Privacy Policy

1. Introduction

We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data.

2. Data Controller

The data controller is LaunchX GmbH, the company behind UptimeEye. For privacy-related inquiries, contact us at: contact@uptimeeye.com.

3. Hosting and Infrastructure

  • Hosting: Our frontend and backend services are hosted on Hetzner servers in Germany.
  • Database backups: Encrypted database backups are stored with Amazon Web Services (AWS) in Frankfurt, Germany (Amazon S3, region eu-central-1). Log data from UptimeEye Logs is held in a separate log store that is not backed up (see section 5).
  • Check probes: Our probes run at six locations. The location eu-central-1 runs on our Hetzner servers in Falkenstein, Germany. The five locations outside the EU (us-east-1, us-west-2, ap-southeast-1, ap-southeast-2 and sa-east-1) run on Amazon Web Services (AWS) in the United States, Singapore, Australia and Brazil. For monitors that use those locations, AWS processes the monitor configuration, including secure variables, and the check responses. Results are sent back and stored in Germany. Monitors that use only eu-central-1 are checked only from our hosting in Germany and are never sent to a probe outside the EU.
  • Payments: We use Stripe to process payments. Stripe may process your payment data according to their privacy policy.

4. Personal Data We Collect

  • Account Information: Name, email address, and password.
  • Usage Data: API requests, monitors, scheduled tasks, status pages, incidents, and logs (for log data, see section 5).
  • Technical Data: IP address, browser type, and operating system.
  • Payment Data: Processed by Stripe, we do not store your payment details.

5. Log Data You Send to UptimeEye Logs

If you use UptimeEye Logs, you send us the log output of your own systems. We store it so that you can search it. Log data frequently contains personal data of your users (for example IP addresses, user identifiers, e-mail addresses or request details). For this data you are the controller and we act as your processor under Art. 28 GDPR; a data processing agreement is available on request at contact@uptimeeye.com.

  • Where: Log data is stored exclusively on our own servers at Hetzner Online GmbH in Falkenstein, Germany. It is not transferred to any third country and no third-party service processes its content, with one exception you control: if an admin of your organization switches on Log access for the AI assistant, the log lines the assistant reads to answer a question are sent to its model provider (OpenAI, United States, or the organization's own provider).
  • Isolation: Each organization has its own isolated tenant. Ingest keys can only write; reading requires a signed-in member of the organization.
  • Retention: Log data is kept for the period of your plan — currently 3 days (Free), 7 days (Pro) or 15 days (Agency) — and is removed automatically afterwards. Physical storage is reclaimed within 31 days at the latest.
  • Deletion: When you delete an organization, we queue the deletion of its entire log tenant immediately and remove the data from our storage; this normally completes within an hour. Log data is held in a separate log store, not in our database, so it is not part of our database backups, and the log store itself is not backed up.
  • Your responsibility: Please do not send us data you are not permitted to process, and mask secrets and special categories of personal data before shipping logs.

6. Mobile App

If you use the UptimeEye app for iOS or Android, it signs you in with the same account (Clerk) and loads the data of your organization from our servers in Germany, as the web app does. On top of that:

  • Your device: when you turn on push, the app registers the device's push token with us, together with its platform, app version, language and a device name that only you see in the app. We keep this until you sign the device out in the app, delete your account, or Google reports the token as no longer valid.
  • Push notifications are optional. If you turn them on, they are delivered through Google (Firebase Cloud Messaging, Google LLC, USA) and, on iPhone and iPad, through Apple's push service (Apple Push Notification service). A push contains only the name of the monitor, scheduled task or log alert, its status, the name of the organization, a time, the first name of a member who acknowledged an outage and internal IDs. It never contains URLs, log lines or check responses. Google processes this data on our behalf as a processor. Legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by turning push off in the app or in your device settings.
  • App lock with Face ID, Touch ID or a fingerprint is checked on your device; the app only learns whether the check passed. No biometric data leaves your device.
  • The app contains no advertising or tracking SDKs.

