Privacy Policy

Zaskoku & Haupt GbR (Uptimeify)

Version 2.2 · In force from 30 October 2026 · Until then version 1.2 of 2 September 2026 applies

This policy tells you what data we process, why we process it and what rights you have. It covers our website uptimeify.io, our documentation at docs.uptimeify.io and your use of the monitoring application.

This is a translation. The German version of this policy is the authoritative one and prevails in the event of any discrepancy.

1. Controller

Zaskoku & Haupt GbR Lange Str. 54 - 56 48683 Ahaus Germany

Represented by Florian Zaskoku and Pascal Haupt Phone: +49 2568 900 9000 Email: hello@uptimeify.io

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

We will appoint a data protection officer as soon as we are legally required to do so. Until then, address data protection enquiries to hello@uptimeify.io.

2. Two roles, one note up front

We process data in two distinct roles, and this matters for understanding this policy.

As controller we process data for our own purposes: operating the website, pre-contractual steps, your account, billing, support and security. That is what this policy is about.

As processor we handle the data our customers bring into Uptimeify, such as monitored addresses, check results and notification recipients. The customer decides on the purposes and means, not us. The basis for this is our data processing agreement.

Cross-customer disruption detection, which we use from 12 November 2026, involves both roles: the evaluation is carried out on behalf of our customers, while we are responsible ourselves for retaining the evidence. Section 9.5 explains this in more detail.

If you come into contact with Uptimeify through an account set up by your service provider or through a status page, your service provider is the point of contact for that data. Section 9 explains this in more detail.

3. Your rights

You have the right at any time to:

• Access the data we hold about you, its origin, recipients and purpose of processing (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a commonly used, machine readable format (Art. 20 GDPR)
• Withdraw consent with effect for the future, without affecting the lawfulness of processing carried out up to that point (Art. 7 (3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest, you may object to that processing on grounds relating to your particular situation. This also applies to profiling based on those provisions.

Where your data is processed for direct marketing purposes, you may object at any time and without giving reasons.

Send objections informally to hello@uptimeify.io.

4. Legal bases at a glance

We process personal data on one of the following bases:

• Consent (Art. 6 (1) lit. a GDPR)
• Contract or pre-contractual steps (Art. 6 (1) lit. b GDPR)
• Legal obligation (Art. 6 (1) lit. c GDPR), for example tax retention and verification duties
• Legitimate interest (Art. 6 (1) lit. f GDPR)

5. Website

5.1 Hosting and delivery

We operate our website and the monitoring application with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Further infrastructure is provided by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, netcup GmbH, UpCloud Ltd and IONOS SE. All locations are within the European Union.

Static content is delivered through the content delivery network of BunnyWay d.o.o. (bunny.net), Cesta Komandanta Staneta 4a, 1215 Medvode, Slovenia. We have restricted delivery to European locations.

The legal basis is Art. 6 (1) lit. f GDPR. We have a legitimate interest in reliable and fast delivery. We have concluded data processing agreements with all providers named.

A complete overview is available at https://uptimeify.io/subprocessors.

5.2 Server log files

When you access our pages, the server automatically records:

• browser type and version
• operating system used
• referrer URL
• hostname of the accessing device
• time of the server request
• IP address

We do not combine this data with other sources. The legal basis is Art. 6 (1) lit. f GDPR; we have a legitimate interest in technically correct delivery, in optimising our website and in defending against attacks. We delete log files after 30 days at the latest, unless a specific security incident makes longer retention necessary for investigation.

5.3 Cookies and consent management

Cookies are small data files stored on your device.

Necessary cookies are set without consent because the website does not work without them. The legal basis is Sec. 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR.

All other cookies and comparable technologies are set only after you have consented. The legal basis is Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG. You can change or withdraw your choice at any time through the cookie settings.

In addition to cookies we sometimes use your browser's local storage. For anything that is not technically necessary we obtain your consent first. If you withdraw your consent, we delete the entries concerned.

