Data and privacy

What up4 stores about your checks, for how long, where it runs and how you get your data out. The legal text is the privacy policy.

What up4 stores

• Your setup. Monitors, alert plans, status pages and incidents, with the settings you entered. Passwords for basic auth, custom headers and the secret fields of alert channels are encrypted before they are stored. Request bodies are not part of that encryption.
• Check results. Status, timing and error diagnostics. A keyword check reads a bounded part of the page, and up4 does not keep that page with the result.
• Check-ins from scheduled jobs. When they arrived and from which address.
• Your account. Email, name and the members of your Company, as listed in the privacy policy.

How long it is kept

The window beyond seven days is plan data, not a fixed rule. The privacy policy lists every retention period, including billing records that the law requires up4 to keep.

Where it runs

The application and its main database run in Germany, and the results of all checks are stored there. After seven days results move to an archive in Paris, so they stay in the EU. Checks run from Europe, North America, Asia and Australia, depending on the regions you choose for a monitor. A region receives the settings it needs to run its check; a monitor set to Europe only is checked from Germany alone. The privacy policy names the providers, their tasks and where they process data.

Export your data

• Monitors. Export monitors (CSV) writes every monitor to a file that goes straight back into the batch import, in this or another account. Credentials, request headers, request bodies and proxy settings are left out on purpose and must be entered again.
• Reports. Under Reporting, Export offers PDF (share & print), CSV (spreadsheet / data), Excel workbook and JSON (machine-readable).
• Everything about you. For a request under data protection law, write to the address in the privacy policy.

Delete data and accounts

Your own identity. Any member can delete their own identity in the account settings under Account deletion, with Delete identity. That removes your sign-in, sessions and memberships. Shared Company data stays with the Company.

A whole Company. Only the owner can ask for this, with Request deletion in the same place, or by writing to the privacy address. up4 checks subscriptions, refunds and open disputes by hand before it deletes anything, because deletion cannot be undone. Afterwards the Company's product data, public shares, attachments and archives are removed. Records the law requires, such as invoices, stay in pseudonymous form for the legal period.

Starting credit is not refundable. Paid credit that is left over is reviewed and refunded on request where that applies.

Data processing agreement

The data processing agreement is available in German and English. If your procurement team needs different terms, send your requirements through the contact form; up4 reviews the terms and the actual processing chain, including agency arrangements.