7. Legal Basis for Processing

  • Consent: When you use our service, we may ask for your consent to process your data for specific purposes.
  • Contractual Necessity: To provide our service, we may need to process your personal data.
  • Legal Obligation: We may process your data to comply with legal regulations, such as tax or accounting obligations.

8. Data Security

We use security measures to protect your data, but no system is 100% secure. We cannot guarantee absolute security. However, we continuously monitor and improve our security practices.

9. Third-Party Services

We may share your data with trusted third-party services such as Stripe (payments), Clerk (authentication and user management), Resend (transactional and alert emails) and AWS (encrypted database backups in Frankfurt, Germany, and check probes outside the EU, only for monitors that use those locations). Clerk (United States) processes your name, email address, login and session data. Resend (United States) sends our transactional and alert emails and processes the recipient address and the alert content, such as the monitor or task name, status and time. Clerk, Resend and AWS process this data on our behalf as processors, bound by data processing agreements with appropriate safeguards. For every organization we create a Stripe customer record with the name of the organization, including on the Free plan without a subscription; payment data is processed only if you take out a subscription. Stripe processes payment data as an independent controller under its own privacy policy. If you turn on push notifications in the mobile app, Google (Firebase Cloud Messaging, United States) delivers them on our behalf as a processor; it receives the device's push token and the content of the notification (the name and status of the monitor, task or log alert, the organization's name and internal IDs). If members use the AI assistant in the app, OpenAI (United States) processes the chat messages and the data the assistant reads to answer them on our behalf as a processor: the configuration of monitors, tasks, notification channels and status pages and the status, error messages and timings of checks, never response bodies, headers or secure variable values; log lines only if an admin of the organization switched on Log access. An organization can set its own model provider instead; the assistant then sends this data only there, and the organization is responsible for that provider.

10. Data Transfers to Third Countries

Some of the services we use, such as AWS, Clerk, Resend and Stripe, transfer your personal data outside the European Economic Area (EEA). AWS runs our check probes at the locations outside the EU, in the United States, Singapore, Australia and Brazil, and receives the configuration and check responses of monitors that use those locations. Clerk (authentication and user management), Resend (transactional and alert emails) and Stripe (payments and the customer record of your organization) receive data in the United States. If you turn on push notifications in the mobile app, Google (Firebase Cloud Messaging) receives the push token of your device and the notification content in the United States. The current list of subprocessors is on our Trust & Security page. We ensure that any such transfers comply with applicable data protection laws: they are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs).

11. Retention of Your Data

We retain your personal data for as long as necessary to provide our services and to comply with legal obligations. The retention period varies depending on the type of data and the purpose of processing. If you request deletion of your data, we will comply, unless we are required by law to retain certain data.

12. Your Rights

As a user, you have the following rights regarding your personal data:

  • Right to access: You can request information about the personal data we process about you.
  • Right to rectification: You can request corrections or updates to your personal data.
  • Right to deletion: You can request that we delete your personal data.
  • Right to restrict processing: You can request that we limit the processing of your personal data.
  • Right to data portability: You can request a copy of your data in a structured, commonly used format.
  • Right to object: You can object to the processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us at contact@uptimeeye.com.

If you believe that we are processing your data unlawfully, you also have the right to lodge a complaint with the relevant supervisory authority (Art. 77 GDPR).

13. Automated Decision Making and Profiling

We do not use automated decision-making processes or profiling that have legal effects or significantly affect you.

14. Use of Cookies

We use cookies to ensure the proper functioning of our website and provide you with a seamless experience. Specifically, we use the following types of cookies:

  • Session Cookies: These cookies are necessary for the proper functioning of the website, such as maintaining your logged-in session. They are deleted when you close your browser.
  • Clerk Cookies: These cookies are set by our authentication provider Clerk to manage your login state and ensure secure access. They are deleted when your session ends. Learn more about Clerk's privacy practices.
  • Stripe Cookies: Stripe uses cookies to process payments and enhance security. We do not store payment information, but Stripe processes it according to their Privacy Policy.

15. Contact Us

For privacy concerns or any questions about how we handle your personal data, please contact us at: contact@uptimeeye.com

16. Data Protection Officer

If we are required by law to appoint a Data Protection Officer (DPO), their contact details will be provided here.