To obtain and document your consent we use a consent management solution. The legal basis for this is Art. 6 (1) lit. c GDPR.

5.4 Google Analytics

On our public website we use Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We do not use Google Analytics within the monitoring application. The only exception is the publicly accessible sign-up path.

Google Analytics analyses how our website is used: pages viewed, time spent, origin, device and individual interactions, for example running one of our free tools, clicking certain buttons or selecting a pricing tier.

What we deliberately do not transmit:

• No query parameters. Addresses are truncated at the question mark before transmission. Domains and other details you enter into our free tools therefore never reach Google.
• No personal details. Names, email addresses, company names and free text entries are not transmitted.
• No cross device linking. Google signals are switched off.
• No advertising. Advertising storage stays disabled regardless of your choice.

The legal basis is your consent under Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG. Without your consent nothing is loaded and nothing is stored.

Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework; we also base the transfer on standard contractual clauses.

Further information: https://policies.google.com/privacy

5.5 fastmon (real user monitoring)

We use real user monitoring provided by fastmon labs UG (haftungsbeschränkt), Germany. It measures how quickly and how reliably our interfaces load for real visitors. We run fastmon in three tiers, and only the last one requires your consent. fastmon sets no cookies in any tier.

Base measurement, without consent. For every page view we collect technical telemetry: load times, the page viewed without any values from the address bar, the referring page, browser and operating system family, device class, the country, the type and number of script errors together with a sanitised error message, and the duration and error codes of requests to our own interfaces. The measurements travel through our own server to fastmon. fastmon removes your IP address and the full browser identifier before the data is processed any further; only the country is derived from the IP address. So that fastmon can count page views by the same visitor together, it derives a pseudonymous key from IP address and browser identifier. The secret used for this lives only in memory and changes every 24 hours; after that the key can neither be reversed nor linked to later visits. Nothing is stored on your device in this tier. The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in detecting and fixing slow pages and loading errors.

Browser error reports (Network Error Logging), without consent. Our server instructs your browser to report failed requests to uptimeify.io. Chromium-based browsers such as Chrome and Edge keep this instruction for 24 hours. If a request fails during that time, for example at name resolution, while connecting, at the certificate or because our server returned an error, the browser sends a report directly to fastmon. Successful requests are not reported. fastmon stores the type and phase of the error, status code, duration, request method and protocol, the requested address without any values from the address bar, the referring page only if it belongs to uptimeify.io, the IP address of our server, as well as country, device class, browser and operating system family and the pseudonymous key from the base measurement. fastmon removes your IP address and the browser identifier as described above. The instruction itself contains no identifier, only the reporting address. We store it under Sec. 25 (2) no. 2 TDDDG, because its sole purpose is to keep the service you are using reachable. The legal basis for the processing is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in detecting outages that never reach our own servers.

Extended measurement, only with consent. If you allow "Real User Monitoring" in the cookie settings, fastmon additionally places a session identifier in your browser's session storage. It applies only to the current browser tab and is deleted with it. This allows the page views of one session to be analysed together. The legal basis is your consent under Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG. You can withdraw it at any time in the cookie settings; the withdrawal takes effect from the next tab.

Processing takes place exclusively in Germany. fastmon deletes the measurement data and error reports after 90 days. We have concluded a data processing agreement.

5.6 Dealfront (Leadfeeder), identifying visiting companies

On our public website we use Leadfeeder provided by Dealfront Group GmbH, Germany, to identify which companies visit our website. The aim is to identify and approach potential business customers.

We process your IP address and details of the page visit. The IP address is matched against a database to determine the company behind it, and is then truncated or discarded. Identifying individual people is not a purpose of this processing.

The legal basis is your consent under Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG. Processing takes place in Germany.

Further information: https://www.dealfront.com/privacy/

5.7 Origin marker and origin recorded at the account

If you consent to analytics, we store an entry in your browser's local storage that records which page you first arrived on. It holds the page category, the path with the query string removed, the language and the time. It is read for 90 days and then no longer evaluated.

