Privacy Policy

Last updated: 1 October 2026

This policy explains how LatidoFlow handles personal data when you use the website, application, APIs, billing flows, integrations, and related services.

1. Scope

LatidoFlow ("we", "our", "us") proves that scheduled or async work completed on time, or produced the right incident. This policy applies to visitors, account users, workspace members, API users, and people whose details appear in a customer workspace, including status-page subscribers. Customers are responsible for what they send in heartbeats, runtime signals, logs, and status-page copy. Where we process that workspace data on a customer's behalf, we act as a processor or service provider under applicable privacy laws.

2. Data we collect

Account: email, password or Google sign-in data, workspace name, timezone, role, permissions, plan, billing email. There is no public contact form. Workspace: monitor definitions, run lifecycle events, bounded output and semantic-check results, incident state, notification-attempt evidence, status-page configuration, and Healthchecks.io import files the customer uploads. Uptime checks do not store raw response bodies. Ingestion tokens are stored as a hash plus last four characters. Billing: plan, checkout status, Paddle identifiers, invoices; Paddle holds card data; LatidoFlow does not store full card numbers. Technical: IP, browser, device, request logs, security events, feature usage. Public marketing pages may include Google Analytics measurement ID G-KPC7CEP02H. There is no cookie-consent banner.

3. Use

Provide, secure, maintain, and improve the service; authenticate; evaluate heartbeat and uptime contracts; retain evidence for the plan window; incidents; customer-configured notifications; status pages; Paddle billing; abuse prevention; legal compliance. We do not use workspace evidence to sell advertising.

4. GDPR bases

Contract; legitimate interests (security, abuse, reliability, service comms); legal obligation; consent only where a specific optional use requires it.

5. Cookies

Auth cookies for sessions. Marketing Google Analytics where the measurement ID is present. These legal pages do not load Google Analytics.

6. Providers

Paddle; Google sign-in; Google Analytics on marketing pages; unnamed operational error and security providers; customer-configured Slack, email, webhook, PagerDuty, and Telegram channels; Healthchecks.io only if the customer uploads an export. We do not sell personal data.

7. International transfers

Adequacy, standard contractual clauses, or other GDPR mechanisms.

8. Retention

Account and workspace data while active, then as needed for security, billing, and law. Evidence: Free 7 days, Starter 30 days, Pro 90 days, Custom 365 days. Billing and tax records as required by law. Logs are limited unless abuse, incident, or claim. Backups are kept for a limited period.

9. Security

Access controls, hashed ingestion credentials, encrypted uptime header values, HTTPS, audit logging. Provider acceptance is not inbox delivery or human receipt.

10. Rights

Access, correction, deletion, restriction, objection, portability, withdraw consent, and supervisory complaint. Email [email protected] with subject Privacy Request.

11. US state rights

No sale of personal information.

12. Deletion

Email [email protected] with subject Data Deletion Request, account email, and workspace name. Some legal, tax, security, and backup retention may remain.

13. Children

Not for children under 18.

14. Changes

Posted with a new last-updated date.

15. Contact

[email protected]. See also the Terms of Use.