Privacy policy

Who is responsible#

Marius Erik Kinzler, c/o Online-Impressum 11507, Europaring 90, 53757 Sankt Augustin, Germany ("we", "us") runs Uplance at https://uplance.cloud and is responsible for the processing described here. You can reach us at [email protected].

We aren't required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). For questions about your data, write to [email protected].

This policy covers people who use Uplance (account holders and their team members), people who visit status pages hosted on Uplance, people who receive alerts or status updates from it, and people who contact us. When a customer uses Uplance to monitor their services, alert their team or publish a status page, the customer decides what is processed and why; for that data we act as their processor under our data processing agreement, and the customer's own privacy policy applies as well.

Your account#

When you sign up we store your name, email address and password. The password is stored only as an Argon2id hash. We record whether you have confirmed your email address, which workspaces you belong to and in which role, and when you last signed in.

When you sign up with an email address, we send you a link to confirm it; the account can be used once it's confirmed. If someone tries to sign up with an address that already has an account, we don't tell them: we email the account holder instead.

If you turn on two-factor authentication, we store its secret encrypted. If you add a passkey, we store its public key, the name you give it, and when it was added and last used; the private key never leaves your device or password manager.

If your organisation connects its identity provider for single sign-on (SAML), your organisation's identity provider sends us your email address and, if it's configured to, your name when you sign in. We use them to find or create your account and add you to that workspace.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

Your workspaces#

We store what you and your team put into Uplance: monitors and the addresses they check, any credentials or headers you enter for checks (encrypted), check results, response times and error messages, incidents, updates and post-mortems, maintenance windows, status pages with their names, logos and colours, custom domains, alert channels (for example email addresses, Discord, Slack, Microsoft Teams or generic webhook addresses, Telegram chat IDs and ntfy topics), API keys (stored only as hashes), remote agents and an audit log of who changed what.

To run checks, our servers send requests to the addresses you enter and record how they answer. Every request identifies itself with a User-Agent that links to https://uplance.cloud/abuse. Depending on the check type we may keep parts of the response, such as the status code, headers, a certificate, an excerpt of the text that caused a failure or, if you turn it on, a fingerprint and a difference of a page's visible text.

Some checks look things up with public services: the registration expiry of a monitored domain at rdap.org (RDAP), certificates issued for it in public certificate transparency logs at crt.sh, and, for blocklist monitors, whether a server is listed on public DNS blocklists. Only the domain name or server address is sent. A logo you give as an image URL is downloaded once and stored with us, so status pages never load anything from other servers.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Where the addresses or responses contain personal data of others, we process it on behalf of the workspace (Art. 28 GDPR).

Security records#

When you sign in we create a session and store your browser's user agent and when the session was last used. We remember the kinds of device you use (for example "Chrome on Windows") so we can email you when someone signs in from a new one. Sign-ins, failed sign-ins, password and security changes and other important actions are written to the audit log, together with the IP address where relevant; IP addresses are removed from the audit log after 90 days. After you sign in, your browser keeps a cookie that recognises it as one you use, so that failed sign-in attempts by someone else elsewhere can't lock you out of it. To stop brute-force attempts, spam and abuse we count requests per IP address, account or target for short periods.

Before sign-up and sign-in (including with Google or GitHub), password reset, bug reports, the free tools, some other public forms, and before we email a team invitation or an alert confirmation to an address you enter, your browser shows that it isn't a bot: it solves a small computing task and runs a short check that it is a real browser. Both run against Cap, open-source bot protection that we operate on our own server; like every visit to uplance.cloud, these requests pass through Cloudflare (see below), no other third party is involved, and no cookie is set. For this, Cap processes your IP address and the information your browser sends with every request (such as its user agent) to limit requests and detect abuse, and the result of the browser check, which includes the size of your browser window. Cap also keeps anonymous counts of passed and failed checks, for example by operating system.

Legal basis: our legitimate interest in keeping accounts and the service secure and preventing misuse (Art. 6(1)(f) GDPR).

Status page visitors#

Status pages are public. When you open one, our servers process your IP address and browser information to deliver the page and protect it against abuse; we don't store what you looked at together with your IP address. We remember your chosen language and colour theme in cookies. Status pages load nothing from other servers: logos are stored with us.

