Privacy

Last updated 8 September 2026

Everything factual here was written from the software itself — the fields named are the fields actually stored, and the retention described is what the code actually does. The legal framing has not been reviewed by a solicitor.

Who is responsible

Uptime IOU, based in the United Kingdom, is the data controller for the information described here. Questions and requests go to hello@uptimeiou.com.

What is collected, and why

This is the complete list. It is taken from the database schema rather than written generically, so if something is not named here, it is not stored.

About you as a customer

Company name and billing email. To identify the account and to send the payment link and receipts. Held for as long as the account is open.
The agreed fee rate, and the date you agreed we could charge a saved card.
Card brand and last four digits, and a Stripe reference. The card number itself is never received, stored or seen by this service — it is entered directly with Stripe and held by them. What is kept is enough to recognise which card, and nothing that could be used to pay with.

About your cloud accounts

Provider API credentials — a Cloudflare token, Azure application credentials, or an UptimeRobot key. These are encrypted before storage using AES-256-GCM, and are only decrypted in memory at the moment a check runs. They are requested as read-only: the service cannot change anything in your cloud account.
The names of your services and domains, your plan names, and the monthly amount you pay each provider. The last of these is necessary because provider credit schedules are a percentage of that amount — the fee cannot be calculated without it.
Outage records — start and end times, duration, and the provider's own published description of the incident.
Claims — the calculated uptime, the shortfall, the estimated and confirmed credit, and the drafted claim text.

What is never collected

Card numbers. The contents of anything you host. Any data flowing through your services. No advertising identifiers, no cross-site tracking, and no profile of you as an individual.

One analytics script runs on the public pages. Sereno Analytics counts page views and which buttons get used, so it is possible to tell which parts of the site are worth keeping. It is cookieless and does not identify individuals — there is no way to tell from it that a particular person visited. It does not run on any page behind a login.

Who else sees it

Cloudflare — hosts the service and its database, with data stored in the European Union.
Stripe — holds card details and processes payments. Their privacy notice governs what they hold.
Your own cloud providers — read requests are made to Cloudflare, Microsoft Azure and UptimeRobot using the credentials you supplied, on your behalf.

Nothing is sold, shared for advertising, or passed to anyone else.

How long it is kept

When an account is closed, the provider credentials are erased immediately, along with the services, outage history, claims and credit records derived from watching your infrastructure. The saved card is dropped at the same moment, so nothing can be charged afterwards.

Records of money actually charged are kept, and this is the one thing that cannot be erased on request. UK tax law requires business records of transactions to be retained for six years, so the amount, date and what it was for survive, together with the minimum identifying detail needed to make sense of them. This is a legal obligation rather than a preference, and it is stated here rather than buried because a promise of complete deletion would not be true.

Your rights

Under UK GDPR you can ask for a copy of what is held, ask for corrections, ask for erasure (subject to the retention above), object to processing, or complain to the Information Commissioner's Office. Requests go to hello@uptimeiou.com and are answered within one month.

Security

Provider credentials are encrypted at rest. Access to the operator console requires a passphrase and a bot check. Card details never reach this service. No security claim beyond these is made here, because a claim that cannot be evidenced is worse than none.

Not yet reviewed by a solicitor. A Data Processing Agreement is likely required before signing a customer of any size, since this service processes data about their infrastructure on their instruction.

Back to Uptime IOU