demotest installation

Privacy

Last updated 30 September 2026.

This page covers Kaudata Monitoring: the public status page, the console and the phone app. It sets out what personal data the service processes, why, on what legal basis and for how long.

Who is responsible

The controller is KAUDATA d.o.o., Kidričeva cesta 2 B, 3320 Velenje, Slovenia, registration number 8948925000, VAT number SI 76817008. Kaudata builds and runs this service itself, and there is no separate operator. The full company details are in the imprint.

Write to [email protected] with any question about this page or any request about your data.

What the service watches

It watches machines, not people. It checks whether the services Kaudata runs are answering and shows the result on the status page. A check records whether the service answered, how long it took, its status code and whether the response matched what the check expects. The content of a response is never stored.

When a service’s state changes, the service posts an alert to a Discord channel that Kaudata’s operators read. An alert names the service and what happened to it, and can add an error code with a fixed description, the status code, the response time and any failing dependency the service reported about itself. It contains no personal data.

If you visit the status page

You do not need an account. The status page loads no advertising and no scripts from other companies. It does measure how it is used, with our own analytics tool, described under Website analytics below, which sets no cookie unless you opt out. If you choose a light or dark theme, your browser remembers the choice itself and does not send it to us.

Your browser sends your IP address with every request, as it does to any website. The application uses it in memory only: to limit how many live connections one address can keep open to the status page and, on the console and the app, how often sign-in can be tried from one address. The application does not store your IP address or write it to a log. The servers that pass requests to the application keep access logs that do include it, for the period given below. Website analytics, below, also receives it and stores only a shortened form.

If you are an operator

The console and the app are open only to accounts Kaudata creates, including read-only accounts. There is no public signup. For each account, the service stores:

  • your name and email address;
  • your password, as a hash and never in readable form;
  • whether two-factor sign-in is on and, once you enrol, the two-factor secret, stored encrypted, and your backup codes;
  • a session for each browser or phone you sign in with, holding its user agent and no IP address;
  • an audit record of what you change in the console: the email address you had at the time, what changed, a request id and a shortened user agent, and no IP address;
  • a link to your account on the incidents, incident updates and maintenance windows you create and the monitors you pause. The status page never shows who wrote an update.

The console sets cookies that keep you signed in and that carry a two-factor sign-in from its first step to its second. They are strictly necessary for signing in. Website analytics sets none, unless you opt out of it.

If you use the phone app

The Kaudata Monitoring app for iPhone and Android signs in to the same account as the console. It keeps your session in the phone’s secure storage, and a copy of the overview and the monitor list you last loaded so you can read them offline. Signing out removes both.

If you turn alerts on, the service stores for that phone: the token Apple or Google issues so notifications can reach it, stored encrypted; the platform; the app version; whether alerts are on and which kinds you chose; and when it was registered and last checked in.

A notification carries a monitor’s name, what happened to it, one fixed sentence and a link that opens the monitor in the app, and no address, error text or other detail. To reach your phone it passes, with the phone’s token, through Apple Push Notification service on an iPhone or Firebase Cloud Messaging on Android.

The app contains no analytics, advertising or crash-reporting code.

Website analytics

We measure how the status page and the console are used with Matomo, an analytics tool we run ourselves at analytics.kaudata.si on servers that KAUDATA d.o.o. operates. We do not share the data with anyone. Requests to the analytics server pass through the network provider that carries its traffic. Only the status page and the console are measured, in a web browser; the phone app sends nothing to Matomo.

Matomo does not use cookies. For each page view it records the page address and title, the page you came from, the time, your browser, operating system, device type, screen size and language, and your approximate location (country, region and town), which is looked up from your IP address. On the status page’s address, these legal pages included, it also records clicks on links to other websites and on file downloads. Only a shortened IP address is stored: the last two of the four parts of an IPv4 address, or everything after the first three of the eight groups of an IPv6 address, are removed. On the console, the page address and title name only the kind of page, such as a monitor page, never the monitor, incident or rule it shows; the page you came from is recorded the same way or, if it was on another website, as that website’s address without the page.

We use this to see which content is read and to improve the status page and the console; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Records of individual visits are deleted after at most 25 months; aggregated statistics that no longer relate to anyone are kept.

You can object at any time with the switch below. Your browser then stores one cookie, mtm_consent_removed, which records only that choice. The console and the status page have separate addresses, and the choice applies only to the one you make it on.

Why, and on what legal basis

  • Keeping the status page and the console available, and protecting sign-in from abuse, which is what your IP address is used for: our legitimate interest in running a reliable and secure service (Art. 6(1)(f) GDPR).
  • Operator accounts, sessions and two-factor sign-in: our legitimate interest in letting only authorised people into the console (Art. 6(1)(f) GDPR).
  • Website analytics: our legitimate interest in seeing which content is read and improving the status page and the console (Art. 6(1)(f) GDPR). You can object as described under Website analytics.
  • The audit record: our legitimate interest in being able to tell who changed the service, and when (Art. 6(1)(f) GDPR).
  • Phone registrations and notifications: our legitimate interest in telling the people who use the service about the state of what it watches (Art. 6(1)(f) GDPR).
  • Answering a request about your data: our legal obligation under the GDPR (Art. 6(1)(c) GDPR).

How long data is kept

  • Your IP address, in the application: never stored. It is held in memory only while a live connection is open or a sign-in rate limit applies to it.
  • Access logs, which include IP addresses: 30 days. They are kept by the servers that pass requests to the application, not by the application itself.
  • Website analytics: records of individual visits, which hold a shortened IP address, at most 25 months. Aggregated statistics that no longer relate to anyone are kept.
  • An operator account: until it is deleted. The delete account page explains how.
  • A session: until you sign out or your account is deleted. It stops working 7 days after it was issued or last renewed, and it is renewed from time to time while you use the console or the app.
  • A phone’s registration: until you sign out on it or remove it, until your account is deleted, or 90 days after the app last checked in from it. When your account is deleted, its phones get one last notification, and their registrations are deleted once it has been sent, at the latest 24 hours later.
  • Audit records: there is no automatic deletion for them yet, so at present they are kept without a time limit.
  • Check results: 35 days. The summaries computed from them are kept longer, for the status page’s history. Neither contains personal data.
  • The record of which alert was sent where: 180 days. It contains no personal data.

Who else processes it

The service and its database run on servers Kaudata operates in Slovenia (EU). Personal data is processed on our behalf by:

  • Apple. Apple Push Notification service delivers the app's notifications to iPhones. It receives the phone's device token and each notification's title and text. Apple processes this data in the United States and elsewhere outside the EU.
  • Google. Firebase Cloud Messaging delivers the app's notifications to Android phones. It receives the phone's registration token and each notification's title and text. Google processes this data in the United States and elsewhere outside the EU.

Sending this data to Apple and Google outside the EU relies on the standard contractual clauses adopted by the European Commission.

Discord receives the alerts described above, which contain no personal data.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable form where that right applies, to object to processing that relies on our legitimate interests, and not to be subject to a decision based solely on automated processing that significantly affects you. The service makes no such decision (Arts. 15 to 18 and 20 to 22 GDPR).

To use any of these rights, write to [email protected]. We respond without undue delay and in any event within one month of receiving your request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. If it is, we tell you within one month of receiving the request, with the reasons for the delay.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, where you work or where you believe the infringement took place. In Slovenia, that is the Informacijski pooblaščenec, the Information Commissioner of the Republic of Slovenia.

Changes to this page

When this page changes, the date at the top changes with it.