Privacy policy
Last updated: 13 November 2026
Informational translation: in case of any difference, the French version prevails.
This page explains how StatOps processes personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Who is responsible?
Valentin THUILLIER (Sole trader), reachable at contact@statops.fr, is data controller for the waiting-list data, the accounts and the security of the service.
For your end clients’ data that you manage in StatOps (client names, sites, measurements, reports), the agency or freelancer using StatOps is the data controller, and StatOps acts as processor. The processing commitments are in article 12 of the terms and conditions.
Data processed
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Announce the launch (waiting list, closed since the service opened) | Email address | Consent | Until launch, then 3 years at most after the last contact. You can withdraw at any time. |
| Answer messages sent through the contact form | Name, email address, message | Legitimate interest (answering a request you send us) | The time needed to handle your request, then 3 years at most after the last exchange. |
| Create and manage your account | Email, name, role, business SIRET, password (stored hashed), two-factor authentication secret (stored encrypted), organisation, date of acceptance of the general terms. From the SIRET, we read in the public business directory the company name, address, legal form, activity (NAF code), size, creation date and status of the establishment | Performance of the contract | Duration of the account, then deletion within 30 days. Backups are purged within a further 14 days. Trial account without a subscribed plan: deletion 7 days after the end-of-trial email. |
| Provide monitoring and reports | End clients (name, contact), site domains, check results (uptime, response time, SSL certificate), server measurements (CPU, memory, disk, containers, pending updates), domain name expiry, incidents and write-ups, maintenance log, PDF reports | Performance of the contract (StatOps acts as processor) | Detailed measurements: 90 days. Hourly averages: 13 months. Automatic deletion at these deadlines. Incidents, reports and write-ups: duration of the contract. Data deleted at the end of the contract (article 12 of the general terms). |
| Collect the subscription and issue invoices | Plan, billing period, status and dates of the subscription, Stripe customer and subscription IDs, invoices. Card data is entered with Stripe; StatOps does not receive it. | Performance of the contract; legal obligation (accounting) | Duration of the subscription, then 10 years for invoices (French commercial code). |
| Secure sign-ins | IP address and email of sign-in attempts; server access logs (IP address, page requested) | Legitimate interest (defence against attacks) | Sign-in attempts: 24 hours. Access logs: 7 days. Automatic deletion. |
| Send reports, alerts and invitations | Recipients’ email addresses, date the address was confirmed, message content; webhook address or Telegram group ID if you configure them | Performance of the contract | The time of sending; the report history follows the life of the account. |
The data requested at sign-up (email, SIRET, agency name, password) is necessary to create the account; without it, the service cannot be provided. No automated decision producing legal effects is taken about you.
If you enable a client’s status page, the status of its sites, its incidents and the write-ups you write are readable by anyone with the link. Do not put personal data in them.
The StatOps agent installed on your servers reads the web server configuration and the state of containers to discover sites, and sends usage measurements. It does not send the content of your sites or databases, and runs no command received from StatOps.
Recipients and processors
Your data is neither sold nor used for advertising. It is accessible only to the providers necessary for the service:
- Production hosting: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, telephone: 1007
- Card payment and invoicing: Stripe Payments Europe, Ltd (Ireland), which acts on its own behalf as a payment institution (data controller) for card data
- SIRET check at sign-up, pre-filling of your company name and address, and monthly re-reading of the establishment’s status: the State’s business directory (recherche-entreprises.api.gouv.fr), which receives only the SIRET, a public datum. We keep neither company officers nor financial data
- Waiting list: stored on the publisher’s server, with no third-party service
- Sending emails: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France for the platform’s sending server, or your agency’s SMTP server if you have configured one
- Alerts: if you configure a Telegram channel or a webhook, the alert text (site or server concerned, nature of the incident) is sent to Telegram or to the address you give
- Domain name expiry: read from the public domain name registries (RDAP), which receive only the domain name
Transfers outside the European Union
Data is stored in: France. Stripe may process data in the United States: the transfer relies on the European Commission’s standard contractual clauses or on the EU–US data protection framework. Telegram is established outside the European Union: alerts are sent there only if you configure that channel, on your initiative.
Security
- Hashed passwords (Argon2id), two-factor authentication available.
- Client secrets (SMTP credentials, for example) encrypted in the database.
- Encrypted connections (HTTPS), automatic daily server backup by the host.
- Separation of organisations: each agency sees only its own data.
- Limits on sign-in attempts.
Cookies
The public site uses no advertising cookies or audience-measurement tools. The dashboard sets a single session cookie (“HttpOnly”, “SameSite=Strict”), essential for signing in: it does not require consent. Your display preferences (language, list grouping) are kept in your browser’s local storage: they never leave it and are not used for any tracking.
Your rights
You may request access, rectification, erasure, restriction and portability of your data, object to processing, or withdraw your consent, by writing to contact@statops.fr. You may also set directives on what happens to your data after your death. We reply within one month. You may also lodge a complaint with the CNIL (cnil.fr). If you are an agency’s end client, send your request to that agency, the controller of your data.
Changes
This policy may change. The date of the last update is at the top of the page; important changes are notified to users of the service.