Privacy Policy

Devino operates Uptimely, an uptime and status-monitoring platform that watches the services, pages, and pipelines you ship — around the clock, on the interval you choose — and alerts you when something breaks. Questions about this policy or your data can be sent to support@getuptimely.com.

Some data-protection laws (such as the EU GDPR) distinguish between a controller, who decides why and how personal data is processed, and a processor, who processes it on a controller's instructions. For our own websites and accounts we act as a controller. For the alert-recipient details and status-page content you configure, we act as a processor on your behalf.

• Services — the Uptimely website (getuptimely.com), the application at app.getuptimely.com, the monitoring infrastructure, the AI Copilot and MCP server, and the status pages we host for you.
• Personal data — any information that identifies you directly or indirectly, including identifiers such as IP addresses or cookie IDs.
• You — a visitor to our site or a user of the Services.
• Customer — an account holder who uses Uptimely to monitor services.
• Monitored target — a URL, endpoint, host, or service a Customer configures Uptimely to check.

Where the GDPR or similar laws apply, we only process personal data when we have a lawful basis to do so. Depending on the situation, that basis is one of: your consent; the performance of a contract with you; compliance with a legal obligation; or our legitimate interests in operating, securing, and improving the Services, where those interests are not overridden by your rights.

Depending on how you use Uptimely, we collect:

• Account and registration data — your name and email, and basic profile information if you sign in through a third-party identity provider.
• Monitoring configuration — the targets you ask us to monitor (URLs, endpoints, hosts), the check intervals you choose, and any headers, credentials, or assertions you store to run those checks.
• Alert-recipient details — the contact endpoints you set up to receive notifications, such as email addresses, phone numbers for SMS, webhook URLs, and chat or on-call integrations.
• Check results and logs — response times, status codes, error details, screenshots or response bodies where you enable them, and the incident history we generate from your checks.
• Status-page content — the text, branding, and components you publish on a status page you host with us.
• Billing information — for paid plans, payment is handled by our payment processor; we receive limited billing details (such as plan, status, and the last four digits of a card), not full card numbers.
• Usage and device data (cookies) — technical data such as your IP address, device and browser type, referring pages, and the actions you take. See “Cookies” below.
• Support communications — records of your correspondence with our support team.

• Provide, operate, and maintain the Services — run your checks, detect incidents, and deliver alerts to the recipients you configure.
• Authenticate your account and process transactions and subscriptions.
• Host and serve the status pages you publish.
• Power the AI Copilot and MCP features you choose to use (see below).
• Respond to your requests and provide support.
• Monitor, secure, and improve the Services and develop new features, including by generating aggregate analytics.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Send you service and administrative messages, including the very alerts you ask us to send.
• With your consent or as otherwise permitted, send you product updates.
• Comply with legal obligations and enforce our agreements.

When you use the AI Copilot or MCP features, we send the relevant monitoring context — such as check results, incident data, and the questions you ask — to a third-party AI model provider to generate explanations and recommendations. This happens only to provide the feature you invoked.

AI outputs are decision-support, not guaranteed fact, and may be inaccurate. We do not sell your data, and where an AI feature is powered by a third-party model, it is sent under terms that prohibit using it to train their general models.

A status page you publish may be public. Only include information on it that you are comfortable making available to its audience. You are responsible for the content you publish and for having a basis to display it.

Where you add other people as alert recipients (for example teammates on an on-call rotation), you are responsible for ensuring they expect to receive those notifications. We process their contact details on your behalf solely to deliver the alerts you configure.

We do not sell your personal data. We share it only as described here:

• Within a Customer's account — administrators and members of your organization can see the monitors, incidents, and activity you share with them.
• Service providers (subprocessors) — vendors that process data on our behalf under confidentiality and data-protection terms, including cloud hosting and our probe infrastructure; delivery providers for email, SMS, push, and chat alerts; our AI model provider; payment processing; error monitoring and logging; product analytics; and customer-support tooling. A current list of subprocessors is available on request.
• Named processors — RevenueCat processes subscription and billing status for paid plans, and PostHog, which we host ourselves, provides our product analytics.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction and remains subject to this policy.
• Legal and safety — where we believe it is necessary to comply with law or legal process, enforce our terms, or protect the rights, property, or safety of Uptimely, our users, or others.

The targets you ask us to monitor, and the service providers we rely on, can be anywhere in the world, so we and they may process data in countries other than your own. Where we transfer personal data across borders — for example out of the EEA, the UK, or Canada — we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses or reliance on an adequacy decision, so that your data keeps an equivalent level of protection.

Protecting your data is a priority. We use technical and organizational measures — including encryption in transit, scoped access controls, and monitoring — to guard against unauthorized access, loss, or misuse. Any credentials you store for authenticated checks are encrypted. No system can be guaranteed perfectly secure, and the safety of your account also depends on you keeping your credentials confidential.