If you create an account, we save that page category and path at your organisation. The purpose is to understand which of our content wins paying customers.

The legal basis is your consent under Art. 6 (1) lit. a GDPR and Sec. 25 (1) TDDDG.

5.8 Free tools

On our website and through our MCP server we offer free check tools, for example for DNS records, certificates, blocklists and reachability. When you enter a domain or IP address, our server queries the target, identifiable by the user agent UptimeifyToolsBot, and shows you the result.

We store the input and the result only if you request a share link. Such a link carries a random identifier, is blocked for search engines, is not listed anywhere and is deleted 30 days after it was created. Tools that run entirely in your browser, such as formatters, converters and generators, send nothing to us.

In our analytics under section 5.4 we record only the name of the tool, whether it returned a result or an error and what kind of input it was, never the input itself.

The legal basis is Art. 6 (1) lit. f GDPR. Our interest is to provide the tools and protect them against abuse. Server log data under section 5.2 is generated for technical delivery.

6. Contact and support

6.1 Contact form, email and support enquiries

When you write to us through the contact form or by email, we process your details to handle your request. Our mailboxes run on Tuta (Tutao GmbH, Hanover, Germany). The mailboxes are end to end encrypted and sit on servers in Germany.

The legal basis is Art. 6 (1) lit. b GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) lit. f GDPR based on our legitimate interest in handling enquiries.

We delete this data once your request has been dealt with, and at the latest three years after the end of the year in which the contact ended.

6.2 Telephone

For our business telephony we use easybell GmbH, Germany. Connection data such as phone numbers, time and duration is generated in the process. We do not record calls.

The legal basis is Art. 6 (1) lit. b GDPR where the call relates to a contract, otherwise Art. 6 (1) lit. f GDPR based on our legitimate interest in handling enquiries.

6.3 Booking a call

On our booking page you can book a call directly. For this we use the open source software Cal.com, which we operate ourselves on our own infrastructure in the EU. No external booking provider is involved.

We process your name, your email address and the time you choose. We send the confirmation through our email service provider Lettermint (section 7.5). We do not pass these details on to our analytics. If you have consented to analytics, we record there only that a booking was made and on which page your visit began.

The legal basis is Art. 6 (1) lit. b GDPR where the call serves pre-contractual steps, otherwise Art. 6 (1) lit. f GDPR based on our legitimate interest in handling enquiries. We delete the details in the same way as contact enquiries under section 6.1.

7. Registration, customer account and billing

Uptimeify is offered exclusively to business customers.

7.1 Account data

On registration we process company name, address, legal form, name and contact details of the person acting, email address, credentials in encrypted form and the VAT identification number. The legal basis is Art. 6 (1) lit. b GDPR.

7.2 Verification of the VAT identification number

We verify the VAT identification number you provide through the European Commission's VIES system. The number is transmitted to the Commission's system and forwarded to the tax administration of the relevant member state. We store the result of the query with a timestamp as evidence.

The legal basis is Art. 6 (1) lit. c GDPR.

7.3 Trial and prevention of abuse

After a trial account has expired and been deleted, we retain a minimal technical marker showing that a trial has already been used for your organisation. Its sole purpose is to prevent repeated use of the free trial.

The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in preventing abuse.

7.4 Payment processing

We process payments through Mollie B.V., Netherlands. Your payment data is processed by Mollie; we do not store complete card details. Invoicing and accounting data is processed using Lexware (Haufe-Lexware GmbH & Co. KG, Germany).

The legal basis is Art. 6 (1) lit. b GDPR for processing the payment and Art. 6 (1) lit. c GDPR for retention under tax and commercial law.

7.5 Notifications to you

Account, system and billing emails are sent through Lettermint B.V., Netherlands. The legal basis is Art. 6 (1) lit. b GDPR.

7.6 Connected applications and AI agents

You can connect applications such as AI assistants to your account via OAuth or an API token, for example through our MCP server. Such connections receive read access within the permissions of your account; they can only change what you explicitly grant write permissions for when you authorise them. We store the connected application, the time access was granted and the associated access tokens. Under Settings, Connected applications you can see all connections and revoke them at any time. Revocation takes effect immediately.

