Privacy Policy
Last updated: 30 October 2026
This policy explains how ServerUp Ltd (“ServerUp”, “we”, “us”) handles personal data when you use https://serverup.live and the ServerUp apps for iOS and Android.
1. Data controller
Private limited company registered in England and Wales
Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Email: [email protected]
2. Data we process
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, optional name, language, sign-in codes and links (stored only as a hash) | Create and secure your account, sign you in without a password | Contract |
| Monitors and results: addresses, ports and keywords you monitor, check results (status, response time, error), incidents, SSL certificate and domain expiry dates | Provide monitoring, history, alerts and badges | Contract |
| Status page: its address, title, introduction and (Pro) logo, which are public, as are the names and uptime of the monitors you choose to show | Publish your status page | Contract |
| Alert channels: extra email addresses, webhook address, Telegram bot token and chat id (Pro) | Send alerts where you asked | Contract |
| App: sign-in tokens per device (stored as a hash), device name and platform, push notification token (Firebase Cloud Messaging) | Keep you signed in, send alerts to your phone | Contract; consent for notifications (you can turn them off at any time) |
| Payments on the website: email, country, billing name and address, VAT number, invoice and subscription details. Card details are handled by Stripe, never by us. | Take payment, issue invoices, manage your subscription | Contract; legal obligation (accounting) |
| App store purchases: transaction and subscription identifiers, status and dates sent by Apple or Google, and a random identifier linking the purchase to your account. We receive no card details. | Activate Pro and keep it in sync with the store | Contract |
| Emails we send: sign-in codes, alerts, weekly summary (Pro), receipts, trial reminders | Run the service; alerts and the summary can be turned off in Settings | Contract |
| Security: a hashed (non-reversible) IP address, counters of requests | Prevent abuse, limit sign-in attempts | Legitimate interests (security) |
| Messages: name, email and content of messages you send us | Answer you | Legitimate interests |
| News (optional): email | Occasional product news | Consent |
Monitored sites receive requests from our bot (ServerUpBot) from our servers, never from your device. We do not sell personal data and do not use advertising or tracking cookies.
3. How long we keep data
- Account, monitors, settings and status page: until you delete your account.
- Individual check results: 48 hours. Daily uptime and incidents: 30 days on the free plan, 12 months on Pro. Event feed and alert log: 90 days.
- Payment and invoice records: 6 years after the end of the financial year (UK accounting rules), detached from your deleted account.
- Sign-in codes and links: 30 minutes (records deleted after 24 hours). App sign-ins unused for 6 months are removed.
- Messages: as long as needed to deal with your request.
4. Who we share data with
- Our hosting and email providers, to run the website, the database and send emails.
- Stripe (payments on the website), acting as an independent controller for payment data. Stripe privacy policy.
- Apple and Google for purchases made in their stores, under their own privacy policies.
- Google Firebase (Cloud Messaging) to deliver app notifications, if you allow them.
- Telegram, Slack, Discord or another webhook service, only if you set them up as alert channels: we send them the alert text.
- RDAP registries (via rdap.org), queried with the domain names you monitor to read their expiry date.
- Google Fonts (typefaces on the website).
Some of these providers process data outside the UK (for example in the United States). Such transfers rely on UK adequacy regulations (including the UK–US data bridge where the provider is certified) or on the International Data Transfer Agreement / Addendum.
5. Your rights
Under UK data protection law (UK GDPR and the Data Protection Act 2018) — and the EU GDPR if you live in the EU — you can ask to access, correct, delete or export your data, restrict or object to its use, and withdraw consent at any time. You can delete your account yourself in “My account” or in the app. For any request, write to [email protected]. You can complain to the UK Information Commissioner’s Office (ico.org.uk) or to your local data protection authority.
6. Children
The service is not directed at children under 13, and we do not knowingly collect their data.
7. Security
Connections are encrypted (HTTPS), sign-in codes and tokens are stored only as hashes, IP addresses are hashed, and access to the administration area is restricted.
8. Changes and contact
We may update this policy; the date at the top shows the latest version, and we will email account holders about significant changes. Questions: [email protected] · contact page.