Privacy policy

Last updated: 18 October 2026

This policy describes how [Company name] processes the personal data of people who visit the website, create a UptimeAnchor account or interact with status pages published by our customers, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. 1.Data controller

   The data controller is [Company name], registered office at [Address], VAT no. [00000000000], email [privacy email], certified email (PEC) [PEC]. The Data Protection Officer (DPO), where appointed, can be reached at [DPO email].

2. 2.Data we process

   • Account data: name, email, password (stored only as a hash), language, time zone, two-factor authentication settings.
   • Organisation and billing data: company name, address, VAT number, SDI recipient code or PEC, payment history. Card details are handled directly by Stripe and are not stored by us.
   • Configuration data: monitors, URLs and hosts checked, alert contacts (emails, phone numbers, webhook URLs), status pages.
   • Technical and usage data: IP address, browser type, access logs, team activity log, API keys (hashed).
   • Status page subscriber data: email address and subscription confirmation date.
   • Data sent via the contact form: name, email, company and message content.

3. 3.Purposes and legal bases

   Purpose	Legal basis
   Providing the service, managing the account and sending configured notifications	Performance of a contract (Art. 6(1)(b) GDPR)
   Invoicing and tax and accounting obligations	Legal obligation (Art. 6(1)(c) GDPR)
   Security, abuse and fraud prevention, technical logs	Legitimate interest (Art. 6(1)(f) GDPR)
   Replying to requests sent via the contact form	Pre-contractual measures and consent (Art. 6(1)(b) and 6(1)(a) GDPR)
   Service communications (changes to the Terms, security notices)	Performance of a contract and legal obligation
   Newsletters and marketing communications, if requested	Consent, which can be withdrawn at any time (Art. 6(1)(a) GDPR)

4. 4.Our role as processor for customer data

   For personal data that customers enter into the service about third parties, such as subscribers to their status pages or on-call team members' contacts, the customer is the controller and UptimeAnchor acts as a processor under Article 28 GDPR. The related terms are set out in the data processing agreement (DPA), available on request.

5. 5.Recipients and sub-processors

   Data is processed by authorised staff and by providers acting as processors, selected for adequate security guarantees:

   • hosting and infrastructure providers with data centres in the European Union: [Hosting provider];
   • Stripe Payments Europe Ltd., for payment processing;
   • transactional email providers: [Email provider];
   • SMS and voice call providers: [SMS provider];
   • third-party services chosen by the customer for notifications (for example chat platforms), to which data is sent on the customer's instructions.

   The up-to-date list of sub-processors is available on request. Data is never sold or disclosed to third parties for marketing purposes.

6. 6.Transfers outside the EU

   Data is stored in the European Union. Check probes located outside the EU receive only the technical information needed to run checks (URLs, hosts, ports). Where providers process data outside the European Economic Area, transfers are based on a European Commission adequacy decision, such as the EU-U.S. Data Privacy Framework, or on standard contractual clauses.

7. 7.Retention

   • Account data: for the duration of the relationship and up to 30 days after account deletion, except for encrypted backups overwritten within 90 days.
   • Check results and incident logs: according to the plan's retention periods (7 days to 3 years).
   • Billing data: 10 years, as required by tax law.
   • Technical and security logs: up to 12 months.
   • Contact form requests: up to 24 months after the last communication.

8. 8.Security

   We apply appropriate technical and organisational measures: encrypted connections (TLS), passwords and API keys stored only as hashes, two-factor authentication, role-based access control, activity logging, backups and redundant infrastructure.

9. 9.Your rights

   Under Articles 15–22 GDPR you may at any time:

   • access your data and obtain a copy;
   • request its rectification or completion;
   • request its erasure or the restriction of processing;
   • receive your data in a structured format and transmit it to another controller (portability);
   • object to processing based on legitimate interest;
   • withdraw consent, without affecting the lawfulness of prior processing.

   To exercise your rights write to [privacy email]. We will reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the supervisory authority of your country.

10. 10.Changes to this policy

    We may update this policy. If there are significant changes we will notify you by email or through the dashboard. The date of the last update is shown at the top of the page.