Política de privacidade

This English version is a courtesy translation; the German version is binding.

This policy describes which personal data we process when you visit this website and use Uptime, for what purpose and on which legal basis, and which rights you have. We only process what the service needs: no advertising, no tracking, no sale of data.

1. Controller

Loading provider details …

For questions about data protection and to exercise your rights, reach us via the contact form. We are not required to appoint a data protection officer.

2. Visiting the website

• Server logs: on every request our server processes the IP address, time, requested address, status code, amount of data transferred and the browser identifier. Purpose: delivery, operational security and defence against attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The logs are deleted after 14 days unless an incident has to be investigated.
• Cloudflare: the website is delivered through Cloudflare’s network (protection against attacks, encryption, faster delivery). Cloudflare processes the connection data on our behalf. Cloudflare, Inc. is based in the USA and certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition.
• Visitor country: Cloudflare tells us the country each request comes from. We use it only to decide whether the imprint details are shown, and do not store it.
• We serve fonts, images and scripts ourselves. No content is loaded from Google Fonts, analytics or advertising services.

3. Cookies and browser storage

We only use what is technically necessary. This needs no consent (Section 165(3) Austrian Telecommunications Act 2021), which is why there is no cookie banner.

• Sign-in cookie: keeps you signed in (the session’s renewal key, unreadable for scripts, HTTPS only). It expires after at most 24 hours without use and is deleted when you sign out.
• “Remember this browser”: only if you tick it when signing in with two-factor protection do we store a cookie that skips the second factor for 30 days. You can remove remembered browsers in the security settings at any time.
• Local storage: chosen language, light or dark appearance, colour theme, last chosen team and whether the sidebar is collapsed. These values stay in your browser and are not sent to us.

4. Customer account and sign-in

• Sign-up: e-mail address, name, chosen plan, language, and the version and time of your consent to the terms and this policy. Legal basis: contract (Art. 6(1)(b) GDPR); we keep the consent as evidence (Art. 6(1)(c) and (f) GDPR).
• Sign-in without a password: we e-mail you a one-time code. It is valid for 15 minutes and stored only as a hash.
• Two-factor protection: if you turn it on, we store the secret key of your authenticator app and your recovery codes, the latter only as hashes.
• Sessions and sign-in history: for every session and sign-in we store the time, IP address, the approximate location derived from it, browser and device. This lets you see and end your sessions in the settings, and lets us detect misuse. Legal basis: contract and legitimate interest in security (Art. 6(1)(b) and (f) GDPR).
• Chosen plan: if you choose a paid plan when signing up, we store this choice with your account, even if the plan cannot be booked yet.
• Ordering a paid plan: we store the version of the terms and the withdrawal instruction, your two declarations on the right of withdrawal and their time as evidence (Art. 6(1)(c) and (f) GDPR).

5. Monitors, check results and alerts

• Monitors: names, targets (addresses, hosts, ports), check type and interval. Our checker requests the targets from our servers and identifies itself with its own user agent.
• Check results: status, response time and error messages, as well as outages and recoveries. For every monitor the last 90 checks and the statistics of the last 90 days stay visible, the same on all plans; outages stay in the history until you delete the monitor or your account.
• Alerts: the e-mail and webhook addresses we send alerts to, and your rules for them. For a webhook we send the monitor, status, error message and time to the address you entered.
• You decide on targets and names. If they contain personal data, you are responsible for processing it. Legal basis for all of this: contract (Art. 6(1)(b) GDPR).

6. Teams and API keys

• Teams: if you invite someone, we process their e-mail address, the role and who invited them, and send an invitation by e-mail. The invitation expires after 7 days. Legal basis: the contract with you and our legitimate interest in enabling teams (Art. 6(1)(b) and (f) GDPR).
• API keys: name, permissions, expiry date and, for every access, the time, IP address and endpoint, so you can review how your keys are used.

7. Contact form and withdrawal

If you write to us via the contact form, we process your name, e-mail address, message and the version of this policy you confirmed, in order to answer your request. Legal basis: pre-contractual measures or our legitimate interest in answering requests (Art. 6(1)(b) and (f) GDPR). We delete the request 12 months after the last message unless it is still needed for a contract or legal claims.

Spam protection: when the form opens, your browser solves a small computing task that our server issues and checks (proof of work). No data is sent to third parties for this and no cookies are set. The form also contains a field invisible to people, by which we recognise automated submissions. Legal basis: legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

Withdrawal: if you declare the withdrawal from a contract on the page “Withdraw from contract”, we process your name, your e-mail address, your details of the contract and the time of receipt in order to handle the withdrawal and to acknowledge its receipt by e-mail. The form is protected against abuse like the contact form. Legal basis: legal obligation and contract (Art. 6(1)(c) and (b) GDPR). We keep the statement with the accounting records for 7 years (Section 132 Austrian Federal Fiscal Code).

8. Operations and support

To run the service, prevent misuse and help you, we as the operator see your account, your monitors and your activity log (sign-up, sign-ins, plan changes, suspensions) and keep internal support notes. Legal basis: contract and legitimate interest (Art. 6(1)(b) and (f) GDPR).

9. Recipients

We only pass on data where the service requires it, and only to processors bound by our instructions:

• Hosting: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The servers are located in data centres in Germany; we run them ourselves, Hetzner provides hardware, power and network.
• Delivery and protection of the website: Cloudflare, Inc. (see section 2)
• E-mail delivery (sign-in codes, invitations, alerts, weekly reports and notices about your account and payment): e-mail service open

Payments: On the free plan we process no payment data and pass on no data for that purpose. Only if you book a paid plan does the payment service Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) handle payment and invoicing. For this we send Stripe your e-mail address, the identifier of your account and the plan you chose. You enter your name, billing address, a VAT ID if you have one, and your payment details directly with Stripe; we neither see nor store card or bank account details. From Stripe we receive your customer identifier and the state of your subscription and payment, and store both with your account. Stripe also processes payment data as a controller in its own right and may transfer data to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. Legal basis: contract (Art. 6(1)(b) GDPR), and for invoices the statutory retention duty (Art. 6(1)(c) GDPR).

Authorities receive data only where we are legally obliged to provide it.

10. Retention

• We keep your account and all related data (monitors, history, channels, API keys, sessions) until you delete the account. You can do this at any time in the settings and download your data there first. After you confirm, the account stays locked for another 7 days so that you can undo the deletion; after that we delete it for good.
• Deleted data disappears from backups after 30 days at the latest.
• Server logs: 14 days. Contact form requests: 12 months.
• Data we must keep for legal reasons is stored for as long as the law requires. This mainly concerns invoices for paid plans (7 years, Section 132 Austrian Federal Fiscal Code).

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interest (Art. 15 to 21 GDPR). You can withdraw any consent at any time with effect for the future. Many of these rights can be exercised directly in the settings (edit profile, download data, delete account).

If you believe we process your data unlawfully, you can complain to the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

12. Obligation to provide data

Without an e-mail address we cannot create an account or send sign-in codes and alerts. Everything else is voluntary or results from your use.

13. No automated decisions

We make no decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR), and we do not create profiles.

14. Changes

When the service or the law changes, we adapt this policy. The current version is shown on this page with its date; we inform you by e-mail about significant changes.