The legal basis is Art. 6 (1) lit. b GDPR.

8. Security and logging within your account

We log security relevant events in your account, such as sign ins, changes to access and administrative actions. The purpose is to detect and investigate unauthorised access. The legal basis is Art. 6 (1) lit. f GDPR together with Art. 32 GDPR.

The connection to our website and to the application is encrypted with TLS throughout.

9. Use of the monitoring application

9.1 Our customers' data

Whatever a customer brings into Uptimeify is processed solely on that customer's behalf and on their instructions: monitored addresses, check results, incident histories, notification recipients, configurations and the diagnostic data generated in the process. The controller is the customer concerned, not us.

The basis for this is our data processing agreement, which forms part of the contract for the use of Uptimeify. It also describes which sub-processors are involved, where processing takes place and when data is erased.

To deliver alerts we use Lettermint (email), seven.io and LOX24 (SMS and voice calls). If a customer connects optional services such as Slack, Google Chat, PagerDuty or their own webhooks, we transmit alert data to the provider they have chosen; the customer is responsible for this.

If a customer forwards alert emails from other systems to their ingest address at Uptimeify, Lettermint receives them and passes the sender, subject and body to our platform, where they create an incident.

9.2 If you are a user of one of our customers

If you use Uptimeify through an account set up by your service provider or your employer, that organisation is the controller for the data processed there. Please exercise your rights of access, rectification and erasure with them. If such a request reaches us directly, we forward it to the controller and do not answer it ourselves.

9.3 Public status pages

If you visit a status page operated with Uptimeify, the same principles apply to the content shown there: the operator of the status page is the controller. Server log data under section 5.2 is generated on our side for technical delivery.

If a status page offers subscriptions by email or RSS and you subscribe by email, we process your email address on behalf of the operator. You only receive messages after you have confirmed the subscription through the confirmation email. As evidence of your consent we store the time, IP address and user agent of the sign-up. We delete unconfirmed sign-ups after seven days. Messages are sent through the operator's email server or, where none is configured, through Lettermint. You can unsubscribe at any time through the link in every message.

9.4 Mobile apps and push notifications

Our iOS and Android incident management apps are optional. Without them, alerts still reach you by email, SMS, voice call, webhook and through your integrations.

Getting the apps. The apps are distributed through the Apple App Store and Google Play. The download produces data such as the store account's user name, email address and customer number, the time of the download, payment information and a device identifier. Apple and Google are solely responsible for it as the operators of their respective platforms.

Push notifications. We send push notifications only if you allow them in your device's system dialog. The legal basis is your consent under Art. 6 (1) lit. a GDPR. You can withdraw it at any time in your device's system settings or in the app settings.

To deliver one, we transmit a wake signal, an alert identifier, the severity and a signed acknowledgement token to your operating system's push service: the Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. The alert text travels with it, but sealed: your device generates a key pair when it registers for notifications, we only ever learn the public half, and we encrypt the text with it. Apple and Google carry a block of bytes they cannot open, and the app decrypts it on your device before the notification appears.

Device registration. We store per device the push token, the platform, the app version and the language setting, along with the link to your user account. When you sign out on a device or uninstall the app, we remove the entry.

9.5 Cross-customer disruption detection and risk assessment

This section applies from 12 November 2026.

Uptimeify detects disruptions at infrastructure and service providers, such as hosting, cloud or DNS providers, even where they do not publish anything themselves. To do so, we attribute monitored systems to their provider on the basis of DNS records, IP addresses and publicly available routing data, and evaluate whether systems of several customers using the same provider fail at the same time.

Evaluation on behalf of our customers. The evaluation is part of the Service and is carried out on behalf of our customers under Sections 3.4 and 3.5 of our data processing agreement. The customer concerned remains the controller for the outage data. We only give notice of a disruption where at least three monitored systems from at least two different organisations fail at the same time. The notice names only the provider concerned. Nobody learns which other customers are affected. Customers can opt out for their organisation or for individual end customers in the settings.

