Privacy Policy

Rekwiem is the controller (the party that decides why and how personal data is processed) for the personal data described here. Our contact for everything in this policy is support@uptimex.co. The Chief Privacy Officer named at the end of this policy is responsible for its application.

Two situations fall outside this policy. First, third-party websites and services you reach through links from UptimeX, and the sites you monitor with UptimeX, have their own privacy notices. Second, if you publish a status page, the visitors to that page are your audience: you decide what it shows, and we process their page views only as described under “Status pages” below.

The table lists every category of personal data we process. Items marked “contract” are processed without separate consent because they are necessary to provide the service you asked for (PIPA art. 15(1) no. 4; GDPR art. 6(1)(b)). Items marked “legitimate interests” are processed under PIPA art. 15(1) no. 6 and GDPR art. 6(1)(f) after weighing those interests against your rights. Items marked “consent” are processed only after you agree, and you can withdraw at any time. Items marked “legal obligation” are kept because a law requires it (PIPA art. 15(1) no. 2; GDPR art. 6(1)(c)).

We do not collect payment card numbers or bank details: you enter them directly with Paddle, Apple, or Google, which process them under their own notices. We do not collect special categories of data (such as health, biometric, or political data) or national identification numbers, and we ask that you not enter such data into monitor names, settings, or messages. We do not use personal data for behavioural advertising or profiling, and we make no automated decisions about you that have legal or similarly significant effects.

• From you: what you enter at sign-up, in the dashboard, in the apps, and in messages to us.
• From your devices: push tokens the apps register, and the IP address and request metadata your browser or client sends.
• From Apple and Google when you choose to sign in with them: your identifier and email, under their terms.
• From our payment providers (Paddle, Apple via RevenueCat, Google Play via RevenueCat): subscription events such as purchase, renewal, cancellation, and refund.
• Generated by the service: check results, incidents, audit entries, and logs.

An email address (or an Apple or Google sign-in) is required to create an account; without it we cannot provide the service. Everything else, such as notification channels, team members, API tokens, status pages, and analytics consent, is optional, and declining it only limits the related feature.

We entrust parts of the processing to the providers below (PIPA art. 26 “outsourcing”; GDPR “processors”). Each is bound by a written agreement to process personal data only on our instructions, to keep it secure, and to delete or return it when the work ends. We review them for security and privacy before use. If a provider changes, we will update this table.

We do not sell personal data, and we do not share it for advertising. We provide it to third parties only in these cases:

• Payment: Paddle.com Market Ltd. (UK) is the reseller and merchant of record for web subscriptions and receives your email, billing country, and transaction details as an independent controller under its own privacy policy. Apple and Google likewise handle purchases made through their stores.
• Your own integrations: when you add a Slack, Discord, or webhook channel, we send alert content to the URL you gave us. That recipient is chosen by you.
• Status pages you publish: the status and history of the monitors you choose to publish are visible to anyone who can open the page.
• Law and safety: where required by law, a court order, or a lawful request from a public authority, or where necessary to protect the rights, property, or safety of UptimeX, our users, or the public.
• Business transfer: if UptimeX is acquired or merged, personal data may be transferred to the successor, who will remain bound by this policy; we will notify you in advance.

Our providers run outside Korea, so personal data is transferred abroad as part of providing the service (PIPA art. 28-8(1) no. 3: transfer to a processor as necessary to perform the contract, disclosed here). The table gives the disclosures required by PIPA art. 28-8(2). The contact for every recipient listed is support@uptimex.co: write to us and we will put your request to the recipient and reply to you.

For personal data of people in the EEA or UK, transfers to the United States and other countries without an adequacy decision rest on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum), or on the EU-U.S. Data Privacy Framework where the recipient is certified, together with encryption in transit and at rest where supported. You can ask us for a copy of the safeguards at support@uptimex.co. You may refuse an overseas transfer; because every transfer above is needed to run the service, refusing means we can no longer provide it and will close your account at your request.

We keep automatic collection to a minimum. A sign-in cookie (uptimex_session, 90 days, HttpOnly, Secure) and a short-lived cookie that protects the Apple and Google sign-in round-trip are strictly necessary and need no consent. Your cookie choice is stored in your browser’s local storage and never sent to us. Marketing-site analytics (Cloudflare Web Analytics) loads only after you choose Accept; it sets no cookies and uses no local storage or fingerprinting. The Paddle checkout, when you open it, may set cookies inside its own frame under Paddle’s notice. You can refuse or delete cookies in your browser; refusing the sign-in cookie signs you out. Every cookie and storage item, and the controls to change your choice, are listed in our Cookie Policy.

