Privacy notice

1. Controller

The controller is PET Digital s. r. o., Agátová ulica 464/8, 951 04 Malý Lapáš, Slovenská republika, company ID 53 324 412. Contact us about privacy at privacy@upbot.eu.

For personal data a customer adds for its contacts, team members, status-page subscribers or monitored services, UpBot may act as processor and the customer as controller.

2. Data we process

• Account and profile data: name, email, hashed password, language and time zone.
• Organisation and collaboration data: memberships, roles, invitations, contact groups and audit events.
• Monitoring data: targets, settings, check results, incidents, latency and technical logs.
• Communications: notification addresses and deliveries, webhooks and support requests.
• Billing: name or company, address, tax identifiers, plan and payment status. Stripe processes card details; they do not pass through UpBot servers.
• Technical data: IP address, user agent, session identifier and security logs required to operate the service.

3. Purposes and legal bases

• Contract: account creation, monitoring, alerts, collaboration, support and billing.
• Legal obligation: accounting and tax records and legally required requests.
• Legitimate interests: security, abuse prevention, auditing, troubleshooting and proportionate service improvement.
• Consent: only where explicitly requested for optional marketing or analytics technologies. Consent may be withdrawn at any time.

4. Recipients and providers

We share data only with personnel and providers that need it to deliver the service, are subject to appropriate safeguards and act on our instructions. Categories and planned subprocessors are listed in the DPA.

Where a transfer outside the EEA is necessary, we use a valid GDPR mechanism such as an adequacy decision or standard contractual clauses.

5. Retention

• Account and configuration data are kept for the contract term and a reasonable period afterwards for recovery or claims.
• Monitoring history follows the selected plan retention; aggregated or anonymised statistics may remain longer.
• Accounting records are kept for the statutory period.
• Security and audit logs are kept only as long as proportionate to their purpose and risk.
• Backups are deleted through rotation unless law or incident handling requires longer retention.

6. Your rights

• You may request access, correction, erasure, restriction and portability where GDPR provides these rights.
• You may object to processing based on legitimate interests and withdraw consent.
• Send requests to privacy@upbot.eu. We may reasonably verify your identity.
• You may complain to the Slovak Data Protection Authority at Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk, or to the authority in your country.

7. Required data

Data marked as required is needed to enter into or perform the contract or comply with law. Without it, an account, paid service or feature may not be available. Other data is optional.

8. Automated processing

UpBot automatically evaluates technical checks and opens incidents or sends alerts according to customer rules. This does not produce legal or similarly significant effects on individuals under GDPR Article 22.

9. Security and changes

We apply appropriate technical and organisational measures, including access controls, encrypted transmission, secure password storage, auditing and backups. We may update this notice when the service, providers or law changes and will publish the effective date.

10. Mobile app, widgets and notifications

MH Global Trade s.r.o. publishes the mobile app. The service provider and data controller remain those identified in section 1.

Optional iOS and iPadOS widgets display workspace and service names, availability, response time, the last check time and incident summaries. People who can see your device screen may also see this information. You can remove a widget from your Home Screen at any time.

The app and its widget store your selected monitor and the last fetched data on your device. The widget uses a session token stored in the system Keychain to fetch data from the UpBot API, including while the app is closed. It does not send this data to advertising or analytics services. Signing out clears the shared token and widget data; the system display may take time to refresh.

If you enable push notifications, we process the device token, platform, associated account and workspace, and delivery status. Expo Push Service, Apple Push Notification service and Google Firebase Cloud Messaging carry the token and notification content needed for delivery. Monitor names and incident information may appear in notification previews according to your device settings. You can disable notifications in Account or in system settings.

You can delete your account after signing in at https://app.upbot.eu/settings#delete-account. Account → Delete account in the mobile app opens the same process. The statutory retention obligations described above still apply.