Risk assessment in reports. In monthly reports we assess the outage risk per monitored system. The assessment is primarily based on the system's own measurement history. Where that is not sufficient, we supplement it with average values per provider, which we only form from data of at least five organisations.

No external AI provider. For detection and assessment we use a statistical model that runs exclusively on our own infrastructure in the EU. We do not use external AI providers or language models for this, and no data is transmitted to third parties. Technical systems are assessed, not people. No automated decision within the meaning of Art. 22 GDPR takes place.

Feedback. You can confirm or reject a notice and optionally leave a comment. Feedback is used solely to review our results and is not used to train the model. Please do not enter personal data in the comment field. We erase feedback, including the comment, after twelve months.

Retention of evidence. We retain the measurement values underlying a displayed notice until the end of the third calendar year after the notice was displayed. The purpose is to be able to substantiate the statement about the provider named and to defend ourselves against claims. We act as controller for this retention. The legal basis is our legitimate interest under Art. 6 (1) lit. f GDPR. We erase measurement values that did not lead to a notice after twelve months.

Removal of the customer reference. Where a customer deletes a monitored system, the contract ends or one of these periods expires, we remove every reference to the customer, their monitors and their incidents and erase the associated measurement values. Only the provider, time, probability, source and model version of a displayed notice are retained. This information does not allow any conclusions to be drawn about the customer.

If you are a user of one of our customers, section 9.2 applies: please exercise your rights with the customer concerned. We give effect to your right to object under Art. 21 GDPR to the retention of evidence, unless retention is necessary for the defence of legal claims.

9.6 Software deployment reports

This section applies from 12 November 2026.

If a customer reports software deployments from their own build environment to Uptimeify, we process the time, version label and environment on their behalf. We discard any further details, such as names or email addresses of developers, before they are stored.

10. Job applications

If you apply to us, we process your application documents, contact details and interview notes to the extent necessary to decide on an employment relationship. The legal bases are Sec. 26 (1) BDSG, Art. 6 (1) lit. b GDPR and, where you have consented, Art. 6 (1) lit. a GDPR.

If no appointment is made, we retain the documents for up to six months after the end of the process in order to defend against possible claims, and delete them afterwards. Inclusion in a talent pool takes place only with your express consent; data held there is deleted no later than two years after consent was given.

11. Retention periods

Where no specific period is stated above, we store data until the purpose no longer applies. We then delete it unless a statutory retention obligation applies.

12. Recipients and transfers to third countries

We pass on personal data only where this is necessary to perform a contract, where we are legally required to do so, where a legitimate interest exists or where you have consented. Where processors are used, a contract under Art. 28 GDPR is in place in each case.

The complete and continuously updated overview of the service providers we use, including role and location, is available at https://uptimeify.io/subprocessors.

All service providers that process monitoring data are established and process within the European Union or the EEA. We operate our databases exclusively at German locations.

Notices of provider disruptions under section 9.5 name the provider concerned. We do not pass on data about other customers to anyone in the process.

Transfers to the USA take place only for individual services supporting general business operations and for the consent based analytics service described in section 5.4. We base these transfers on the EU-US Data Privacy Framework, on standard contractual clauses of the European Commission and on supplementary measures. Despite these safeguards, a level of protection fully comparable to that in the EU cannot be guaranteed in third countries; in particular, access by public authorities cannot be ruled out in every case.

13. Advertising emails

We hereby object to the use of the contact details published in our legal notice for sending advertising that has not been expressly requested. We reserve the right to take legal action.

14. Changes to this policy

We update this policy when the law, our services or our processing activities change. The current version is always available on this page, and every previous version is listed with its validity period in our legal archive. For your use of Uptimeify, the change procedure in Section 20 of our Terms applies in addition.

Version 2.2 · In force from 30 October 2026 · Until then version 1.2 of 2 September 2026 applies