UpMonix Privacy Notice
Last updated: 13 October 2026
This notice explains what personal data UpMonix collects when you visit upmonix.com, create an account, use the UpMonix monitoring service or contact us. It covers what we do with that data, why, who we share it with, how long we keep it, and your rights.
We have tried to keep it short and in plain English. If anything is unclear, contact us using the details below.
1. Who we are
UpMonix is operated by Think X Intelligent Systems LTD, a company registered in Ireland (company number 706889), with its registered office at [Registered office address: to be confirmed].
Think X Intelligent Systems LTD is the controller of the personal data described in this notice. That means we decide how and why it is used, and we are responsible for it.
Contact for privacy questions: [privacy contact email] Post: Think X Intelligent Systems LTD, [Registered office address: to be confirmed]
We have not appointed a Data Protection Officer because the law does not require us to. Please send any privacy question to the email address above.
2. What personal data we collect
When you create an account - First and last name, company name and country - The website domain you want to monitor - Your alert email address (an address on the monitored domain) and login email - Your password (we store it only in hashed form, so we cannot read it) - Your confirmation that you are authorised to have the domain monitored
When you use the service - The monitors you set up: URLs, API endpoints, servers, DNS, mail server and SSL checks, check intervals and alert settings - Check results, uptime history, incident records and status page content - Names and email addresses of team members you invite, and their roles - Contact details for alert channels you turn on, such as additional email addresses and, if you use the Telegram alert add-on, your Telegram chat ID and username [other alert channels, if offered] - Support requests and messages you send us - Technical records about your use of your account, such as login times, IP addresses and security logs
When you pay for a plan - Billing name, billing email, company details and billing address - Payment card details. These go directly to Stripe, our payment provider. We do not see or store your full card number. Stripe gives us limited details, such as the card type, the last four digits and the expiry date, plus your payment and subscription history.
When you contact us or book a demo - Your name, email address, company and anything you choose to tell us in your message
When you visit our website - Technical data such as your IP address, browser type, device and the pages you request, which our servers log automatically - If you accept analytics or marketing cookies: information about how you use our website and how you reached it, for example from a Google or Meta advert. See our Cookie Policy.
We do not ask for special category data (such as health information), and we ask you not to include it in support requests or monitor settings.
3. Why we use your data and our lawful basis
Data protection law says we must have a lawful basis for each use of your data. This table sets them out.
| What we do | Lawful basis |
|---|---|
| Create and manage your account, run the monitors you set up, send alerts and reports, host your status pages, and provide support | Contract: we need it to provide the service you signed up for |
| Take payments and manage subscriptions through Stripe | Contract |
| Keep invoices and accounting records | Legal obligation: Irish company and tax law |
| Send service emails, such as alerts, security notices, billing notices and important changes to the service or our terms | Contract, and our legitimate interests in running a secure and reliable service |
| Answer contact forms, demo requests and other enquiries | Legitimate interests: replying to people who contact us, or steps you ask for before entering a contract |
| Keep the service and website secure, prevent abuse and fraud, and check that monitoring is authorised for a domain | Legitimate interests: protecting our service, our customers and the websites we check |
| Improve the service using information about how features are used inside your account | Legitimate interests: improving our product. We use the minimum data needed and aggregate it where we can |
| Measure website use with Google Analytics | Consent, given through our cookie banner |
| Measure our Google and Meta advertising | Consent, given through our cookie banner |
| Send marketing emails about UpMonix | Consent. If you are a paying customer, we may email you about similar UpMonix services, and you can opt out when you sign up and in every email (Regulation 13(11), S.I. No. 336 of 2011) |
| Establish, exercise or defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for more detail and you can object at any time (see section 8).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal data.
4. Who we share your data with
We share personal data only where we need to, and only with:
- Hosting: [hosting provider and region], which hosts our website, application, databases and monitoring servers.
- Email delivery: [email provider], which sends alert, service and account emails.
- Payments: Stripe, which processes payments and manages subscriptions. Stripe acts as our processor for some activities and as an independent controller for others, such as fraud prevention and meeting its own legal obligations. See stripe.com/privacy.
- Telegram: if you turn on the Telegram alert add-on, we send alert messages to the Telegram chat you link. Telegram processes those messages under its own privacy policy.
