Privacy Policy

UpControl is a monitoring service: it watches sites and services, collects the events an application sends it, and tells someone when something breaks. This page says what personal data that involves, why we hold it and what you can ask us to do with it.

Who is responsible

UpControl is operated by an independent sole trader based in Finland, who is the data controller for everything described here. Questions, requests and complaints go to contact@upcontrol.io, and are answered within three business days.

What we collect

Your account. Your email address, the display name you choose, and how you signed in. Signing in with a magic link stores the address you typed; signing in with Google gives us your Google account email and name, and nothing else from Google. A session is kept in one cookie that carries no personal data of its own.

What you set up. The addresses you ask us to watch, your projects, your alert channels, and the people you invite to them. Inviting someone means giving us their email address or their Telegram account, so tell them.

What your application sends. Events, log lines and metrics you send us through the SDK or the ingest API, and whatever you put inside them. If you include a customer identifier, an email address or an IP address in an event, we store it, because we cannot tell it apart from anything else you send. The SDK scrubs common secret shapes before sending, but it is not a filter for personal data: what leaves your servers is your decision, so send the least you can.

What our script tag records on your site. If you put our script on your pages, it records for each visit: the page path, the referring site (its host only), the UTM tags in the address, the width of the window, clicks and mouse positions relative to the elements of the page, and how far the page was scrolled. It sets no cookie and stores nothing on the visitor's device. The visitor's IP address and browser are used once, to derive a country, an operating system, a browser name and a visitor hash that changes every day; the address itself is never stored. It never reads the text of the page or anything typed into it. We process this for you, so your own privacy notice should say that you use it.

Our own website. We measure our marketing pages with our own product, first party, no third party analytics and no advertising network. That record holds a page path, a referrer, a coarse device type, a random visitor id and whether you arrived through an affiliate's link, and it is joined to an account only if you sign in. Our pages also carry the script tag described above, so they record the same page views, clicks, mouse positions and scroll depth, under the same rules.

Operational logs. Our servers keep short lived request logs containing IP addresses, for security and abuse handling.

What we do not collect

We never see your card. Payments run through Creem, our merchant of record, who takes the payment details on their own systems. What comes back to us is which plan you bought, whether it is active, and the identifiers needed to keep the two in step. We do not sell personal data, we do not share it for advertising, and we run no advertising or cross-site tracking on any of our pages, apart from the affiliate referral described under cookies and local storage below.

Public status pages

When someone checks a site, we create a public status page for that site automatically. It publishes our measurements of the site: whether it answers, how fast it answers, and how often it was up. We keep measuring the site for as long as the page exists.

Our basis for this is legitimate interest: people search for whether a site is down, and we answer with measurements we took ourselves. What these pages publish is never page content and never personal data.

If you own a site we measure and you object, the objection and the removal are the same act: write to contact@upcontrol.io from an address on the site's domain, and the page is removed within one business day. A removed site is never monitored again; we keep an opt-out list for exactly that.

When we contact a site's owner about their page, we use a contact the site itself publishes. We never take outreach addresses from WHOIS.

Why we are allowed to hold it

• To perform our contract with you: your account, your projects, the data you send, and the alerts we deliver. Without these the service cannot run.
• Our legitimate interest: keeping the service secure, preventing abuse, and understanding in aggregate how our own website is used.
• Legal obligation: tax and accounting records for purchases, kept by us and by our merchant of record for as long as the law requires.

Who else processes it

• Creem, our merchant of record: checkout, payment, invoices, tax, the customer billing portal and our affiliate program.
• Mailgun, outbound email: sign-in links, invitations and alerts sent to an address.
• DigitalOcean, the servers and databases the service runs on.
• Cloudflare, DNS and traffic in front of those servers.
• Telegram, Slack, Discord and your own webhook endpoints, only where you connect one, and only carrying the alerts you asked us to send there.
• Google, only if you choose to sign in with a Google account.

Some of these operate outside the European Economic Area. Where they do, transfers rest on the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

Event and log data is trimmed to the window your plan carries: the retention figures on the pricing page are the real ones, applied by a job that runs continuously, not a promise. Account data lives as long as the account does. When you delete a project or an account we delete its data; backups roll off within 30 days. Records tied to a purchase are kept for the statutory accounting period.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable form, ask us to restrict what we do with it, or object to processing we base on legitimate interest. Write to contact@upcontrol.io and we will answer within 30 days, usually far sooner. If you think we have handled your data badly you can complain to the Finnish Data Protection Ombudsman, or to the supervisory authority where you live.

Cookies and local storage

We set one cookie: the session that keeps you signed in. It is strictly necessary, so we do not ask permission for it. Your theme choice and a few interface preferences are kept in your browser's local storage and never reach us. If you arrive through an affiliate's link, the referral token in that link is kept there too and passed to Creem when you open a checkout, so the affiliate who sent you is credited for the purchase. We set no advertising or cross-site cookies, which is why this site has no cookie banner.

Children

UpControl is a tool for people running software in production. It is not directed at children, and we do not knowingly collect data from anyone under 16.

If you self-host

The core of UpControl is open source and can be run on your own machines. That installation sends us nothing: no telemetry, no phone home, no account. Nothing in this policy applies to it, because we never see it.

Changes

If we change this policy we update the date at the top, and we email account holders before any change that materially affects them takes effect.

Contact

contact@upcontrol.io