Privacy policy for Vitrina Engine
This describes what Infinity Curve LLC collects when you use Vitrina Engine, why we hold it, and what you can ask us to do with it. We are the data controller for it.
App: Vitrina Engine
Developer: Infinity Curve LLC
Registered address: 76 Vazha-Pshavela Ave, 0186 Tbilisi, Georgia
Privacy contact: privacy@vitrinaengine.com
This policy covers the Vitrina Engine website and the Vitrina Engine apps for iOS and Android.
The short version: we collect what is needed to run monitoring for you and to bill you, we do not sell any of it, there is no advertising anywhere, the only analytics is our own on our public pages and it stores nothing on your device, and we never see your card details.
What we collect
Account data
Your name, email address and password hash; your organisation name; the roles and workspace assignments of people you invite. Passwords are hashed, never stored in a readable form, and cannot be recovered — only reset.
What you configure
The hostnames, URLs, IP addresses and other targets you ask us to check, plus any credentials you attach to a check so that it can authenticate. Credentials and webhook signing secrets are encrypted with a key held outside the database, so a database backup on its own does not contain them.
What monitoring produces
Response times, status codes, TLS certificate details, DNS answers, error text, and the incidents and notifications derived from them. If a monitored endpoint returns personal data in an error message, that text will be stored in the check result and shown in the alert — so avoid pointing checks at endpoints that do that.
Status page subscribers
When somebody subscribes to one of your status pages we store their email address and their subscription state. Confirmation is always double opt-in: an unconfirmed address is sent nothing except its own confirmation. For those addresses you are the controller and we process on your behalf.
Technical data
Server logs containing IP address, user agent and request path, kept for 30 days for security and debugging. Session cookies, which are strictly necessary. We set no advertising cookies anywhere, ever.
The cookie policy lists every one by name, what it is for and how long it lasts. The short version: the public pages set nothing at all.
Payment data
None that identifies a card. Paddle.com Market Ltd is the merchant of record: the checkout is theirs, card details are entered on their systems, and we receive only a customer reference, the plan, the amount, the currency and the subscription status. There is no form anywhere in this product that accepts a card number.
Why we hold it, and on what basis
- To provide the service — performance of our contract with you. This covers your account, your configuration and your monitoring history.
- To bill you — performance of the contract and our legal obligation to keep transaction records.
- To keep the service secure — our legitimate interest in preventing abuse. This covers logs and rate limiting.
- To send service email — performance of the contract. Alerts, invitations and billing notices are not marketing and cannot be turned off while the account is open.
How long we keep it
- Individual check results: for your plan’s raw retention period, then dropped.
- Aggregated uptime history: for your plan’s history retention period.
- Account and configuration data: until you delete the organisation, then 30 days.
- Server logs: 30 days.
- Transaction records: seven years, as required for tax.
Who we share it with
We use a small number of processors, and no others. They are named in one place rather than two: the sub-processor list gives each one, what it does for us, what data reaches it, where it processes it and on what basis. It changes on the day that list changes rather than on the day this page is next edited, which is the point of having one of them.
Three companies you may meet are deliberately not on it, because they do not act on our behalf — they decide their own purposes, and answer to you for them:
- Paddle — our reseller and the merchant of record, so the seller on your invoice is them rather than us. They take the payment, handle the tax and answer to your card issuer, and they decide how to do all of it: they are a controller in their own right, with their own privacy notice to you, not a company processing on our instructions. We pass them the email address and name on the account so they can bill it. They never receive your monitoring data.
- Google, Microsoft, Apple or Huawei, if you sign in with them — only when you choose to. They tell us your email address and name; what they do with the fact that you signed in here is their own affair, not something we direct. You can use a password instead.
- Telegram, if you use Telegram alerts — only when somebody links a Telegram chat. The alert text goes there, naming the monitor and what went wrong. We send it through our own bot, but Telegram handles it as its own user's messaging provider rather than on our behalf. An account registered in the EEA has its Telegram data stored in the Netherlands.
We do not sell personal data, we do not share it for advertising, and we disclose it to anybody else only where the law requires it.
Where it is processed
Your account data — organisations, users, monitors, incidents and their history — is stored and processed in the European Union, on servers operated by Contabo GmbH. Your email is sent from inside the EU as well.
Because that is inside the European Economic Area, the hosting itself involves no transfer out of it. What governs our relationship with the hosting provider is an Article 28 data processing agreement rather than standard contractual clauses.
We are established in Georgia, and we run the service from there. So although your data is stored in the EU, the people operating it reach it from outside the EEA — which is an international transfer, and we would rather say so than let “servers in the EU” imply something it does not. For customers in the EEA and the UK that transfer is covered by the European Commission’s standard contractual clauses, set out in our data processing agreement.
Checks run from several countries. Your personal data does not.
Monitoring means making requests to your systems from more than one place, so that an outage is confirmed from somewhere other than where we happen to be. Some of those vantage points are outside the EEA, and the set of them changes as we add and retire capacity.
Personal data is never sent to them. Where a check’s configuration could contain personal data — a request header, a request body — it is only ever run from inside the EEA. That is not a policy we ask people to follow: our scheduler will not place such a check anywhere else, and the restriction is tested against a real database on every build.
What a vantage point outside the EEA receives is the address being checked and whether it answered. It is never given a database credential, so there is nothing on one to lose beyond the checks it is running, and none of them stores anything.
We deliberately do not list the countries here. They change, and a list that is accurate today would quietly stop being accurate — which is worse than not publishing one. If you need to know exactly where checks against your systems run, including for your own compliance, ask us at privacy@vitrinaengine.com and we will tell you and keep you informed if it changes.
How it is protected
In transit everything is encrypted, including the leg between our own servers. Credentials you store with us — a webhook signing secret, an SMTP password — are sealed with AES-256-GCM under a key held separately. Backups are encrypted to a key that is on none of the servers, so a copy of a machine is not a copy of your data.
Our transfers to Paddle.com Market Ltd and to Bunny are covered by the European Commission’s standard contractual clauses, and we will send you a copy on request. Google and Microsoft are covered by their own data processing terms. Our own access from Georgia is covered by the data processing agreement. The servers holding your account data are in the EEA, and so is the one that serves your status pages.
Your rights
You can ask us for a copy of your data, for it to be corrected, or for it to be deleted. You can object to processing based on legitimate interest, and you can ask for your data in a portable form. Most of it you can also simply export or delete yourself from the dashboard.
Email privacy@vitrinaengine.com and we will respond within 30 days. If you are in the EEA or the UK and are unhappy with our answer, you may complain to your local supervisory authority.
Security
Traffic is encrypted in transit. Stored credentials and channel secrets are encrypted with a key held outside the database. Access between customers is enforced at the query layer rather than by convention, and every API key is bound to the membership that created it, so removing somebody’s access removes their keys with it.
If you believe you have found a vulnerability, please email security@vitrinaengine.com. We will not pursue anybody who reports one in good faith.
Changes and contact
We will email account owners before a material change takes effect. For anything here, contact:
Infinity Curve LLC
76 Vazha-Pshavela Ave, 0186 Tbilisi, Georgia
privacy@vitrinaengine.com
Last updated 31 August 2026.