Privacy policy

Who is responsible

The controller is Kristián Partl (Krpasoft), company ID 21495106, Chudenická 1059/30, Hostivař, 102 00 Praha 10, Czech Republic. Contact: support@backupwitness.com.

What we store and why

• Your email address, and your GitHub user ID if you sign in with GitHub: to run your account and send alerts.
• Check settings: storage endpoint, bucket, prefix, rules, and the access key you enter. Keys are encrypted at rest and never shown again.
• Results of each check: time, outcome, number of objects, the newest object's key, size and date. We never read the contents of your objects.
• Alert channel settings (webhook URLs, bot tokens), encrypted at rest.
• A session cookie that keeps you signed in. It is strictly necessary; we use no analytics or tracking cookies.

The legal basis is the performance of our contract with you (GDPR Art. 6(1)(b)) and, for short-lived technical logs that keep the service secure and working, our legitimate interest (Art. 6(1)(f)).

Who processes data for us

BackupWitness runs on Cloudflare (hosting, database, queues and email delivery). Cloudflare processes data on our behalf under its data processing terms. Data may be processed outside the EU.

How long we keep it

• Check results: 30 days.
• Sign-in links: until they expire (15 minutes), then deleted within an hour. Sessions: 30 days.
• Your account: until you delete it in Settings. Deletion removes your data and keys at once; database backups (Cloudflare D1 Time Travel) keep them for at most 30 days.

Your rights

You can access, correct, export or delete your data, object to processing and lodge a complaint with a supervisory authority (in the Czech Republic: the Office for Personal Data Protection, uoou.gov.cz). Write to support@backupwitness.com.