This policy explains which personal data LucidStack processes, why, for how long and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR).
Data controller
The controller is the publisher named in the legal notice, who can be reached at contact@lucidstack.dev.
Data we process
- Account: name, e-mail address, password (stored hashed), two-factor and passkey settings, sign-in through Google or GitHub when you choose it.
- Organizations: members, roles, invitations and the actions recorded in the audit log.
- Monitoring: the addresses you watch, the results of the checks, incidents, server metrics and the output of your scheduled tasks.
- Alerts: the contact details of your channels, such as e-mail addresses, phone numbers for SMS or webhook addresses.
- Status pages: the e-mail addresses of the people who subscribe to them.
- Technical data: IP address and browser of the requests, kept in the server logs for security.
Purposes and legal bases
- Providing the service you subscribed to: performance of the contract.
- Securing the service and preventing abuse: legitimate interest.
- Invoicing and accounting: legal obligation.
- Status page subscriptions: consent, confirmed by e-mail and withdrawable at any time.
Retention
- Detailed check results and server metrics: 30 days.
- Runs of scheduled tasks: 90 days.
- Audit log: 12 months.
- Account and organization data: as long as the account exists, then deleted.
- Encrypted backups: up to six months.
- Status page subscribers: until they unsubscribe.
Processors
LucidStack relies on the following providers, bound by contract to protect your data:
- Scaleway · hosting, database, backups and e-mail sending, in the European Union.
- Brevo, smsmode · sending of SMS alerts, in France.
- Google (Gemini) · AI features: the content of an incident (checks, metrics, timeline) is sent to generate a diagnosis or a summary. Google LLC is located in the United States; the transfer is governed by the EU-US Data Privacy Framework and standard contractual clauses.
- Google, GitHub · sign-in, only if you choose these buttons.
Cookies
LucidStack only uses the cookies needed to keep you signed in and to protect the forms. There is no advertising or audience measurement cookie. Your theme choice is stored in your browser.
Your rights
You can access, correct, delete, export your data, object to or limit its processing by writing to contact@lucidstack.dev. You can also lodge a complaint with the CNIL (cnil.fr).
Security
Connections are encrypted (HTTPS), accounts can be protected by a second factor or a passkey, and the database is backed up every night, encrypted.