Privacy Policy

As of: September 21, 2026 · Version 1.6

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

A Data Protection Officer is currently not appointed pursuant to Art. 37 GDPR in conjunction with § 38 BDSG (German Federal Data Protection Act), as the statutory requirements are not met. For all questions regarding data protection, you can reach us at the email address stated above.

2. Scope

2.1. This privacy policy informs about the nature, scope, and purpose of the processing of personal data in connection with the use of the website and the uptime monitoring service UptimeSheriff(hereinafter "Service").

2.2. Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), in particular email addresses, IP addresses, and usage data.

3. Overview of legal bases

Insofar as this privacy policy refers to legal bases, the following apply:

• Art. 6(1)(a) GDPR (Consent): you have given consent to the processing for one or more specific purposes;
• Art. 6(1)(b) GDPR (Performance of a contract): the processing is necessary for the performance of the contract with you or for pre-contractual measures;
• Art. 6(1)(c) GDPR (Legal obligation): the processing is necessary for compliance with a legal obligation to which we are subject;
• Art. 6(1)(f) GDPR (Legitimate interest): the processing is necessary for the purposes of our legitimate interests, except where such interests are overridden by your interests or fundamental rights.

4. Hosting and server log files (Vercel, Hetzner)

4.1. The website and the application (dashboard, status pages) are operated by Vercel, Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). The server-side functions run in the EU region Frankfurt (fra1); static content is delivered through Vercel's global network. The monitoring server that checks your monitors runs on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in Germany.

4.2. Each time the Service is accessed, information transmitted by your browser is automatically collected (server log files). These include:

• IP address of the accessing device;
• time of access;
• page accessed;
• browser type and version (user agent).

4.3. This data is processed to provide the Service, to ensure system security and stability, and for technical error analysis. Vercel stores these log files only briefly (according to Vercel between one day and at most 30 days, depending on the plan); the log files of the monitoring server are stored for a maximum of 7 days. This data is not combined with other data sources.

4.4. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the technically flawless provision and security of the Service.

4.5. Vercel is a company based in the USA. For transfers to the USA we rely on Vercel's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and on the EU standard contractual clauses (Art. 46(2)(c) GDPR), see § 15.

5. Bot protection (Cloudflare Turnstile)

5.1. On the sign-in, sign-up and forgot-password pages we use Cloudflare Turnstile, a service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile protects these forms against automated access (bots) and abuse.

5.2. Technical data (IP address, browser information) is transmitted to Cloudflare and processed there to distinguish humans from automated access. Cloudflare does not set any cookies for this purpose that would require consent.

5.3. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in protecting the Service against automated attacks and abuse.

5.4. Cloudflare is a company based in the USA. For transfers to the USA we rely on Cloudflare's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and on the EU standard contractual clauses (Art. 46(2)(c) GDPR). Further information: https://www.cloudflare.com/privacypolicy/

6. Registration and user account

6.1. A user account is required to use the Service. During registration, we collect:

• your email address;
• your password (stored exclusively as a cryptographic hash; we have no access to the plaintext password).

6.2. The processing is necessary for the provision of the user account and the features of the Service. The legal basis is Art. 6(1)(b) GDPR.

6.3. We store the account data until your account is deleted. We retain contract data for 30 days after the end of the contract so that you can export your data; thereafter it is deleted (see § 16).

6.4. Sign-in with Google. You can optionally register and sign in with your Google account. In that case Google transmits to us the email address, the name and the profile picture of your Google account; we do not store a password. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The legal basis is Art. 6(1)(b) GDPR. Google's privacy policy: https://policies.google.com/privacy

7. Authentication and database (Supabase)

7.1. For user accounts, sign-in and the storage of your data (account, monitors, alert channels, status pages, measurements) we use Supabase (Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992). Our Supabase project runs in the EU region eu-central-1 (Frankfurt, Germany) on servers of Amazon Web Services. All database and authentication data is stored and processed within the European Union.

7.2. When you sign in, Supabase processes your email address, the password hash, and the time and IP address of the sign-in (security log). The legal basis is Art. 6(1)(b) GDPR (performance of the contract) in conjunction with Art. 6(1)(f) GDPR (security of the user account).

