Privacy Policy

Last updated: October 16, 2026

At UptimeIO.com ("UptimeIO", "we", "us", or "our"), we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website monitoring services.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

  • Email address
  • Name (optional)
  • Password (encrypted)
  • Organization name (if applicable)

1.2 Monitoring Data

To provide our services, we collect and process:

  • URLs and endpoints you choose to monitor
  • Check results (response times, status codes, availability)
  • Incident history and alerts
  • Status page configurations

1.3 Usage Analytics

We use PostHog to understand how our website, dashboard and status pages are used. How it runs depends on where you are:

  • Website: analytics is off by default and only runs after you accept it via the cookie consent banner. If you reject, your visit is only counted anonymously (see our Cookie Policy).
  • Dashboard: for signed-in customers, analytics runs by default and you can turn it off at any time in Settings > Account. Nothing is stored in your browser. We also record dashboard sessions to see how the interface is used; recordings mask all text and everything you type, so your monitor names, URLs and other data are not captured.
  • Public status pages: we count page views anonymously, without cookies or any other storage in the visitor's browser, using the same daily-rotating anonymous hash as for website visitors who reject cookies. Addresses in links are sent without their query string.

Analytics includes:

  • Pages visited and features used
  • Device type and browser information
  • Referral source
  • Session duration and interactions

2. How We Use Your Information

We use the collected information to:

  • Provide, maintain, and improve our monitoring services
  • Send you alerts and notifications about your monitored services
  • Communicate with you about service updates and support
  • Analyze usage patterns to improve user experience
  • Ensure the security and integrity of our platform
  • Comply with legal obligations

Under the General Data Protection Regulation (GDPR), we process your data based on:

  • Contract Performance: Processing necessary to provide our services to you
  • Legitimate Interests: Improving our services, ensuring security, and preventing fraud
  • Consent: For optional communications and certain cookies
  • Legal Obligation: When required by applicable laws

4. Data Sharing and Third Parties

We do not sell your personal data. We only share data with the following categories of service providers:

4.1 Service Providers

  • Email: ZeptoMail and Scaleway Transactional Email Manager (TEM), to deliver transactional emails and incident alert notifications
  • Monitoring Probe Hosting: Vultr and OVH, to host and operate our distributed monitoring agent nodes
  • Network / Tunnel: Cloudflare, for network routing and tunneled connectivity to our infrastructure
  • Application Monitoring: New Relic, for our own application performance and error monitoring
  • Backups: Scaleway Object Storage (Paris, France), to store our nightly database backups
  • Payments: Dodo Payments, to process subscription billing
  • Status Page CDN: Bunny.net, to deliver public status page assets
  • Analytics: PostHog (US-hosted), for product usage analytics (see section 1.3)

4.2 Integrations (User-Configured)

When you connect third-party alert channels, we dispatch relevant incident payloads to:

  • Slack, Telegram, and Pushover (for team alerts)
  • Custom Webhook endpoints defined in your dashboard
  • Email

5. Data Storage and Security

5.1 Data Location

Your customer database records and check execution logs are stored on our application server, located in the European Union. Our monitoring probes that perform checks run separately, from Amsterdam (EU), US West, and Singapore.

5.2 Security Standards

We apply the following security controls:

  • Data is encrypted in transit over HTTPS
  • Passwords are hashed with bcrypt and never stored in plain text
  • Webhook signing secrets are encrypted at rest with AES-256-GCM
  • Optional two-factor authentication (TOTP) is available for your account
  • Rate limiting and standard security headers protect our API
  • Audit logs record account and configuration events such as sign-ins, team membership, monitor changes, and subscription changes

6. Data Retention

We retain your information in accordance with the following schedules:

  • Account Records: Maintained while your subscription is active, and purged within 30 days of account termination upon request.
  • Monitoring & Latency Logs: Retained up to 365 days depending on your account plan tier for SLA and historical trend analysis.
  • Aggregated Telemetry: Anonymized metrics may be retained indefinitely to optimize probe routing.

7. Your Rights (GDPR & CCPA)

Under GDPR, CCPA, and global data privacy standards, you have the right to:

  • Access: Request a complete export of your personal and organization data.
  • Rectification: Correct or update outdated account details via your dashboard.
  • Erasure: Request permanent deletion of all stored data ("Right to be Forgotten").
  • Portability: Export monitor configurations and SLA records in JSON/CSV format.
  • Objection & Restriction: Object to processing or request restricted handling.

To exercise any of these rights, email our data privacy team at [email protected].

8. International Data Transfers

Because our probe nodes execute from multiple geographic regions (Amsterdam in the European Union, US West, and Singapore), probe dispatch metadata may transit international networks. Whenever cross-border data transfer occurs, we enforce European Commission Standard Contractual Clauses (SCCs) to ensure equivalent protection.

9. Children's Privacy

Our services are exclusively intended for professional business and software operations. We do not knowingly solicit or collect personal information from individuals under 18 years of age.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect infrastructure improvements or legal compliance requirements. Material changes will be communicated via email or dashboard notifications prior to taking effect.

11. Contact Us

For any questions regarding this Privacy Policy or our security architecture, contact: