Privacy Policy

This Privacy Policy explains how we collect, use, process, store, and protect your personal information when you use the UptimeWarden monitoring platform and related services.

UptimeWarden is developed and operated by Zenigma Teknoloji Anonim Şirketi, a Turkish corporation providing comprehensive monitoring solutions for websites, APIs, servers, and digital infrastructure with intelligent threat detection and security analysis.

This Privacy Policy applies to all personal information we collect and process through:

• UptimeWarden web platform (uptimewarden.online and app.uptimewarden.online)
• Monitoring agents and distributed infrastructure systems
• API services, integrations, and third-party connections
• Mobile applications and browser extensions (when available)
• Customer support channels and communication systems
• Marketing communications and promotional materials

This Policy does not apply to third-party websites, services, or applications that may be linked to or integrated with our Services, even if accessed through our Platform.

We process your personal information based on the following legal grounds under GDPR Article 6 and KVKK Article 5:

We may collect information about you in a variety of ways:

Personal Data

Personally identifiable information may include:

• Email address
• First name and last name
• Username
• Password (securely hashed and encrypted)
• Payment information (processed securely by third-party providers)

Usage Data

We may also collect information that your browser sends whenever you visit our Service or when you access the Service by or through a mobile device. This may include your IP address, browser type, browser version, the pages of our Service you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Monitoring Data

To provide our monitoring services, we collect data about the services you configure for monitoring, such as:

• URLs and endpoints you configure for monitoring.
• Response times, status codes, and availability metrics.
• SSL certificate information and expiration dates.
• Security headers and vulnerability scan results.

Usage Analytics

We collect analytics data to improve our services:

• Platform usage patterns and feature utilisation.
• API access logs and integration usage.
• Performance metrics and error logs.
• Device and browser information.

We implement technical and organisational security measures to protect your personal information:

• •Encryption: All traffic to the Platform is served over HTTPS (TLS). Payment-card credentials and other sensitive credentials are stored encrypted with AES-256-GCM.
• •Access Controls: Role-based access control with secure session management and account-lockout protection.
• •Infrastructure Security: Hosting in Microsoft Azure data centres in the European Union, with regular security audits.
• •Data Minimisation: We collect only the data necessary for service operation.
• •Regular Backups: Automated backups, kept in the European Union.

These are the cookies we use. The necessary ones are required for the service to work and cannot be switched off; the rest run only with your consent. You can change your choice at any time from the cookie notice.

Necessary cookies

• connect.sid, keeps your session open. Stored for the duration of the session.
• uw_access_token and uw_refresh_token, keep you signed in. Their lifetimes follow the configured session lifetime.
• csrfToken, protects against cross-site request forgery.
• uw_oauth_state_google and uw_oauth_state_github, verify the sign-in round trip with Google or GitHub. They expire after 10 minutes.

Analytics cookies (consent-based)

• First-party product analytics, hosted on our own infrastructure, usage measurement including page views, interactions and errors. Data is not shared with a third-party analytics network. Runs only if you consent to analytics.

Marketing cookies

The cookie notice offers a marketing category; we do not currently set any cookie in it. If that changes we will update this section and ask for your consent separately.

You can also delete or block cookies in your browser settings. Blocking the necessary cookies may stop you signing in or prevent parts of the service from working.

Specifically, we may use information collected about you to:

• Create and manage your account securely.
• Provide monitoring, security analysis and, if you turn them on, AI features.
• Process payments and send transaction confirmations.
• Send security alerts, updates, and support communications.
• Provide customer support and respond to inquiries.
• Improve the accuracy of our monitoring and analysis.
• Ensure compliance with legal obligations and regulations.

We may share information we have collected about you in certain situations:

By Law or to Protect Rights

If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

Third-Party Service Providers

We may share your information with third parties that perform services for us or on our behalf, including payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance.

We describe these recipients by category rather than by name so that the specifics of our supply chain are not published. That does not limit your right to know: a current list of the sub-processors that receive personal data, together with the country in which each processes it, is available on request from [email protected].

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

This section explains where we store your data, which parts of the service run outside the European Union, and the safeguards that apply when personal data leaves the European Union or Turkey.