7.3. After registration we send a confirmation email to the address provided; when you reset your password we send a one-time, time-limited link. The legal basis is Art. 6(1)(b) GDPR.

7.4. New passwords are checked against the list of known compromised passwords of the Have I Been Pwned service. Only part of a hash value is transmitted, never the password itself. The legal basis is Art. 6(1)(f) GDPR (protection of your account).

7.5. Supabase acts as our processor under Art. 28 GDPR on the basis of Supabase's data processing agreement. Supabase, Inc. is certified under the EU-US Data Privacy Framework (see § 14 and § 15).

8. Monitoring data processed on your behalf

8.1. In the Service, you create monitors (URLs and endpoints) and store alert recipients (email addresses as well as Telegram, Slack, or webhook targets).

8.2. Insofar as this data contains personal data (for example, email addresses of your team members), we process it on your behalf pursuant to Art. 28 GDPR. You remain the controller for this data within the meaning of Art. 4(7) GDPR and ensure that an appropriate legal basis exists and that the data subjects have been informed in accordance with Art. 13/14 GDPR.

8.3. Our data processing agreement is available under "DPA" in the footer of this website; it governs the processing of this data on your behalf.

9. Alert messages

9.1. If one of your monitors triggers an alert, we send a message to the recipients you have stored. The message contains the information about the affected monitor that is required for the alert.

9.2. Available channels are email, Telegram, Slack, and webhook. You choose the recipients and the channel yourself.

9.3. For third-party channels such as Telegram or Slack, the message is delivered via the infrastructure of the respective provider; these providers process the data in accordance with their own privacy policies. For webhooks, the message is sent to the target you specify.

9.4. The message is sent as processing on your behalf (see § 8). In relation to you, the legal basis is Art. 6(1)(b) GDPR (performance of a contract).

10. Email delivery (Resend)

10.1. We use the service Resend (Plus Five Five, Inc., 2261 Market Street No. 5039, San Francisco, CA 94114, USA) to send emails. This covers account emails (registration confirmation, password reset, confirmation of a new email address), alert emails (see § 9) and an internal notification to us about every new registration (email address, user ID and time of registration).

10.2. Emails are sent via Resend's EU infrastructure in Ireland. In doing so, Resend processes the recipient address, the subject and content of the message, and delivery data, and acts as our processor under Art. 28 GDPR on the basis of Resend's Data Processing Agreement.

10.3. Resend is a company based in the USA. For transfers to the USA, we rely on Resend's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10.4. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We do not send newsletters or marketing emails.

11. Payment processing (Stripe)

11.1. Payment processing for paid subscriptions is carried out by the payment service provider Stripe. In this process, the data required for the payment is transmitted to Stripe.

11.2. Stripe acts partly as our data processor and partly as an independent controller, in particular for fraud prevention and for compliance with its own legal obligations. This is based on Stripe's Data Processing Agreement.

11.3. The legal basis for the transmission to Stripe is Art. 6(1)(b) GDPR (performance of a contract).

12. Invoicing (sevDesk)

12.1. For the creation and management of invoices, we use the service sevDesk. In this process, the data required for invoicing is transmitted to sevDesk.

12.2. We retain invoice data for 10 years (§ 147 AO (German Fiscal Code), § 257 HGB (German Commercial Code)).

12.3. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) in conjunction with Art. 6(1)(c) GDPR (tax and commercial law retention obligations).

13. Cookies and local storage

13.1. We do not use any marketing or tracking cookies. There is no user-level tracking and no profiling.

13.2. Only what is technically necessary is stored in your browser, in each case in localStorage: your theme setting and, if you close the language notice above the navigation, that choice. This storage is required for the display you have chosen; consent is not required for this (§ 25(2)(2) TDDDG (German Telecommunications Digital Services Data Protection Act)).

13.3. In all other respects, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technical provision of the Service).

14. Processors and sub-processors

14.1. Personal data is generally processed within the European Union: the database and authentication with Supabase in Frankfurt, the application with Vercel in Frankfurt, the monitoring server with Hetzner in Germany.

