Privacy policy

Last updated: 10 November 2026

Who we are

Uppio is run by Ivan Ivanov, Gagarinova 55, 821 07 Bratislava, Slovakia, a private individual (“we”). We are the controller of the personal data described here. Write to us at privacy@uppio.dev.

This policy covers the website uppio.dev, the Uppio API and MCP service at https://api.madeyour.app, and its claim pages.

The data we process and why

Requests to join the beta

When you ask to join the beta on this website, we keep your email address, the agent you use and what you tell us you are building, to decide on your request and send you an invite. We also keep the IP address and the browser identification of the request, to protect the form from floods and abuse.

• Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the form safe (Art. 6(1)(f)).
• Kept: the IP address and browser identification for 30 days; a request we decline, for 30 days after the decision; a request we accept, while the beta lasts.

Accounts your agent starts

An agent starts a preview account without any personal data. We keep the IP address it came from, to limit how many accounts one address can start and to handle abuse.

• Legal basis: our legitimate interest in preventing abuse and in answering reports and requests of authorities about what was hosted (Art. 6(1)(f)).
• Kept: 12 months, since such reports and requests come months later.

Claimed accounts

When you claim an account, we keep the email address you confirm, with the time and IP address of the claim, to give you the account and to write to you about it.

• Legal basis: the contract with you (Art. 6(1)(b)); after the account ends, our legitimate interest in answering reports and requests about it (Art. 6(1)(f)).
• Kept: while the account exists, and 12 months after it ends. A claim you never confirm is deleted 30 days after its link expires.

What you host

Your apps, their files, databases and logs (including the IP addresses of their visitors) are yours. For the personal data in them you are the controller and we are your processor; this section, with the terms, is our data processing agreement under Art. 28 GDPR. We:

• process that data only to host and run your apps, on your instructions: what you and your agent do through Uppio, and these terms;
• keep it confidential and do not use it for anything else;
• protect it: each account is isolated from the others, connections are encrypted, and so are backups;
• use only the processors listed below, and tell you before we add one, so that you can object or leave;
• help you answer the people whose data it is, and tell you without undue delay of a breach that affects it;
• delete it within 30 days after your account ends, and its copies in backups as the next section describes;
• give you the information you need to show that all this is done.

Backups

Claimed accounts are backed up every night: their files, databases and app settings, encrypted. We keep seven daily and four weekly copies. Thirty days after an account ends, no copy of it is left anywhere.

Our own database, with the records this policy describes and the logs of deployments, is backed up every hour, encrypted. What we delete from it leaves those backups within four months.

Email

We send claim confirmations and beta invites. When you write to us, we keep the conversation as long as it is needed to answer you and for our records.

Who processes data for us

• netcup GmbH, Germany: the servers Uppio runs on.
• Hetzner Online GmbH, Germany: the storage of backups.
• Resend, USA: the delivery of our email.
• Porkbun LLC, USA: our domains and their DNS.
• Zoho Corporation B.V., the Netherlands: our mailbox, kept in Zoho’s EU data centre. Zoho’s support in India can reach it when needed, on a transfer basis that Zoho keeps in place under the GDPR.
• GitHub, Inc., USA: the hosting of this website.
• Let’s Encrypt (ISRG), USA: certificates for the domains you add. It gets only the domain names, which every certificate makes public anyway.

Transfers to the USA rely on the EU Standard Contractual Clauses (Resend, Porkbun, GitHub) and, for Resend and GitHub, also on the EU-U.S. Data Privacy Framework. Our own notifications go to a Telegram chat without any personal data of yours.

This website

uppio.dev uses no cookies, no analytics and no third-party scripts or fonts. Its host, GitHub Pages, may log the IP addresses of visitors for security.

Your rights

You can ask us for access to your data, for its correction or erasure, for a restriction of its processing, and for a copy in a portable format, and you can object to processing based on our legitimate interest. Write to privacy@uppio.dev. You can also complain to the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk) or to the authority of your country.

Changes

We publish changes here with their date. If a change matters for your account, we write to you first.