Privacy Policy

1. Introduction

This Privacy Policy explains how UptimeVanguard ("we", "us", "our") processes personal data when you use our website monitoring service at uptimevanguard.com and app.uptimevanguard.com. We process personal data in compliance with the General Data Protection Regulation (GDPR) and Dutch data protection law.

2. Our two roles

Controller. We are the controller for the data we need to run our relationship with our customers: the account holder's name, organization, email address and password, billing and payment status, the security and request logs of our platform, and fraud and abuse prevention. For that data, the controller is:

UptimeVanguard, eenmanszaak (sole proprietorship)
De Ambacht 4, 4681 CV Nieuw-Vossemeer
The Netherlands
Chamber of Commerce (KvK) no.: 42017143, branch no. 000065206312
VAT ID: NL005434561B13
[email protected]

Processor. We are a processor for the personal data that a customer enters into the Service: team members the customer adds, alert recipients, status page subscribers, monitored targets and request settings, check credentials, and check results. The customer is the controller of that data. Our Data Processing Agreement governs that processing and prevails over this policy where they conflict. If your data is in a customer's account, contact that customer; we forward requests we receive to the customer.

We do not use data that customers enter to train models or for advertising, and we never analyze or use an individual customer's data for our own purposes. We only use anonymous totals that identify no person and no customer, such as the number of checks run, to operate and plan the Service.

3. What data we collect as controller

3.1 Account data

• Name, email address and the organization you use the Service for
• An optional privacy contact email address
• Password (stored as a bcrypt hash)
• The versions of the Terms and the Data Processing Agreement you accepted, with the time and IP address of the acceptance

3.2 Payment data

Payment processing is handled by Mollie. We store the Mollie customer ID, subscription status and plan details, and billing history. We do not store your full card number. Mollie handles payment data as an independent controller under its own privacy policy; see section 6.1.

3.3 Technical data

For every request to our website, application and status pages, we log the time, method, path (without query string), status code, user ID if signed in, IP address, browser user agent and duration. This includes visitors of public status pages.

4. How we use your data

Monitoring, alerts and status pages are processing on behalf of our customers under the Data Processing Agreement, not on a legal basis of our own.

5. Cookies and browser storage

• Session cookie — required for authentication. Strictly necessary.
• CSRF token cookie — required for security (prevents cross-site request forgery).
• Theme cookie (one year) and browser storage for interface preferences (theme, dark mode, sidebar width, monitor list view). These are functional and do not track you.
• Consent cookie uv_consent (6 months) — your choice in the cookie banner on uptimevanguard.com and on our public sign-in, sign-up, forgotten-password, help, tools and legal pages. Strictly necessary.

5.1 X (Twitter) advertising, only with your consent

Only when you click "Accept" in the cookie banner, our website and our public sign-in, sign-up, forgotten-password, help, tools and legal pages load the X advertising pixel from X Corp. It tells X that you visited the page, so that we can see which ads on X bring visitors. X sets its own cookies for this (_twclid, _twpid, _twsid) and receives your IP address and browser details. When you came from an ad on X, we keep its click id in the cookie uv_twclid for 30 days. When you then sign up, we store your consent and that click id with your account.

When you verify your email address, we send the sign-up to X through the X Conversion API: the click id, if there is one, and your email address as a SHA-256 hash (trimmed and lowercased; X compares the hash, not the address). We do not send your name or anything else. We delete the click id from your account after X accepted it. X keeps the data under its own retention policy; see the X Privacy Policy. Inside the application, after sign-in, we load no pixel.

Without consent we load no pixel and send nothing to X. To change your choice, use "Cookie settings" in the footer of our website or of these pages. "Decline" withdraws the consent from then on and removes the click id cookies. A conversion that was already sent is not called back; to have your consent removed from your account, contact us (section 14).