If you report a problem with "Having problems?", we store your optional note and a hash of your IP address combined with a secret key, so several reports from the same person count once. Reports are deleted after 90 days.

If you subscribe a Discord or Slack channel to a status page, we store its webhook address until you unsubscribe or the status page is deleted, and send it updates about incidents and maintenance.

Legal basis: our legitimate interest and the customer's in informing people about the status of a service (Art. 6(1)(f) GDPR); for subscriptions, your request (Art. 6(1)(b) GDPR).

Visits to our website#

On our own pages (the home page, pricing, help, legal pages, sign-in and sign-up) we count visits: which page, which website linked to it and on which day. We store no cookie, no IP address and nothing else that could identify you, and we don't count visits from browsers that send Do Not Track or Global Privacy Control. The counts are kept for 400 days. Legal basis: our legitimate interest in knowing which pages are useful (Art. 6(1)(f) GDPR).

Google Analytics#

To see which campaigns, links and search terms bring people to Uplance, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It loads only after you have agreed in the cookie notice, and not at all if your browser sends Do Not Track or Global Privacy Control — we treat that as a no, whatever the notice says.

Once loaded, it stores cookies in your browser, gives it a random identifier and sends Google the pages you open, the site that linked you, an approximate location derived from your IP address, and your device, browser and language. We have switched off every advertising use of it (advertising storage, ad personalisation and ad user data are refused by the tag itself), the property is linked to no Google advertising product, and the data-sharing settings in the Analytics account are all off. Data is deleted after 14 months.

Google Ireland Limited processes this for us under Google’s data processing terms. Google LLC in the United States can access it; that transfer relies on the EU-U.S. Data Privacy Framework, to which Google LLC is certified, and on the European Commission’s standard contractual clauses. US authorities may be able to demand access to data held by US companies.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time, with the same single click that gave it: “Cookie settings” at the bottom of any page. Withdrawing stops the tag immediately and does not affect what was collected before.

Emails and notifications#

We send emails you need for your account: confirming your address, resetting your password, invitations, sign-ins from new devices, and billing notices. If you own a workspace, its alerts go to your confirmed account address from the start, until you change or delete that alert channel. If a workspace adds any other email address as an alert channel, we first ask that person to confirm; until they do, no alerts are sent to them. Every alert email contains a link to stop them.

Occasionally we email account holders news about Uplance, such as new features and important changes. You can turn this off at any time under Your account or with the link in every such email; account, security and billing emails still arrive. Legal basis: our legitimate interest in informing customers about our own service (Art. 6(1)(f) GDPR, § 7(3) UWG).

We keep each email (recipient, subject, content and whether it was delivered) for 30 days so failed deliveries can be retried and investigated, then delete it.

Emails are delivered through our own mail server (Poste.io) on our servers at 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany; no separate email service receives the messages.

If you turn on push notifications in your browser, we store the subscription your browser gives us. Notifications are delivered through your browser vendor's push service (for example Google, Mozilla, Apple or Microsoft).

If a workspace connects its own Discord bot, we store the bot token encrypted, the Discord server and channel IDs, and send alert and status messages to that server. Messages to Discord, Slack, Microsoft Teams, Telegram or ntfy are processed by those services under their own terms.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for alert emails to people outside a workspace, their consent (Art. 6(1)(a) GDPR), which they can withdraw at any time.

Payments#

Paid plans are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your payment details on Stripe's pages; we never see your full card or bank details. We receive and store your Stripe customer and subscription IDs, your plan, billing status and renewal date, and Stripe gives us the billing name, address and VAT number you enter for invoices. Stripe also processes data to prevent fraud, under its own privacy policy. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligation to keep invoices (Art. 6(1)(c) GDPR).

If you cancel or withdraw on https://uplance.cloud/cancel, we use your name, email address, the contract you name, the date and, for an extraordinary cancellation, your reason to carry it out and confirm it to you by email, as the law requires (§ 312k BGB). They're kept with the billing records. Legal basis: Art. 6(1)(b) and (c) GDPR.

Abuse reports and contact#

If you report unwanted checks through https://uplance.cloud/abuse, we store the hostname, your message, your email address if you give one, and a hash of your IP address combined with a secret key. We use them to find and stop the checks, and delete the report after one year. If you email us, we use your message and address to answer you.

