Privacy policy

Who we are

Elevator Uptime is a free, public platform for reporting and tracking elevator and escalator outages. It is run by FIELDBOSS, the organization responsible for the personal information described here.

What we collect

• Outage reports. When you report an outage we collect the building, the note you write, any photo you attach, and a device ID. The device ID is either a random ID saved in your browser or an ID that FingerprintJS computes in your browser from its settings. It is used to limit spam and abuse, and it is not your name or email address. Photos are shrunk and re-encoded in your browser before upload, which removes their location and camera metadata, and are published with the report.
• Outage alerts. If you ask to be told when an outage ends, we collect your email address and the outage you follow.
• Claims, responses, corrections and tips. If you claim a building as its owner or manager, respond to an outage, ask us to correct a record, send a tip about a contractor, or report a bug, we collect what you enter, such as your name, email address, phone number, role and message. Our team receives it by email and reviews it.
• Building dashboard and tenant posts. If you sign in to the dashboard or to post on a building wall, we collect your email address to sign you in, and what you post.
• Abuse prevention. Forms record your IP address briefly to limit how often they can be used, and Cloudflare Turnstile checks that you are a person.
• Analytics. We use Google Analytics 4 (GA4) and Vercel Analytics to understand how the site is used. GA4 uses cookies and similar identifiers and records things like pages viewed, approximate location derived from IP address, and device and browser type. We have turned off Google signals and ads personalization for our GA4 property. Vercel Analytics does not set cookies.
• Your Google Analytics choice. Google Analytics only runs where you allow it. If you visit from the European Union, the European Economic Area, the United Kingdom, Switzerland or Quebec, or we cannot tell where you are, it stays off unless you choose Accept. Elsewhere in Canada we show a notice and it runs unless you turn it off. Everywhere else it runs unless you turn it off. If your browser sends a Global Privacy Control signal, it stays off unless you turn it on yourself. You can change your choice at any time with the “Your privacy choices” link at the bottom of every page. Your choice is saved in your browser’s local storage, not in a cookie.
• Error reports. When the site hits an error, Sentry records the error, the page address and your browser details.

Cookies and similar technologies

These are the cookies and browser storage the site uses. Only the Google Analytics cookies are optional.

Why we collect it, and on what basis

• To publish and moderate outage reports, keep the record accurate, review claims and corrections, and prevent spam and abuse. This is our legitimate interest in running a trustworthy public service (GDPR Art. 6(1)(f)), and for what you submit, your decision to submit it.
• To send the outage alerts you asked for, and to reply to you. This is based on your request and consent (GDPR Art. 6(1)(a) and (b)), which you can withdraw at any time.
• To measure the site with Google Analytics. Where the law requires it, this is based on your consent (GDPR Art. 6(1)(a)). Elsewhere it is based on our legitimate interest, and you can opt out.
• To find and fix errors, and to count visits with Vercel Analytics. This is our legitimate interest in a working site (GDPR Art. 6(1)(f)).

Who receives it

We do not sell your personal information or share it for cross-context behavioral advertising. These service providers receive it to run the site:

