Privacy Policy

UptimePilot ("we"), a sole proprietorship based in Hyderabad, India, is the data fiduciary (data controller) for the personal data described here. Our legal business details are on our Contact page. For data your team puts into a workspace — for example teammates' email addresses used for alerts — the workspace owner decides what is collected and we process it on their behalf.

• Account data: your name, email address, a salted hash of your password (never the password itself), time zone and display preferences, two-step verification settings (the secret is stored encrypted), and API key fingerprints. If you sign in with Google we receive your Google account ID, name and verified email address.
• Workspace data: workspace name, members and their roles, invitations, notification channels (such as email addresses, Slack/Teams webhook URLs, PagerDuty keys — stored encrypted where they are secrets) and alert rules.
• Monitoring data: the URLs, hostnames, IP addresses and request settings you configure, and the results of each check (status, response time, status code, error messages, certificate and domain expiry dates), incidents and comments.
• Billing data: plan, payment status, amounts, invoice details and the billing name, address, mobile number and GSTIN you provide. Payments are processed by Razorpay; we never receive or store your card number, CVV, UPI PIN or bank login. We keep the Razorpay order and payment IDs needed to reconcile payments.
• Support and communications: messages you send us and the emails we send you.
• Security and technical logs: IP address, browser user agent, request IDs, sign-in attempts and an audit log of important actions in each workspace, used to keep the Service secure and to troubleshoot.

We do not knowingly collect data from children, and we do not collect sensitive personal data such as health or financial account details.

• To run the Service: perform checks, open incidents and deliver alerts to the channels you choose.
• To create and secure your account: sign-in, email verification, password reset, two-step verification, fraud and abuse prevention.
• To bill you: take payments through Razorpay, issue tax invoices and send receipts and plan reminders.
• To support you and tell you about important changes to the Service, your plan or these policies.
• To comply with law, for example tax record-keeping, and to enforce our Terms.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we process your data on the basis of your consent, given when you sign up, and for legitimate uses permitted by the Act, such as complying with law. Where GDPR-style laws apply, we rely on performance of our contract with you, our legitimate interest in keeping the Service secure, your consent (which you can withdraw), and legal obligations. We do not sell your personal data and we do not use it for advertising.

We share personal data only with service providers that help us run UptimePilot, under contracts that require them to protect it:

• Razorpay — payment processing; it receives the payer's name, email address and mobile number to process each payment.
• Our email (SMTP) provider — delivery of verification, alert, receipt and account emails.
• Our hosting and infrastructure providers — servers, databases and backups.
• Google — sign-in, only if you choose "Continue with Google"; and Google Analytics for usage statistics (cookies only with your consent).
• Destinations you configure — Slack, Microsoft Teams, PagerDuty and webhooks receive the alert content you route to them.

We may also disclose data when required by law or a valid order from a competent authority, or to protect the rights and safety of our users and the Service. If our business is sold or merged, data may transfer to the new owner under this policy.

Some providers may process data outside India. When they do, we use providers that offer appropriate safeguards and we comply with any transfer restrictions notified under the DPDP Act.

We keep this minimal and use no advertising cookies. Analytics cookies are only set if you accept them.

• Sign-in cookie (uptimepilot_refresh): a secure, HTTP-only cookie that keeps you signed in for up to 30 days. It is deleted when you sign out.
• Google sign-in cookie: a short-lived cookie (a few minutes) used only while you complete "Continue with Google", to protect against forged sign-in requests.
• Local storage: your selected workspace and theme preference are remembered in your browser. They never leave your device except as part of normal requests to us.

Analytics (optional): we use Google Analytics to understand which pages are used and how the Service performs, so we can improve it. Analytics cookies (_ga, _ga_*) are set only after you click "Accept" on the cookie banner; until then Google receives only cookieless, aggregate signals. We send page paths without query strings (so links such as password-reset or invitation links are never shared), never your email or monitor data, and advertising features are turned off. Google processes this data as our service provider; see Google's privacy policy.

The other items above are strictly necessary for the Service to work. You can change your analytics choice at any time: Cookie settings.

• Check results are kept for the history period of your plan — 7 days in the free trial, 30 days on Starter, 60 days on Pro and 90 days on Business — and then deleted automatically. When a workspace moves to a plan with a shorter history, older results are deleted at the next daily clean-up.
• Account and workspace data is kept while your account or workspace exists. When you delete a workspace or your account, we delete the associated data from our live systems immediately; copies in encrypted backups are overwritten within 30 days.
• Billing records and tax invoices are kept for as long as Indian tax law requires (generally 8 years), even after deletion, but are not used for anything else.
• Security logs are kept for up to 180 days unless needed to investigate an incident.

Subject to applicable law (including the DPDP Act and, where it applies, the GDPR), you can:

• Access and export your data: download a JSON copy any time from Settings → Profile ("Export my data").
• Correct your name, email preferences and workspace details in Settings, or ask us to.
• Erase your data: delete a workspace (owners) or your whole account from Settings. Deletion is permanent.
• Withdraw consent at any time by deleting your account; this doesn't affect processing that already happened.
• Nominate another person to exercise your rights in case of death or incapacity (DPDP Act), by writing to our Grievance Officer.
• Object or restrict certain processing, and complain to a data protection authority.

For anything you can't do yourself in the app, email [email protected]. We may need to verify your identity, and we aim to respond within 30 days.

We protect data with encryption in transit (HTTPS), hashed passwords, encrypted secrets, optional two-step verification, role-based access within workspaces, rate limiting and audit logs. No system is perfectly secure; if a personal data breach affects you, we will notify you and the authorities as the law requires.

In line with the Information Technology Act, 2000, its rules, and the DPDP Act, 2023, you can raise any complaint about how we handle your personal data with our Grievance Officer:

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you're not satisfied with our response, you may approach the Data Protection Board of India once it is operational.

We'll update the "Last updated" date when this policy changes and, for significant changes, tell you by email or in the app before they apply.