Where we store your data

We store customer data in Microsoft Azure data centres in the European Union. The primary database is in Sweden and the application platform is in Germany. Backups are also kept in the European Union.

Monitoring locations

Monitoring checks run from six locations: one in Germany and five outside the European Union, in Australia, Brazil, Singapore, the United Arab Emirates and the United States. Each location receives only the monitor settings it needs to run a check, such as the address to check and any request headers you configure. It runs the check and sends the result to our systems in the European Union. These locations do not store customer data.

Other service providers

Service providers that deliver notifications (SMS, voice calls, WhatsApp, push notifications and email), provide content delivery and DDoS protection, or process card payments receive the data needed for their service. Some of them process it outside the European Union. AI requests are sent only to Microsoft Azure, as described in Section 10. The full list of sub-processors, with the country in which each processes data, is available on request as described in Section 8.

Transfer safeguards

When personal data is transferred out of the EEA, the United Kingdom or Switzerland, for example to a monitoring location or a service provider outside the European Union, we rely on one or more of the following safeguards under GDPR Chapter V:

• European Commission adequacy decisions (Art. 45).
• Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c)).
• Supplementary technical and organisational measures (encryption, pseudonymisation, access controls) where required by a Transfer Impact Assessment.

Storing your data in the European Union is itself a transfer out of Turkey. For this and every other transfer out of Turkey, we rely on the safeguards in KVKK Article 9: an adequacy decision of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) where one exists, or otherwise the standard contracts published by the Board. Only for occasional transfers where neither applies do we rely on one of the exceptions in Article 9, such as your explicit consent.

You may request a copy of the safeguards we apply to international transfers by writing to [email protected].

UptimeWarden uses artificial-intelligence techniques (including statistical analysis, anomaly detection, and large language models used through Microsoft Azure) to deliver predictive monitoring, anomaly detection, incident correlation, and security analysis.

These processes operate on technical monitoring data (URLs, response times, status codes, certificate metadata, logs) and do NOT produce legal or similarly significant effects on data subjects within the meaning of GDPR Art. 22(1). We do not use your personal data for solely automated decisions that materially affect you (e.g., automated credit scoring or eligibility decisions).

If any future feature relies on solely automated decision-making with such effects, we will (i) obtain your explicit consent or rely on another lawful basis permitted under Art. 22(2), (ii) provide meaningful information about the logic involved, and (iii) preserve your right to obtain human intervention, express your point of view, and contest the decision. Equivalent rights apply under KVKK Art. 11(g) for processing carried out exclusively by automated means.

AI features that use large language models run only after you turn on AI processing in your profile. You can turn it off at any time; while it is off, we start no new AI requests for you.

We use these models only through Microsoft Azure, our AI sub-processor. Microsoft Azure is the only service to which we send AI requests; we do not send them directly to the companies that develop the models.

Before a request is sent, common personal data and secrets in it, such as email addresses, IP addresses, API keys, tokens and database credentials, are masked. Masking is pattern-based and may not catch every value. Each request contains only the monitoring context it needs.

The AI service does not store your prompts or the outputs it returns. Microsoft does not use them to train AI models, and we do not allow your data to be used for that purpose.

UptimeWarden itself stores the AI results it shows you, such as health predictions, postmortem drafts, and the questions you ask the Wardy assistant with its answers, in its own database in the European Union. These are retained according to your subscription plan's data-retention limits; postmortem drafts are kept with the incident they belong to. We also keep a usage record for each AI request — the feature and the resources the request consumed, but not the prompt or the output — for 400 days, for billing and to enforce plan budgets.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Typical retention periods are:

• •Account & profile data: for the duration of your subscription. When you request account deletion, the account enters a 30-day grace period during which you may cancel the request and export your data, after which the account is irreversibly removed.
• •Monitoring results: retained according to your subscription plan's data-retention limits; aggregated or anonymised analytics may be retained longer.
• •AI results and usage records: AI results such as health predictions and Wardy answers are retained according to your subscription plan's data-retention limits; AI usage records, which contain no prompts or outputs, are retained for 400 days.
• •Invoicing and tax records: retained for the statutory period under the Turkish Tax Procedure Law (currently 5 years from the close of the relevant fiscal year) and applicable EU rules.
• •Security and audit logs: retained for the time required to investigate security incidents and to respond to legal process; we minimise retention to what is necessary.
• •Marketing data: until you withdraw consent or object to processing.

