Scope and contact
This policy covers the public UpBastion website, its monitoring application and messages sent to UpBastion. UpBastion is responsible for the processing described here. Contact [email protected] for privacy questions or requests, or use the contact form.
The cookie policy explains browser storage and the optional analytics controls. The terms of service describe the service and the rules for using monitored addresses.
Account and monitoring information
Clerk handles account authentication. UpBastion's application database stores your Clerk user identifier and synchronized verified primary email address. The monitoring database does not store your account password. Information you provide in Clerk's account flows is also processed by Clerk to provide authentication.
When you create a monitor, we store its owner, name, complete URL, active or paused state, scheduling and creation information. Observations include timestamps, success or failure, HTTP status when available, measured request duration, request error and available TLS expiry metadata. Incidents record observed start and end times and an error reason.
We use these records to run checks, associate results with your account, display history and send incident, recovery and certificate-expiry emails. Monitoring emails contain the monitor name and full URL. Do not place secrets or third-party personal information in a name or URL query string.
The worker makes requests to your monitored endpoint. That endpoint and its infrastructure can see the worker's network address, request path and monitoring user agent. You are responsible for having permission to monitor the endpoint and for how your own endpoint handles requests.
Contact messages and service communications
The contact form collects your name, email, selected topic and message. A submission identifier prevents the same submitted request from being queued repeatedly. We use the information to receive and handle your inquiry. The form does not request an attachment or a password.
Messages are queued in the application database and delivered to [email protected] through the configured email service. Your address is used as the reply-to address. Contact form submissions are not automatically added to a marketing list.
To limit spam, the application derives a keyed hash from the network address supplied by the request proxy. The contact queue stores that hash with the message and uses it to count recent submissions. The queue does not store the raw source IP in that field. The proxy itself still processes network information when serving the request.
Website requests and optional analytics
Serving a website request involves processing information such as its IP address, user agent, requested URL and technical response data. Our hosting and Cloudflare infrastructure process this information to deliver requests and operate their services. Diagnostic records can include errors and request metadata needed to investigate a service problem.
Optional Umami analytics runs only after you allow it in Cookie settings. It is self-hosted on UpBastion's domain and describes visits to public pages, including page and referrer information, visit time, browser, device, screen and language information, and approximate location. Umami derives session identifiers from request information; see its session documentation.
Tracked page paths exclude query strings and fragments. UpBastion does not send account identities, monitor records or contact form values to the tracker. Session replay and advertising pixels are not enabled by the application. You can withdraw analytics permission through the footer without losing access to the service.
Purposes and legal grounds
Where the GDPR applies, we process account and monitoring information to provide the service you request. We process support inquiries to respond to your request, including steps related to the service, and rely on our legitimate interest in handling other correspondence and keeping the service secure. The security interest includes preventing spam and investigating faults.
Optional website analytics relies on your consent. You can withdraw that consent at any time through Cookie settings. Withdrawal stops future collection through that choice and does not change the lawfulness of earlier consent-based processing. Records required by an applicable legal obligation are processed for that obligation.
Providing an account identifier and a usable monitored address is necessary for account-based monitoring. A verified primary email is needed for monitoring alerts. Contact details are needed if you want a response to a message. Analytics permission is optional. The application does not use these records for automated decisions producing legal or similarly significant effects about you.
Service providers and disclosure
The service uses Clerk for authentication, Neon PostgreSQL for application records, Cloudflare for public request routing and protection, and home.pl SMTP for email delivery. Umami analytics is hosted in a separate database operated with the UpBastion deployment. Hosting infrastructure also processes the records necessary to run the application.
These providers handle information relevant to their role. Their published information is available from Clerk, Neon and Databricks, Cloudflare and home.pl. A provider's general privacy notice does not replace this policy for UpBastion's use of the service.
We do not sell account or monitoring information. Disclosure can be necessary to comply with a binding legal requirement or address misuse and security incidents. Provider processing locations and transfer arrangements depend on the services and contracts in use. This policy does not claim that all processing stays in a particular country; contact us for the arrangements relevant to your request.
Retention and deletion
Account and monitor records remain in the application while the account and monitor exist. The worker's daily cleanup removes check results older than 30 days and closed incidents whose end time is older than 30 days. Open incidents remain until closed or their monitor is deleted.
Sent and permanently failed notification queue records, including contact submissions and their anti-spam hash, are removed by daily cleanup when their creation time is older than 30 days. Pending messages remain while awaiting processing. A delivered message also exists in the receiving mailbox; deleting a queue entry does not recall that email.
Support correspondence is retained for handling the inquiry and related follow-up, or an applicable legal need. Saved browser preferences are valid for up to 180 days. The current self-hosted analytics database has no automatic record-expiry schedule, so analytics records remain until deleted by the operator. Contact us about records that concern you.
Deleting a monitor removes its results, incidents and associated mail queue entries from the active application database. When a Clerk account-deletion event is received and processed, account deletion removes the application user and the user's monitoring records. Copies in delivered email or existing backups are not erased by that database operation. See account and data for the available account controls.
Your rights and requests
Depending on the law that applies, you can request access, correction, erasure, restriction, portability or object to relevant processing. You can withdraw optional analytics consent in Cookie settings. To make another request, email [email protected], identify the account or records involved and describe the action you want.
We may need information to verify your entitlement to the records. Do not send a password or authentication token. Some requests are subject to legal conditions or retention duties. Where GDPR rights apply, you can also complain to the relevant supervisory authority; the EDPB directory lists authorities. The GDPR text provides the legal provisions.
Security and updates
The application scopes monitor access to the authenticated owner, validates monitored URLs and uses TLS verification for HTTPS checks. These measures do not make a guarantee that a system can never experience unauthorized access or data loss. Keep your own account credentials secure and report suspected misuse through contact.
The update date identifies the version of this policy. We will revise it when the described processing changes. Read the related cookie policy and account documentation for current controls.