We keep personal data only as long as the purpose in the table above requires, then destroy it. Deleting your account removes it and everything scoped to it immediately, as described on the “Delete your UptimeX account” page. The exceptions are records a law requires us to keep, listed below, which are stored separately and used only for that purpose.

Destruction method: electronic records are deleted so they cannot be recovered, including from search indexes; backups that contain deleted data expire on their normal rotation and are never restored to bring it back. Paper records, if any, are shredded or incinerated.

• Administrative: access to personal data is limited to the people who need it for their work; providers are assessed before use and bound by data processing agreements; this policy and internal procedures are reviewed when the service changes.
• Technical: all traffic is encrypted in transit (TLS); passwords are stored as salted one-way hashes; API tokens and invitation tokens are stored only as SHA-256 hashes; Slack, Discord, and webhook URLs are encrypted at rest (AES-GCM); secrets are held in managed secret stores; sessions expire after 90 days and can be revoked by changing your password; API requests are rate limited; every account-changing request is written to the audit log.
• Physical: our infrastructure runs in Cloudflare’s data centres, which maintain SOC 2 and ISO 27001 attestations; we hold no personal data on premises.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the competent authority as the applicable law requires (within 72 hours of becoming aware for PIPA and GDPR).

UptimeX is built for developers and businesses and is not directed to children. We do not knowingly collect personal data from children under 14 (or under the age of digital consent where you live, if higher). If you believe a child has created an account, contact us and we will delete it.

Wherever you live, you can ask us to tell you what personal data we hold about you (access), correct it, delete it, stop or restrict processing it, give you a copy in a machine-readable format, and withdraw any consent you gave. You can also object to processing based on our legitimate interests. A legal representative or an agent you authorise in writing may act for you.

• In the dashboard: change your email, password, notification preferences, channels, team members, and tokens; delete monitors, projects, or your whole account.
• By email: write to support@uptimex.co from the address on your account. We may ask you to confirm you control that address before acting.
• Response time: we act without undue delay, within 10 days under PIPA and within one month under the GDPR (extendable once by two months for complex requests, with notice).
• No disadvantage: exercising your rights never affects the service you receive, and we do not charge for a reasonable request.
• Limits: we may refuse or limit a request where a law requires us to keep the data (see the records above) or where fulfilling it would harm someone else’s rights; we will explain why.

The legal bases for each category are in the table above. Where we rely on legitimate interests, the interests are running a secure and reliable service, preventing abuse, and giving project owners an accountable history of changes; you may object at any time and we will stop unless we can show compelling grounds. You can lodge a complaint with your national supervisory authority (the list is at edpb.europa.eu) or with the UK Information Commissioner’s Office (ico.org.uk). We have not appointed a representative in the EU or UK under GDPR art. 27 because we do not have an establishment there; our contact for all requests is support@uptimex.co.

In the preceding 12 months we have collected the following categories of personal information, from the sources and for the purposes described above: identifiers (email address, account and provider IDs, IP address), commercial information (plan and subscription records), internet or network activity (requests to the service, audit and service logs), and coarse geolocation (the country of a page view, in aggregate). We disclose these categories only to the service providers listed above for business purposes. We have not sold or shared personal information, and we do not collect sensitive personal information as defined by the CPRA, so no “Do Not Sell or Share” or “Limit the Use of My Sensitive Personal Information” link is needed.

You have the right to know, access, correct, and delete your personal information, to receive it in a portable format, and not to be discriminated against for exercising these rights. Submit a request at support@uptimex.co; we will verify it against the email on your account and respond within 45 days. An authorised agent may submit a request with your written permission. We do not knowingly sell or share the personal information of consumers under 16.

• Items processed without separate consent and their legal basis are marked in the table above (PIPA art. 15(1) no. 2, 4, and 6). We do not use personal data beyond the stated purposes (no “additional use or provision” under art. 15(3) and 17(4)), we do not process pseudonymised data, we do not operate visual data processing devices, and we do not collect online behavioural information for advertising.
• Requests to access, correct, delete, or suspend processing are received by the Privacy team at support@uptimex.co and handled under PIPA art. 35 to 37.
• Chief Privacy Officer (개인정보 보호책임자): SeungMin Lee, support@uptimex.co.
• If a dispute cannot be resolved with us: Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972); Personal Information Infringement Report Center, KISA (privacy.kisa.or.kr, 118); Supreme Prosecutors’ Office cybercrime (spo.go.kr, 1301); National Police Agency cybercrime (ecrm.police.go.kr, 182).

When we change this policy we post the new version here and update the date at the top. For changes that affect your rights or add a new purpose, provider, or overseas transfer, we give at least 7 days’ notice through the service or by email before the change takes effect; where a change needs your consent, we ask for it.