• Supabase. Hosts our database and sign-in.
  Receives: Everything we store: reports, claims, responses, corrections, alert addresses and sign-in email addresses.
  Where: United States (Amazon Web Services, us-east-1), under the EU Standard Contractual Clauses in its data processing addendum.
• Vercel. Hosts and serves the website, and provides Vercel Analytics.
  Receives: Your IP address and request details on every page, and anonymous page statistics with no cookies.
  Where: United States and its global network. Vercel is certified under the EU-U.S. Data Privacy Framework.
• Cloudflare. Stores report photos and map tiles (Cloudflare R2), checks forms (Turnstile), and routes our moderation requests (AI Gateway).
  Receives: Photos you attach; your IP address when you load map tiles or a form check; the text and photos sent for moderation.
  Where: United States and its global network. Cloudflare is certified under the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks, with Standard Contractual Clauses as a fallback.
• Postmark. Sends our email, including outage alerts and messages to our team, and reports bounces and complaints.
  Receives: Email addresses and message contents.
  Where: United States. Its operator, ActiveCampaign, is certified under the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks.
• Google. Google Analytics (only where you allow it), and Google Maps address lookup as a fallback.
  Receives: Analytics: pages viewed, device and browser details, and your IP address. Address lookup: the address text or map location you search, sent by our server without your IP address.
  Where: United States. Google LLC is certified under the EU-U.S. Data Privacy Framework.
• OpenStreetMap Foundation (Nominatim). Address search.
  Receives: The address text or map location you search. Most searches go through our server without your IP address. If our server finds nothing near you, your browser asks Nominatim directly, which sends your IP address.
  Where: United Kingdom and the Netherlands.
• GitHub Pages. Serves the fonts and icons drawn on our maps.
  Receives: Your IP address and browser details when a map loads.
  Where: United States. GitHub is certified under the EU-U.S. Data Privacy Framework.
• jsDelivr. Serves the script that shrinks a photo in your browser before upload. The photo itself is never sent to jsDelivr.
  Receives: Your IP address and browser details when you attach a photo.
  Where: A global network. We have not confirmed a transfer safeguard for it.
• Sentry. Records errors in the website so we can fix them.
  Receives: Error details, the page address and browser details when an error occurs, sent from your IP address.
  Where: United States. Sentry is certified under the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks.
• Anthropic, OpenAI and DeepSeek. Language models that check submitted text and photos for spam and abuse, reached through Cloudflare's AI Gateway. Anthropic is tried first. OpenAI, then DeepSeek (text only), are used only if the one before is unavailable.
  Receives: The text of a note, post, tip or bug report, and report photos (Anthropic and OpenAI only). Not your email address.
  Where: Anthropic and OpenAI: United States, under the Standard Contractual Clauses in their data processing addenda. DeepSeek: China, which has no EU adequacy decision; we have not confirmed a transfer safeguard for it.
• TypeSafe. A test classifier that may run alongside moderation to compare results. It never changes a decision.
  Receives: The same text sent for moderation.
  Where: Reached through Cloudflare's AI Gateway. We have not confirmed where it processes data.

Where it is processed

We are based in Canada, and most of our providers process data in the United States or on global networks, as listed above. Where a provider relies on the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses, we say so above. We have not confirmed a transfer safeguard for jsDelivr, DeepSeek or the TypeSafe test classifier. Email info@elevatoruptime.com for a copy of the safeguards that apply.

Retention

We keep personal information only as long as we need it for the purposes above, or as the law requires. Only the first three rules below run automatically today.

IP addresses used for rate limiting

Deleted automatically after about a day.

Backups of reports, responses, claims and alert addresses

Deleted automatically after 8 weeks.

Google Analytics user and event data

Deleted by Google after 14 months. Aggregated reports, which do not identify you, are kept longer.

Reports, photos and device IDs

Set by policy: kept while the report is part of the public record. Deleted on request.

Alert email addresses

Set by policy: kept until you unsubscribe. After that the address stays marked as unsubscribed so we do not email you again. Deleted on request.

Claims, responses, corrections, tips, bug reports and messages

Set by policy: kept while we need them to review and maintain the record. Deleted on request.

Your rights and choices

• Analytics.Change your Google Analytics choice at any time with “Your privacy choices” at the bottom of every page.
• Unsubscribe. Every alert email includes an unsubscribe link. It opens a page where you confirm, and the alert stops as soon as you do.
• Your rights. Depending on where you live, you can ask to access, correct or delete your personal information, restrict or object to how we use it, receive a copy to take elsewhere, and withdraw any consent you gave. Email the Privacy Officer at info@elevatoruptime.com. We answer within 30 days.
• Deletion. Email info@elevatoruptime.com with the email address you used, or the building and date of your report, and we will delete your alert address, report, device ID or other submission.

Complaints

If you are unhappy with how we handle your information, email info@elevatoruptime.com with “privacy complaint” in the subject. The Privacy Officer will acknowledge it within 30 days, look into it, and write to you with the outcome.

You can also complain to a regulator: the Office of the Privacy Commissioner of Canada (OPC), the Commission d’accès à l’information du Québec (CAI), the UK Information Commissioner’s Office (ICO), the Swiss Federal Data Protection and Information Commissioner (FDPIC), or the data protection authority where you live in the EU.

CASL and CAN-SPAM

Our alert email follows Canada’s Anti-Spam Legislation (CASL) and the United States CAN-SPAM Act. We only send alerts you asked for, every message identifies Elevator Uptime as the sender and includes our mailing address, and every message includes a working unsubscribe link.

Children

Elevator Uptime is a general-audience service and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

When we change this policy we update the version date at the top of the page. If a change is material we will make it prominent before it takes effect.