We keep personal data only as long as needed for the purposes described here, after which we delete or anonymize it. Check results and incident history are retained according to your plan. Account data is kept while your account is active; when you delete your account, your personal data is erased 30 days later (the window in which we can still restore it for you), except the billing records the law requires us and our payment providers to keep. Delete your account lists exactly what is deleted, what is kept and for how long. Email support@getuptimely.com for details on other retention periods.

Depending on where you live, you may have some or all of the rights below. We may need to verify your identity before acting on a request.

• Access — ask what personal data we hold about you.
• Correction — ask us to fix inaccurate or incomplete data.
• Deletion — delete your account and its data yourself in the app, or ask us to (we may keep what we're legally required to). See Delete your account for the steps and what happens to your data.
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive a copy of the data you provided in a portable format.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.
• Complain — lodge a complaint with your local data-protection authority (we'd appreciate the chance to resolve it first).

To exercise any of these, email support@getuptimely.com. If the data is held on behalf of a Customer, please contact that Customer directly.

Cookies are small text files (and similar technologies like pixels and device identifiers) that help our sites work and help us understand usage. We use:

• Necessary cookies that make the site function and can't be switched off.
• Functional cookies that remember your preferences.
• Security cookies that help protect your session and detect abuse.
• Analytics cookies that tell us how the site is used so we can improve it.

Some analytics cookies are set by third parties such as our web-analytics provider. Most browsers let you refuse or delete cookies; if you do, some features may not work properly.

The Services may link to or integrate with third-party products — for example the chat, on-call, and webhook destinations you connect. Your use of those is at your own risk and subject to their own terms and privacy policies, which we don't control.

If you add the Uptimely app to a Slack workspace, we receive and store:

• Workspace details: the Slack workspace ID and name, and the ID of the Uptimely bot user.
• Access tokens: the bot token Slack issues when you install the app, and, only if you link your own Slack account, a user token for that account. We use them only to post the notifications you configure and to attribute actions you take from Slack.
• Channel IDs and names of the channels you choose in your notification rules.
• Your Slack user ID, name and email, only if you link your Slack account, so actions such as acknowledging an incident from Slack are recorded as yours.
• What you do with our buttons: when you press an action button on an Uptimely message (acknowledge, resolve, change state, add a note, run on-call), Slack sends us that action and any text you type into its form.

We do not read your channels' message history or any messages that are not sent to the Uptimely app.

The app asks Slack for chat:write to post notifications, channels:read and groups:read to list channels so you can pick one, and channels:join to join a public channel you pick. When you link your own account, it also asks for openid, profile and email.

Retention. Tokens are kept until you disconnect Slack or uninstall the app. Notes and actions that arrive from Slack are stored with the incident they belong to and kept for as long as that incident is.

Removing it. Disconnecting Slack in your project settings revokes the tokens at Slack and deletes them from Uptimely. Uninstalling the app from your workspace, or revoking its tokens in Slack, makes Slack notify us, and we delete the stored tokens automatically. If you start an install from the Slack Marketplace and don't finish connecting it to a project within 30 minutes, we revoke that install's token and delete it.

Slack data is used only to provide the Slack features you turned on. It is never sold and never used for advertising. If you ask the AI Copilot about an incident, notes on that incident, including ones typed in Slack, can be part of what is sent to the AI model provider, under the terms described in the AI Copilot and automated insights section above.

If you add the Uptimely agent to Microsoft 365 Copilot or Microsoft Teams, Microsoft calls Uptimely's MCP server on your behalf when you ask the agent about your monitors, incidents or status pages.

Before the agent can read anything, you sign in to Uptimely and approve the access it asks for. Microsoft stores the resulting access token in its own token vault and sends it with each request. We keep a record of that grant so you can see and revoke it.

For each request we receive the action the agent wants to run and the details it fills in from your question, such as a monitor name or a time range. We do not receive your chat history, your email, your files or any other Microsoft 365 data.

We send back only data from the Uptimely projects your account can already see, such as monitor status, incidents and response times. Once it reaches Microsoft, it is handled under Microsoft's own privacy terms, which we don't control.

The agent can change something in Uptimely, such as acknowledging an incident, only if a project admin has turned on AI write actions for that project.

Removing it. You can revoke the agent's access at any time under Connected AI apps in your Uptimely user settings, or remove the agent from Microsoft 365. Revoking it ends its access straight away.

Data from the agent is used only to answer your requests. It is never sold and never used for advertising.

Uptimely is a developer and business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data without appropriate consent, contact us and we'll remove it.

We may update this policy to reflect changes in law or how we operate. We'll post the new version here and update the date above; significant changes may be highlighted. Please check back from time to time.

Questions or requests about this policy or your personal data? Email support@getuptimely.com and we'll be glad to help.