Legal basis: our legitimate interest in preventing misuse of the service and answering enquiries (Art. 6(1)(f) GDPR).

Cookies#

We only use cookies that are needed for what you ask the site to do: your session after signing in, short-lived cookies that protect sign-in with passkeys, Google, GitHub or single sign-on against forgery, a short-lived cookie for the second sign-in step, a cookie that recognises a browser you've signed in with (180 days; it protects your account from being locked by other people's failed sign-ins), and your chosen language and colour theme.

Your answer to the cookie notice is remembered in one more cookie, for a year, so that we don’t ask again and so that a no stays a no.

We also write the answer down on our side — what was allowed, when, in which language, and a hashed form of the IP address that cannot be turned back into it — because consent has to be demonstrable (Art. 7(1) GDPR). These records are deleted after three years. Legal basis: our legal obligation to be able to show that consent was given (Art. 6(1)(c) GDPR).

Google Analytics sets cookies of its own, but only after you agree to it — see “Google Analytics” above.

Who receives data#

Hosting: 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany (servers in Germany).

Email delivery: our own mail server (Poste.io) on our servers at 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany; no separate email service receives the messages.

Payments: Stripe Payments Europe, Ltd. (see above).

Website analytics, only if you agree to it: Google Ireland Limited (see above).

Network delivery, DNS and protection against attacks for uplance.cloud (all visits pass through it, including IP addresses): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Spam checks for emails sent to us (the sending mail server's IP address and domain are looked up in public blocklists): Spamhaus Technology Ltd., United Kingdom, and other public DNS blocklists. For completeness, not processors: the service, its database and mail server are deployed and managed with Coolify, which we run ourselves on our own servers, so no data goes to Coolify's makers. Browser checks run in a Chromium browser (Playwright) on our own servers. HTTPS certificates come from Let's Encrypt (Internet Security Research Group, San Francisco, USA), which only sees domain names, not visitor data.

Everyone who processes data on our behalf does so under a data processing agreement. Some of these companies, or companies in their groups, are in the United States. Transfers there rely on the EU-U.S. Data Privacy Framework where the company is certified, and otherwise on the European Commission's standard contractual clauses.

Messages you choose to send to Discord, Slack, Microsoft Teams, Telegram, ntfy or your own endpoints go to those recipients as part of the service.

We don't sell personal data and don't use it for advertising.

How long we keep data#

Account data: until you delete your account. Workspaces that only you use are deleted with it. Check results: as long as the workspace's retention setting allows, at most 30 days on Free, 90 days on Pro and 365 days on Business; daily summaries for 400 days. Sessions: they end after 7 days without use and after 30 days at most. Audit log: 365 days; IP addresses in it: 90 days; the name typed in a failed sign-in to an account that doesn't exist: 30 days. Alert delivery logs and emails: 30 days. Problem reports from status pages: 90 days. Abuse reports: one year. Invitations: 30 days after they expire or are used. Password reset and confirmation links: 7 days after they expire or are used. Rate-limit counters: until their time window ends, from minutes to a day. Invoices, billing records and withdrawals (name, email address, contract, date and refund): as long as tax and commercial law requires, in Germany up to ten years (§ 147 AO, § 257 HGB). Backups: a database backup every night, stored on our servers at 24fire GmbH in Germany, kept for 30 days and then deleted.

Your rights#

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18) and to receive it in a machine-readable format (Art. 20). Where we rely on consent, you can withdraw it at any time with effect for the future.

You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR).

Much of this you can do yourself: "Download my data" and "Delete account" are under Your account in the dashboard. For anything else, write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Security#

Passwords are hashed with Argon2id. Two-factor secrets, check credentials and bot tokens are encrypted; API keys, session tokens and one-time links are stored only as hashes. Every database query of the dashboard is bound to one workspace, connections are encrypted with TLS, and access to the operator console requires two-factor authentication. If you find a security problem, please tell us as described at https://uplance.cloud/security.

Do you have to provide data?#

You need to give us an email address and a password, or use a passkey, Google, GitHub or single sign-on, to create an account; without it we can't provide the service. Everything else is up to you.

We don't use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Changes#

We update this policy when the service or the law changes. The date at the top shows the current version. We tell account holders by email about significant changes.