14.2. To provide the Service we use the following processors (provider, registered office, purpose, data categories):

• Vercel, Inc., Covina, USA: hosting of the application, edge network, serverless functions; server log files, request data.
• Supabase, Inc., Singapore: database and authentication; user accounts, monitors, alert channels, status pages, measurements.
• Hetzner Online GmbH, Gunzenhausen, Germany: monitoring server; monitor addresses, check results.
• Cloudflare, Inc., San Francisco, USA: bot protection (Turnstile); IP addresses, browser information.
• Resend (Plus Five Five, Inc.), San Francisco, USA: email delivery; email addresses, email content.
• Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing; email, payment and subscription data (partly as an independent controller, see § 11).
• sevDesk GmbH, Offenburg, Germany: invoicing; invoice data.

14.3. Data processing agreements under Art. 28 GDPR are in place with these processors. Towards you, we ourselves act as processor for the monitoring data (see § 8); our data processing agreement is available under "DPA" in the footer of this website.

14.4. Changes to the processors are updated in this policy.

15. Data transfers to third countries

15.1. Some of the processors named in § 14 are based outside the European Union. For transfers to the USA we rely on the respective provider's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

• Supabase: data is stored in the EU (Frankfurt). Content data is not transferred to the USA; Supabase, Inc. is certified under the EU-US Data Privacy Framework.
• Vercel: the server-side functions run in Frankfurt; static content is delivered through Vercel's global edge network. Vercel, Inc. is certified under the EU-US Data Privacy Framework.
• Cloudflare: bot protection runs through Cloudflare's global network at the nearest location. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition.
• Resend: delivery through Resend's EU infrastructure in Ireland; Resend is certified under the EU-US Data Privacy Framework (see § 10).
• Stripe: for customers in the EU, Stripe Payments Europe, Ltd. (Dublin, Ireland) processes the payment data; Stripe, Inc. is additionally certified under the EU-US Data Privacy Framework (see § 11).
• Google: for sign-in with Google, Google Ireland Limited (Dublin, Ireland) acts as provider; Google LLC is certified under the EU-US Data Privacy Framework (see § 6).
• Hetzner and sevDesk are based in Germany; no transfer to third countries takes place in that respect.

16. Storage period and deletion

16.1. We store personal data only for as long as necessary for the respective purpose or as statutory retention obligations require. At a glance:

• Server log files: a maximum of 7 days;
• Account data: until your account is deleted;
• Contract data: 30 days after the end of the contract (period for data export), then deletion;
• Invoice data: 10 years (§ 147 AO (German Fiscal Code), § 257 HGB (German Commercial Code)).

16.2. Data subject to statutory retention periods is blocked for further use and deleted upon expiry of the retention period.

17. Your rights

17.1. Under the GDPR, you have the following rights vis-à-vis us:

• Access (Art. 15 GDPR): you can request confirmation as to whether we process personal data concerning you, and obtain access to this data as well as information about the processing purposes, recipients, and storage period;
• Rectification (Art. 16 GDPR): you can request the rectification of inaccurate data or the completion of incomplete data;
• Erasure (Art. 17 GDPR): you can request the erasure of your data, provided no statutory retention obligations oppose this (see § 16);
• Restriction of processing (Art. 18 GDPR): you can request the restriction of processing under certain conditions;
• Data portability (Art. 20 GDPR): you can receive the data you have provided to us in a structured, commonly used, and machine-readable format;
• Objection (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR;
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent you have given at any time with effect for the future.

17.2. To exercise your rights, please contact support@uptimesheriff.com. We will process your request without undue delay, at the latest within one month of receipt (Art. 12(3) GDPR).

18. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR).

19. Changes to this privacy policy

19.1. We amend this privacy policy as necessary, for example in the event of changed legal requirements, technical changes, or new processing activities. The version published here at any given time applies.

19.2. We will inform you of material changes affecting your rights by email or within the Service.

As of: September 21, 2026 · Version 1.5