UpHeron

Privacy policy

Last updated: 16 October 2026

UpHeron (upheron.com, its API, MCP server and status pages) is run by Symelo LTD, a company registered in Bulgaria, VAT number BG207464756, ul. Makedonia 66, ap. 51, Plovdiv, Bulgaria. Symelo LTD is the controller of the personal data described here. Write to [email protected] about anything in this policy.

In short

  • We collect what we need to run your account and your monitors, and nothing for advertising.
  • We use no analytics, advertising or tracking cookies, and no third-party trackers.
  • Our servers are in Germany. Sign-in goes through Clerk and payments through Stripe.
  • You can see, export, correct or delete your data: write to [email protected].

What we collect and why

Your account. Your name, email address and how you sign in, and the name of your workspace. Your profile, password or social sign-in are held by Clerk, our sign-in provider; we keep your Clerk identifiers and your workspace's name. We need this to give you an account (legal basis: the contract with you, Art. 6(1)(b) GDPR).

Billing. Your plan and subscription status, and the billing name, address, country and VAT number you give us. Card details go straight to Stripe; we never see them. We use this to charge for paid plans and keep accounting records (the contract, and our legal obligations under accounting and tax law, Art. 6(1)(c)).

Your monitors. The addresses you monitor and their settings, check results (status, response time, status codes, error messages), incidents, status pages, software lists and repository addresses. Access tokens you give us, for example for private repositories or alert channels, are stored encrypted. This is the service you signed up for (the contract).

Alert contacts. Email addresses, chat IDs and webhook addresses you add to receive alerts. A new email address must confirm before it receives alerts. If you add other people, make sure you may give us their details; we use them only to deliver the alerts you set up (the contract with you, and our legitimate interest in delivering them, Art. 6(1)(f)).

API tokens and AI agents. Token names, when they were last used, and agents you connect. Tokens are stored only as digests, so we cannot read them back (the contract).

The website check on the home page. The address you enter, which we check once and do not keep. To stop abuse, we limit how often it can be used: for that we keep a keyed hash of your IP address, in memory only, for a few minutes (our legitimate interest in offering a free check and protecting it).

Popular website pages. We count views of each popular website's page to order the list. Repeat views are ignored for a minute using a keyed hash of your IP address, kept in memory only. The counts contain no personal data (legitimate interest).

Server logs. Like any website, our servers record requests, which can include your IP address, the time, the page and your browser. We use them only to keep the service secure and fix faults, and keep them no longer than needed for that (legitimate interest).

Messages you send us. We use what you write to answer you.

We do not sell personal data, use it for advertising, or make decisions about you by automated means alone.

Cookies and browser storage

Necessary, always on, as the site cannot work without them:

  • Cookies and browser storage set by Clerk, our sign-in provider (such as __session and __client_uat), which keep you signed in. Clerk's sign-in script loads on every page, so they can be set on any page.
  • uptime:consent (local storage): your cookie choice.
  • pulseguard:monitor (session storage): the website you checked on the home page, carried to sign-up when you choose to add it to an account.
  • pulseguard_admin: a session cookie used only by our own administrators.

Preferences, only if you allow them:

  • uptime:monitor-tab (local storage): the monitors tab you last opened in the dashboard.

Analytics and advertising: none.

You can change your choice at any time with Cookie settings at the bottom of every page. Turning preferences off deletes what they stored.

Who processes data for us

  • Hetzner Online GmbH, Germany: hosts our application, database and monitoring servers.
  • Clerk, Inc., United States: sign-in, account profiles and subscription management. Because its script loads on every page, Clerk receives your IP address and browser details.
  • Stripe: processes payments for paid plans and for monitors that AI agents pay for.

We send alert and confirmation emails through our own mail server.

When you send alerts to Slack, Discord, Microsoft Teams, Google Chat, Telegram, PagerDuty, Pushover, ntfy or your own webhook, or monitor a GitHub repository, we send the relevant data to that service for you, and its own privacy terms apply. To find vulnerabilities we look up software names and versions in public databases (OSV.dev, the US National Vulnerability Database, CISA and endoflife.date); no personal data is sent to them.

Clerk and Stripe may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

How long we keep it

  • Account and workspace data: while your account exists. When you close your account or ask us to delete it, we delete it within one month, except what we must keep by law.
  • Check results: individual results for 1 day on the Free plan and 7 days on paid plans; the error log for 30 days on Free and 90 days on paid plans; daily uptime totals (how many checks ran, passed and failed, and the average response time) for as long as the monitor exists.
  • Resolved vulnerability findings: 180 days after they are resolved.
  • Invoices and accounting records: as long as Bulgarian accounting and tax law requires.
  • Server logs: only as long as needed for security and troubleshooting.
  • IP address hashes for rate limits: in memory, for minutes.

Your rights

Under the GDPR you can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct it;
  • delete it;
  • restrict how we use it;
  • give it to you, or another service, in a machine-readable format;
  • stop using it where we rely on our legitimate interests (you can object).

Where we rely on your consent, such as for preference storage, you can withdraw it at any time with Cookie settings. Write to [email protected]; we answer within one month.

You can also complain to a data protection authority: in Bulgaria, the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or the authority where you live or work.

Security

All traffic to UpHeron is encrypted with HTTPS. Access tokens and alert channel secrets are stored encrypted, and API tokens only as digests. Only the people who run the service can reach its servers and database.

Children

UpHeron is not meant for children under 16, and we do not knowingly collect their data.

Changes

When we change this policy we update this page and its date. If a change matters to how we use your data, we tell account holders by email before it takes effect.