Privacy Policy
How [Company legal name] collects and uses personal data when you visit our website or use Upstreamr, in line with the EU General Data Protection Regulation (GDPR).
Draft, pending legal review. This document is a template and is not yet in force. Text in [brackets] will be completed before launch.
Contents
1. Controller
[Company legal name], [Registered address], is the controller for the processing described here. Contact: hello@upstreamr.com. [Data protection officer, if appointed.]
For data our customers publish or collect through Upstreamr, such as subscribers of a customer’s status page, the customer is the controller and we act as its processor under the Data Processing Agreement. Subscribers should contact the company running the status page.
2. Data we process
- Account data: name, email address, organization, role, and authentication data (password hashes and session records).
- Billing data: billing contact, address, VAT number and payment status. Card details are collected and stored by Stripe, not by us.
- Usage and technical data: IP address, browser details and logs of requests and actions, kept for security and troubleshooting.
- Communications: emails you send us.
- Status page visitors: requests are processed to serve the page. We do not use advertising or tracking cookies. An approximate location derived from the IP address may be used to show the nearest location, without being stored.
3. Purposes and legal bases
- Providing the service and managing your account: performance of a contract (Art. 6(1)(b) GDPR).
- Billing, accounting and tax: legal obligation (Art. 6(1)(c)) and contract.
- Security, abuse prevention and service improvement: legitimate interests (Art. 6(1)(f)).
- Service and product announcements to customers: legitimate interests, with an opt-out in every email.
4. Cookies
We use only cookies that are strictly necessary, such as the session cookie that keeps you signed in, and local storage for preferences like the colour theme. We do not use analytics or advertising cookies.
5. Sub-processors and recipients
We share personal data only with service providers that help us run Upstreamr:
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, compute, database, queues, content delivery and network security | Global network; EU data localisation where configured | EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework |
| Stripe Payments Europe, Ltd. (Stripe) | Payment processing, invoicing and tax calculation | Ireland, with transfers to the United States | EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | Transactional and notification email delivery | United States and EU regions | EU Standard Contractual Clauses |
| jsDelivr (Prospect One / Cloudflare and Fastly CDN) | Delivery of the API reference page’s scripts and styles (/api/docs); receives the visitor’s IP address and browser details | Global content delivery network | EU Standard Contractual Clauses [to confirm with counsel] |
Where data is transferred outside the European Economic Area, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.
6. Retention
Account data is kept while your account is active and deleted within [30] days after it is closed. Billing records are kept for the period required by tax law [e.g. 10 years]. Security logs are kept for up to [90] days.
7. Your rights
You have the right to access, rectify, erase, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Email hello@upstreamr.com to exercise them. You can also lodge a complaint with your local data protection authority or with [lead supervisory authority].
8. Security
Data is encrypted in transit and at rest by our infrastructure providers. Access is limited to people who need it, and API keys and probe tokens are stored hashed.
9. Changes
We will post updates here and notify account owners of material changes by email.