- Google: Google Analytics and Google Ads, but only if you accept the relevant cookies. Our website also loads resources from Google services, which receive your IP address.
- Meta Platforms: the Meta Pixel, but only if you accept marketing cookies. For collecting and sending this data to Meta, Meta and we act as joint controllers. Meta is responsible for what it does with the data afterwards. See Meta's privacy policy.
- Content delivery networks: our pages load some code from cdn.jsdelivr.net, which receives your IP address so that it can deliver the files.
- Professional advisers, such as our accountants and lawyers, where needed.
- Authorities and others, where the law requires it or to protect our rights, our customers or the public.
- A buyer or investor, if UpMonix or our business is sold or restructured, under confidentiality terms.
Our processors may use your data only on our instructions, under written contracts that meet the GDPR.
Status pages: if you publish a status page, the information you choose to show on it is public.
If you monitor websites with UpMonix: where our checks capture personal data from your own website or systems, you are the controller and we act as your processor. Our [DPA link] and [sub-processor list link] set out those terms.
5. International transfers
Some of our providers, including Google, Meta, Stripe and Telegram, are based outside the European Economic Area (EEA) or may access data from outside it. When personal data leaves the EEA, we make sure it is protected by one of these:
- an EU adequacy decision, including the EU-US Data Privacy Framework for US companies certified under it; or
- Standard Contractual Clauses approved by the European Commission, with extra safeguards where needed.
You can ask us for more information about the safeguards we use, or a copy of them, using the contact details in section 1.
6. How long we keep your data
We keep personal data only for as long as we need it:
| Data | How long |
|---|---|
| Account details | While your account is open, then [retention period] after it closes |
| Check results, uptime history and incident records | For the data retention period of your plan (at most 12 months), or until you delete them or close your account |
| Billing and accounting records | 6 years after the end of the financial year they relate to, as Irish tax and company law requires |
| Support requests and enquiries | [retention period] after the matter is resolved |
| Demo requests that do not lead to an account | [retention period] |
| Security and server logs | [retention period] |
| Google Analytics data | [Google Analytics retention setting], then deleted automatically |
| Marketing email preferences | Until you unsubscribe. We then keep only your email address on a suppression list so that we do not email you again |
After these periods we delete the data or anonymise it so that it can no longer identify you. You can ask us to delete your data earlier (see section 8).
7. How we protect your data
We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls and limiting access to staff who need it. If a breach is likely to put your rights at risk, we will tell the Data Protection Commission within 72 hours, and we will tell you where the law requires it.
8. Your rights
You have the following rights over your personal data:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate data or complete incomplete data. You can also update most account details yourself.
- Erasure: ask us to delete your data, for example when we no longer need it or you withdraw consent.
- Restriction: ask us to limit how we use your data, for example while we check whether it is accurate.
- Portability: ask for data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation, where we rely on contract or consent.
- Objection: object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will stop.
- Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.
- Withdraw consent: at any time, where we rely on consent (see section 9).
To use any of these rights, email [privacy contact email]. Using your rights is free. We will reply within one month. If your request is complex, or you have sent several, we may need up to two more months; if so, we will tell you within the first month and explain why. We may ask you to confirm your identity before we act.
Some rights have limits. For example, we must keep billing records for as long as tax law requires. If we cannot do what you ask, we will explain why.
9. Withdrawing consent
Where we rely on your consent, you can withdraw it at any time, and doing so is as easy as giving it:
- Cookies: click Cookie settings at the bottom of any page and switch analytics or marketing off.
- Marketing emails: click the unsubscribe link in any marketing email, or email [privacy contact email].
Withdrawing consent does not affect processing that took place before you withdrew it. You will still receive service emails, such as alerts and billing notices, while you have an account.
10. Your right to complain
If you are unhappy with how we handle your personal data, please tell us first at [privacy contact email] so we can try to put it right.
You also have the right to complain to the Data Protection Commission (DPC), Ireland's data protection authority, at www.dataprotection.ie. If you live or work in another EEA country, you can also complain to the data protection authority there. If you are in the UK, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
11. Children
UpMonix is a service for businesses and is not aimed at children. You must be 18 or over to create an account. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.
12. Changes to this notice
We may update this notice when our services, providers or the law change. The date at the top shows when it was last updated. If we make a significant change, we will tell account holders by email or with a notice in the app before the change takes effect.