When personal data is no longer required, it is securely deleted, anonymised, or returned to you, in line with our retention schedule and the principles of storage limitation and data minimisation.

We maintain incident-response procedures designed to detect, contain, and remediate security incidents affecting personal data. In the event of a personal data breach:

• Under GDPR Art. 33, where the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• Under GDPR Art. 34, where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected data subjects without undue delay in clear and plain language.
• Under KVKK Art. 12(5) and Board Decision No. 2019/10, we will notify the Personal Data Protection Authority (KVKK Kurumu) within the prescribed period (currently 72 hours) and inform affected data subjects in the shortest reasonable time.
• Where UptimeWarden acts as a processor for a business customer (Controller), we will notify that Controller without undue delay so they can comply with their own notification duties.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority:

• Turkey

  Kişisel Verileri Koruma Kurumu (KVKK), kvkk.gov.tr. Note: under KVKK Art. 14, you must first apply to the data controller before submitting a complaint to the Board, except where the Board determines otherwise.

• EU/EEA

  The data protection authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.

• United Kingdom

  The Information Commissioner's Office (ICO), ico.org.uk.

We encourage you to contact us first at [email protected] so that we may attempt to resolve your concern directly.

Subject to the conditions and exceptions in applicable law, under KVKK Article 11, you have the right to (i) learn whether your data is being processed, (ii) request information if it has been processed, (iii) learn the purpose of processing and whether the data is used in line with that purpose, (iv) know the third parties to whom your data is transferred at home or abroad, (v) request correction of incomplete or inaccurate data, (vi) request erasure or destruction, (vii) request notification of corrections/erasures to third parties, (viii) object to outcomes resulting from solely automated processing that produce adverse effects, and (ix) claim compensation for damages arising from unlawful processing.

Under the GDPR, you additionally have the rights summarised below:

• •Right of Access: Request copies of your personal data.
• •Right to Rectification: Request correction of inaccurate data.
• •Right to Erasure: Request deletion of your personal data.
• •Right to Restrict Processing: Limit how we use your data.
• •Right to Data Portability: Receive your data in a machine-readable format.
• •Right to Object: Object to processing based on legitimate interests.

To exercise these rights, write to [email protected] with sufficient information to verify your identity. Under KVKK Art. 13, we respond within 30 days at the latest; under GDPR Art. 12(3), we respond within one month, extendable by a further two months for complex requests with notice. Requests are free of charge unless they are manifestly unfounded or excessive, in which case a reasonable fee may be charged or the request refused.

The Services are not directed to minors. Consistent with our Terms of Service, you must be at least 18 years old to create an account and use the Services. We do not knowingly collect, solicit, or process personal data of individuals under 18 years of age.

Under GDPR Art. 8, where any optional feature relies on consent and is offered to information-society users in the EU/EEA, processing of data of users under the age of 16 requires the consent of a parent or legal guardian (Member States may lower this threshold to 13). Under Turkish law, processing personal data of children typically requires consent and the assistance of a legal guardian.

If you are a parent or guardian and you believe that a minor has provided us with personal data, please contact [email protected]. If we become aware that we have collected personal data from a minor without the appropriate consent, we will take steps to delete that information from our systems.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Changes in this version (25 September 2026)

• Section 9 now states where we store your data: in Microsoft Azure data centres in the European Union, with the primary database in Sweden, the application platform in Germany and backups in the European Union.
• Section 9 now explains that monitoring locations outside the European Union run checks but do not store customer data, and describes the safeguards for transfers out of the European Union and Turkey.
• Section 10 now describes how AI processing works: requests go only to Microsoft Azure, the AI service does not store prompts or outputs, they are not used to train AI models, prompts are masked, and AI runs only with your consent. It also sets out what UptimeWarden itself keeps and for how long.
• Sections 6, 7 and 11 were updated to match: backups are kept in the European Union, our monitoring is no longer described as AI-powered, and AI results and usage records have their own retention entry.

For questions about this Privacy Policy or to exercise your rights, please contact us:

This Privacy Policy is effective as of 25 September 2026.