We do not use other advertising or analytics cookies. On our website uptimevanguard.com, Cloudflare Web Analytics counts page views: a script from Cloudflare sends the page address, the referring page, the browser type and page-load timings to Cloudflare. It sets no cookies and stores nothing in your browser. Cloudflare's bot protection on sign-in and signup runs a check in your browser to tell people from bots.

6. Providers

These providers process data on our instructions under written agreements. Annex C of the Data Processing Agreement lists what each of them processes for our customers, and where.

6.1 Payment provider

Mollie B.V. (Netherlands), together with its group companies, handles our payments. For the payment data you enter, Mollie acts as an independent controller under its own privacy policy. It is not our processor, and we cannot instruct it on how that data is used. We receive from Mollie only a customer identifier, your subscription status and your billing history. See the Mollie Privacy Policy for how Mollie uses your data and for the transfer safeguards it applies.

7. Data retention

• Account data: while your account exists. After you delete your account, it is deleted from our production systems within 30 days and from backups within a further 30 days.
• Data of an ended trial or subscription: when the team does not continue on the Free plan, monitors, their history, alert channels and status pages are deleted 30 days after the end, with an email 7 days before.
• Billing records: 7 years after the transaction, as Dutch tax law requires.
• Request logs: 365 days. The IP address is removed after 30 days. Request logs of a deleted account are deleted with it.
• Security events: 90 days. Audit logs: 365 days. Notification history: 30 days.
• Backups: encrypted, and kept at most 30 days.
• Marketing consent and X click id: the consent with your account while it exists; the click id until X accepted the sign-up conversion. X keeps what it received under its own policy.

8. Your rights

Under the GDPR, you have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent where processing is based on consent.

If we are the controller of your data (account, billing, platform security, request logs), email [email protected]. We respond without undue delay and within one month. If we need the further two months that Article 12(3) GDPR allows, we tell you within the first month.

If a customer entered your data (for example as an alert recipient, a status page subscriber, or in a monitored target), that customer is the controller. We forward your request to the customer and do not decide it for them.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

9. Account deletion

You can delete your account at any time in your account settings or by contacting [email protected]. If a subscription is still active, it is canceled first; deletion then completes automatically. Your account, monitors, results, alert channels and status pages are deleted from our production systems within 30 days and from backups within a further 30 days. We keep invoices and other accounting records for as long as Dutch tax law requires.

10. Data security

We protect personal data with the measures in Annex B of the Data Processing Agreement, among them:

• HTTPS for all traffic
• Passwords hashed with bcrypt, and optional two-factor authentication on every account
• Rate limiting and bot protection on sign-in and registration
• Check credentials and notification settings encrypted at rest; encrypted backups
• Only our owner has access to production systems

11. International transfers

We store account and monitoring data in the European Union (Hetzner, Germany). To run checks from the regions a customer selects, we send the check target and the request details the customer configured (for example headers, a request body or credentials) to monitoring nodes, including nodes outside the European Economic Area. A node keeps those details in memory only, performs the check, and sends the result back to our servers in Germany. Its logs contain no request details or credentials. Cloudflare carries traffic to our website and application and delivers our email, and can process data outside the EEA. Annex C of our Data Processing Agreement names each provider, the location and the safeguard: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Mollie is an independent controller for payment data and applies its own safeguards.

12. Children

The Service is for businesses and is not directed at children. Monitored targets and check results can still contain data about anyone; customers are responsible for what they monitor.

13. Changes to this policy

We announce material changes by email or an in-app notice at least 30 days before they take effect. The version at the top of this page changes with each new version.

14. Contact

For privacy-related questions or to exercise your data rights, contact us at:

UptimeVanguard, eenmanszaak (sole proprietorship)
De Ambacht 4, 4681 CV Nieuw-Vossemeer
The Netherlands
Chamber of Commerce (KvK) no.: 42017143, branch no. 000065206312
VAT ID: NL005434561B13
[email protected]

For general support questions, contact [email protected].