1. Introduction

This Privacy Policy explains how personal data is processed when you visit uptimewire.com, create an account at app.uptimewire.com, or use the UptimeWire website monitoring service (together, the "Service"). It also explains your rights and how to exercise them. This document is written in English. If it is also shown in another language and the versions differ, the English version prevails.

UptimeWire checks whether the websites you add are reachable, whether their SSL certificates and domain registrations are close to expiry, and whether their DNS records change. It tells you when something goes wrong. To do this it needs some information about you and about the sites you choose to monitor.

This policy should be read together with the Terms & Conditions, the Cookie Policy and the Refund Policy.

2. Who is responsible for your data

The operator of the Service and the controller of the personal data described in this policy is:

Because the operator is established in Latvia, no representative in the European Union is needed. We do not specifically target the Service at individuals in the United Kingdom and have not appointed a representative there. We have not appointed a data protection officer; the GDPR does not require one for the kind of processing described here.

When a customer adds the email addresses of its own clients as recipients of client reports, UptimeWire acts as a processor for that customer rather than as a controller. The customer decides why that data is used, and UptimeWire handles it on the customer's instructions. A separate data processing agreement is not offered at this time.

3. What data we collect

3.1 Data you give us

  • Account data. Your name, email address and password. The password is stored only as a hash. If you sign in with Google or Apple, we receive your email address and name from that provider and store the provider name and your identifier at that provider.
  • Profile settings. Preferred language, time zone, an optional profile picture, and your choices about weekly, monthly, product and welcome emails. Product news is opt-in: the box is unticked by default and we record when you ticked it.
  • Security settings. If you turn on two-factor authentication we store a protected secret and backup codes. If you register a passkey we store its name, public credential data and the dates it was created and last used.
  • Monitoring configuration. The addresses (URLs) and domains you ask us to monitor, names you give them, check intervals, alert conditions, expected status codes and keywords, and the email address that receives alerts.
  • Alert channels. A mobile phone number for SMS alerts, a Telegram chat identifier, and addresses and secrets for Slack, Discord, Microsoft Teams and your own webhooks, if you set them up.
  • Team and client data. Names and email addresses of team members you invite, and of clients and report recipients you add. Please make sure you are allowed to give us this information.
  • Status pages. The name, logo and settings of status pages you create.
  • Billing data. Your billing name, address, company name and tax number if you enter them, and the email address used for billing. You enter payment card details directly at Stripe. We do not receive or store your full card number.
  • Support messages. What you write to us, with any files you attach.

3.2 Data we collect automatically

  • Registration and sign-in data. The IP address used at registration and at your latest sign-in, the date and time of those events, and a security log of sign-in and two-factor events that includes the IP address.
  • Browser identifier. When you register, the page creates a technical identifier of your browser using the open-source FingerprintJS library, with its own monitoring switched off. We use it together with your IP address to stop one person from opening several free accounts.
  • Usage and diagnostic data. Technical logs created by our servers when you use the Service, such as errors and the time of requests. The website at uptimewire.com does not use analytics or advertising tools.
  • Cookies and similar technologies. Described in the Cookie Policy.

3.3 Data collected when we monitor a website

When you add a website, our monitoring servers send requests to it under the name "UptimeWireBot/1.0 (+https://uptimewire.com)". For every check we store the time, the monitoring location, whether the check succeeded, the HTTP status code and the response time. If a check fails we also store the kind of error and its message. We read the page body only up to 1 MiB, and only when a keyword rule needs it. We do not store response headers, page bodies or screenshots.

For SSL monitoring we read the certificate expiry date. For domain monitoring we ask the public registration database (RDAP) for the expiry date and name servers. For DNS monitoring we store the records we find and a history of changes. This data relates to websites and domains, not to people, but it can include personal data if a domain name or a page identifies a person. You should monitor only websites you own or are authorised to monitor.

3.4 Data from other sources

Stripe tells us the status of your subscription and payments. Our email provider tells us when an email to you bounced or you unsubscribed, so that we stop sending to that address.

3.5 Visitors to status pages and the free tools

Public status pages, uptime badges and client reports do not set cookies. If a visitor subscribes to updates on a status page operated by UptimeWire, we store the email address after double confirmation and delete it when the visitor unsubscribes. The free tools on uptimewire.com (such as the DNS, HTTP and SSL checks) send the address you type to our server to run the check. We do not store it; we keep only short technical codes in logs.

If the General Data Protection Regulation (GDPR) or the UK GDPR applies, each use needs a legal basis. We rely on the following.

Purpose Data Legal basis
Create and run your account, sign you in, keep it secure Account data, security settings, sign-in data Performance of a contract (GDPR Art. 6(1)(b))
Run monitoring and send alerts, reports and status pages Monitoring configuration, check results, alert channels Performance of a contract
Take payments, issue and keep invoices, handle refunds Billing data Performance of a contract; legal obligation (Art. 6(1)(c)) for accounting records
Answer support requests Support messages, account data Performance of a contract; legitimate interests (Art. 6(1)(f))
Protect the Service: rate limiting, bot checks, fraud and abuse prevention, including the free-plan duplicate check IP address, browser identifier, security log Legitimate interests in keeping the Service secure and fair
Send service emails (security, billing, incident, deletion notices) Email address Performance of a contract
Send product news Email address Consent (Art. 6(1)(a)), which you can withdraw at any time
Improve the Service from technical logs Diagnostic data Legitimate interests
Comply with law and respond to lawful requests As required Legal obligation; legitimate interests in defending legal claims

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object as described in section 9.

5. Who receives your data

We do not sell personal data. We share it with providers who help us run the Service, and only as far as needed for the task.

