Privacy Policy

1. Who is responsible

metikular GmbH, Alte Hedingerstrasse 25a, 8910 Affoltern am Albis, Switzerland, is responsible for the processing described here (controller under the Swiss Federal Act on Data Protection, revDSG/nFADP, and, where applicable, the EU GDPR). Contact: hello@metastic.ch. For the data your jobs send to Cuckoo (ping bodies, check names), your organization decides what is sent; for that data we act as its processor.

2. What we process

• Account data: your email address, your organizations and role, your alert email setting, sign-in times.
• Checks: names, schedules, notes, integrations (webhook URLs) and status history.
• Pings: for each ping or Sentry check-in: time, type, exit code, duration, the sending IP address, the user agent and up to 10 KB of the request body if your job sends one. Do not send secrets or personal data in ping bodies.
• Billing data: for paid plans, Stripe processes name, billing address, VAT ID and payment details. We store only the Stripe customer and subscription IDs, the plan and the subscription status.
• Technical data: server logs with IP address, time, path and status code of page requests, kept for at most 30 days. Successful pings are not written to the server log, and query strings are never logged.
• Feedback: messages you send with the feedback button, with your email (if you give it) and the page you were on.

3. Why (purposes and legal bases)

To provide, secure and bill the service, to send the emails you need (sign-in links, invitations, alerts, billing notices) and to answer your messages. Legal bases under the GDPR: performance of the contract (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)) and our legitimate interest in a secure, working service (Art. 6(1)(f)). We do not sell data, show ads or profile you.

4. Cookies

Cuckoo uses two technically necessary cookies: a session cookie that keeps you signed in and a security cookie against cross-site request forgery. If you arrive through a link with a ref or utm_ parameter (for example from a forum post), a first-party cookie stores that source for up to 30 days; when you sign up, it is saved with your account so we know which channels bring users. It is never shared with third parties. Your dark mode choice is stored in your browser's local storage. There are no analytics, tracking or advertising cookies and no third-party scripts.

5. Processors and where data is stored

• Hetzner Online GmbH, Germany: servers and backups in data centres in Germany (EU).
• Stripe Payments Europe Ltd., Ireland (with Stripe, Inc., USA): payments. Transfers to the USA are covered by the EU-US and Swiss-US Data Privacy Framework and standard contractual clauses.
• Our mail server (mail.metikular.ch, operated by us in Europe): delivery of all emails.
• Slack, Discord or your own webhook receivers, only if your organization configures them: alert texts with check names are sent to the URL you enter.

6. How long we keep data

• Pings: for the history period of your plan (Free 30 days, Team 1 year, Business 2 years) and at most the plan's number of entries per check; older pings are deleted automatically every hour.
• Status changes: 2 years. Sent alerts: 30 days; failed deliveries: 90 days.
• Account, checks and settings: until you delete them; deleted data disappears from backups within 30 days.
• Sign-in links: 15 minutes. Sessions: 30 days. Billing records: 10 years (Art. 958f CO).

7. Your rights

You may access, correct, delete or receive your data, restrict or object to processing, and withdraw consent. You can delete your account and organizations yourself in the app. For anything else, write to hello@metastic.ch; we answer within 30 days. You may also complain to the Swiss FDPIC (EDÖB) or the supervisory authority of your EU country.

8. Security

All traffic is encrypted (HTTPS with HSTS). Sign-in uses one-time links; sessions and API tokens are stored only as hashes. Data of different organizations is strictly separated. Webhooks cannot reach private networks.