Art. 6(1)(b)) |
| Billing data | plan, payment status, customer and subscription identifiers from our payment provider, invoices, VAT number | charge, invoice, meet tax duties | contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Technical and security data | request logs (method, path, status code, duration, account identifier), security events, rate-limit counters | secure and operate the Service, prevent abuse, fix faults | legitimate interest (Art. 6(1)(f)) |
| Support communications | messages you send us and our replies | answer you, improve the Service | contract (Art. 6(1)(b)); legitimate interest |
| Status page subscribers | email address of people who subscribe to a status page | send status updates they asked for | consent / contract (Art. 6(1)(a)/(b)) |
We do not sell personal data. We do not use advertising or cross-site tracking cookies, and we do not profile you for advertising.
2. Cookies and similar technologies
We use only what is strictly necessary: session cookies that keep you signed in (and a short-lived cookie used during sign-in with Google), and your browser's local storage for preferences such as language, theme and the active team. These do not require consent. If we later add analytics or any non-essential technology, we will ask for your consent first and update this policy.
3. Where the data comes from
From you; from your team members who invite or configure things; from your sign-in provider (Google gives us your name, email address, and account identifier when you choose to sign in with it); and from the monitoring checks themselves.
4. Who receives data
We use service providers (processors) to run the Service, bound by contracts that require them to protect the data and use it only on our instructions. They are listed on the sub-processors page and include providers for hosting, payments, email delivery, backups and, where used, AI services. Messaging platforms you connect (Slack, Discord, Telegram, Microsoft Teams) receive the alert content you ask us to send; they act under their own terms. We may disclose data where required by law or to protect rights, safety and security.
5. Transfers outside the EEA
Our main infrastructure is hosted in the European Union. Some providers, or the locations from which monitoring checks are run, may be outside the EEA. Where personal data is transferred outside the EEA we rely on an adequacy decision or on Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the safeguards.
6. Automated processing and AI
We use automated systems, including AI, to help operate and support the Service (see section 12 of the Terms). We limit the personal data made available to them to what is needed for the task, and we do not use customer content to train AI models. We do not take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you; decisions such as suspending an account for abuse or refusing a refund are reviewed by a person. You can ask for human review at any time at [privacy email].
7. How long we keep data
| Data | Retention |
|---|---|
| Account data and configuration | while your account exists, then deleted within 30 days of account closure, except as below |
| Monitoring results (checks, DNS snapshots) | up to 90 days, then deleted automatically |
| Request and security logs | up to 30 days |
| Backups | encrypted, kept for up to 30 days, then overwritten |
| Invoices and accounting records | as the tax law requires (in Italy, 10 years) |
| Terms acceptance records | for as long as needed to defend legal claims, up to 10 years after account closure |
| Support communications | up to 2 years after the last message |
| Status page subscribers | until they unsubscribe or the status page is removed |
8. Security
We use measures appropriate to the risk, including encryption in transit, hashed passwords, encrypted backups, access controls and logging, protections against requests to internal addresses, and limited access for staff and automated systems. No system is completely secure. If a personal data breach occurs that is likely to put people at risk, we will notify the competent authority within 72 hours where required and tell affected customers without undue delay.
9. Your rights
Under the GDPR you may ask us for access to your data, correction, deletion, restriction, portability, and you may object to processing based on legitimate interests; where we rely on consent you may withdraw it at any time. To exercise a right write to [privacy email]; we will reply within one month. You also have the right to lodge a complaint with a supervisory authority, for example the authority in the country where you live or work, or in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it).
10. People who receive alerts from our customers
If a customer entered your email address or messaging details so that you receive alerts, we process them for that customer. To exercise your rights, contact the customer first; you may also write to [privacy email].
11. Children
The Service is for businesses and is not directed to people under 18. We do not knowingly collect their data.
12. Changes
We may update this policy. We will tell you about material changes by email or in the app, and the version at the top shows which text applies.