Provider What it does Data it receives
Stripe Payments, subscriptions, invoices, customer portal Account identifier, name, email, billing address, company and tax details, card details entered at Stripe
Brevo Sends our email Recipient addresses and the content of emails
Sent Sends SMS alerts and verification codes, if SMS is enabled Phone number, message text
Telegram Delivers alerts you route to Telegram Chat identifier, alert text
Cloudflare (Turnstile) Bot check on registration, sign-in, password recovery, the contact form and the free tools Visitor IP address and a challenge token
Google and Apple Sign-in, only if you choose it Email address, name
Slack, Discord, Microsoft Teams and your own webhook endpoints Deliver alerts to the destinations you configure Monitor name, address, incident details
Let's Encrypt Issues security certificates for custom status-page domains Contact email of the operator
Hetzner Hosts our main server in Nuremberg, Germany, which also runs one monitoring location, and the copies of our backups kept on that server All data stored on them
Kamatera Hosts our monitoring locations in Los Angeles and New York (United States), Hong Kong and Sydney (Australia) The addresses you monitor and the results of the checks made there
Contabo Stores encrypted copies of our backups in the European Union Encrypted copies of all data on our main server, which Contabo cannot read

Stripe, Brevo, Sent, Hetzner, Kamatera, Contabo and Cloudflare handle data for the tasks above on our behalf. Stripe, Google, Apple, Let's Encrypt and Telegram also decide for themselves how they use the data they receive, within their own rules. We have accepted the data processing terms of Stripe, Brevo, Sent, Hetzner and Cloudflare. The data processing terms with Kamatera and Contabo are being put in place.

We may also disclose data to professional advisers, to a buyer if the business is sold, and to authorities when the law requires it.

6. Transfers outside your country

Some providers may process data outside the European Economic Area or the United Kingdom, for example in the United States. Where that happens, we need a lawful transfer mechanism, such as an adequacy decision or standard contractual clauses. Our main server is located in Germany and our backups are kept in Germany and elsewhere in the European Union, all within the European Economic Area. Our monitoring locations in the United States, Hong Kong and Australia are outside the European Economic Area; they receive only the addresses you monitor and send back the results of the checks. Providers such as Stripe and Cloudflare may process data in the United States; their data processing terms include standard contractual clauses. For Kamatera, standard contractual clauses are being put in place together with its data processing terms. You can ask us for a copy of the safeguards in use through the contact address in section 2.

7. How long we keep data

We keep data only as long as we need it for the purposes above or as the law requires.

Data Retention
Account data While your account exists. After you delete the account there is a 14-day period in which you can restore it; then it is deleted.
Individual check results For as long as the longest history setting of the plans we offer (seven days at the time of writing), then removed.
Hourly check summaries 90 days
Daily check summaries 2 years
Failure details and engine events 90 days
Client report delivery log 180 days
Payment events received from Stripe 30 days. Invoices and payment records stay with Stripe. We keep our own accounting records for 5 years.
Database backups Copies on our server: 14 days. Encrypted copies in storage: 30 days.
Incidents, alert logs, email and SMS logs, security log Up to 5 years
Support requests and attachments Up to 5 years
IP addresses and browser identifier stored on your user record Until you delete your account, and in any case up to 5 years
Status-page subscribers Until they unsubscribe

When an account is deleted we also remove its monitoring data, status-page logos and support pictures, and we delete the customer record and saved card at Stripe. Invoices remain at Stripe as accounting records.

8. Security

We protect personal data with measures we can describe accurately:

  • Passwords are stored as hashes. API keys are stored as hashes.
  • Two-factor authentication with an authenticator app and passkeys are available to every account, with a lockout after repeated failed codes.
  • Sign-in, registration, API and public page requests are rate limited. A bot check protects the forms.
  • The site is served over HTTPS with strict transport security, a content security policy, same-site cookies and request-forgery protection.
  • Webhook destinations are checked to stop requests to internal networks.
  • Database backups are kept for a limited time.

No system is completely secure, and we cannot promise that data will never be accessed without authorisation. If a personal data breach affects you and creates a risk to your rights, we will tell you and the supervisory authority as the law requires.

9. Your rights

Depending on where you live, you may have the right to:

  • ask whether we process data about you and receive a copy (access);
  • have wrong data corrected (rectification);
  • have data deleted (erasure);
  • ask us to limit how we use data (restriction);
  • receive your data in a structured, commonly used format and transmit it to another service (portability);
  • object to processing based on legitimate interests, and to direct marketing at any time;
  • withdraw consent at any time, without affecting earlier processing;
  • complain to a data protection authority, for example in the country where you live or work. Our supervisory authority is the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv).

How to use them. Signed-in users can download a file with their profile, sites, clients, status pages, team and billing information on the "Your data" page, and can delete the account on the same page. Check history is not part of the file. For any other request, or if you cannot sign in, write to support@uptimewire.com. We may ask you to prove who you are. We aim to answer within one month, as the GDPR requires.

California and other US states. We do not sell personal information and we do not share it for cross-context behavioural advertising.

10. Children

The Service is for businesses and adults. You must be at least 18 years old to use it. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

11. Automated decisions

We do not make decisions that have legal or similarly significant effects on you by automated means. Two automated checks do affect access: the free-plan duplicate check described in section 3.2 can refuse a registration, and failed payments move an account to the Free plan after a period set out in the Terms. If a registration is refused by mistake, write to support@uptimewire.com and a person will review it.

12. Changes to this policy

When we change this policy in a material way, we will post the new version here, change the date at the top and, if you are a registered user, notify you by email before the change takes effect. The version in force is the one on this page.

13. Contact

Questions about this policy and requests about your data: support@uptimewire.com. General questions: contacts@uptimewire.com. Postal address: SIA LAT TEAM, Gaujas iela 9c, Čiekurkalns, Rīga, LV-1026, Latvia.