Data processing
Belvador is built so that the errors your apps send stay on a machine in your own Hetzner project. This page lists where each kind of data lives, who processes it, and the draft data processing agreement (DPA) that applies when you use Belvador.
Where your data lives
| Data | Where | Kept |
|---|---|---|
| Events, stack traces, breadcrumbs, source maps | Your node, in your Hetzner project | 30 days (events), 90 days after last use (source maps) |
| Traces and logs (span and log contents and attributes) | Your node, in your Hetzner project | Your project's retention, 7 days by default (up to 90) |
| Errors, traces and logs received while your node is unreachable | Cloudflare, sealed with your node's key (Belvador cannot read them) | Until delivered: errors at most 14 days, traces and logs at most 15 minutes |
| Uptime failure evidence (status line, safe headers, start of the response body) | Your node; the probe seals it to your node's key (Belvador cannot read it) | Newest 100 per check, as long as your errors |
| Uptime results (up or down, reason, status code, timings, certificate expiry, failing regions), check targets and ping URL times | Belvador's monitor service (Cloudflare) and control plane (Supabase) | Per minute for 3 days, per hour for 90 days |
| Node backups | Cloudflare R2, encrypted with age for your node and your recovery key | 7 daily + 4 weekly |
| Accounts, settings, hourly counts, error titles with personal data removed | Belvador control plane (Supabase) | While the workspace exists; 13 months for counts |
| Alert messages (title, level, link) | The channels you connect, under your own accounts (your Telegram bot, Slack, email account or Resend) | Per the channel provider |
Three places see content briefly in memory and store none of it: the edge reads each OpenTelemetry request to check it before sealing it to your node's key; when a member of your workspace opens errors, traces or logs, the edge passes them from your node to the browser; and Belvador's uptime probes read up to 64 KB of a response to test your check's conditions.
Sub-processors
Belvador gives at least 30 days' notice by email before adding or replacing a sub-processor, so you can object.
| Provider | Purpose | Data it can see |
|---|---|---|
| Cloudflare, Inc. | Edge intake, sealed buffer, encrypted backups, configuration, uptime and ping URL judging | Encrypted payloads; uptime results and ping URL times; IP address of the sending browser or server while in transit |
| Supabase, Inc. | Control-plane database and sign-in | Account email and name, workspace settings, counts, scrubbed titles, audit log |
| Lovable | Hosting of the Belvador web app | Requests to belvador.dev (no error payloads) |
| Hetzner Online GmbH | Belvador's uptime probe machines (Germany, United States, Singapore) | Each check's target address, and its responses in memory while a check runs |
| Belvador's mail provider (SMTP) — named here before the first paying customer | Belvador's own account emails (sign-in help, security notices, invitations) | Recipient email address and the message |
Your node runs under your own contract with Hetzner, in your own project — for it Hetzner is your provider, not Belvador's. Only Belvador's uptime probes run in Belvador's own Hetzner account.
Alert channels you connect — your own Telegram bot, Slack workspace, email account or Resend — are your providers, not Belvador sub-processors: Belvador delivers alert content to them on your instruction.
Data processing agreement (draft)
Draft for review
This DPA is a working draft that has not yet been reviewed by a lawyer. The contracting entity, its address, governing law and the control-plane hosting region will be filled in before the first paid plan. Until then, contact hello@belvador.dev for a signed copy.
1. Roles
You (the customer) are the controller of personal data in the errors your apps send. Belvador acts as your processor when it provisions and operates your node, relays and buffers your errors, and stores control-plane metadata.
2. Subject, nature and purpose
Belvador processes data only to provide error monitoring: receiving, buffering, grouping, alerting and displaying errors, and maintaining your node and its backups. Belvador does not sell data, use it for advertising, or train models on it.
3. Categories of data and data subjects
End users of your apps (technical data in errors; by default emails and IP addresses are masked and user IDs are hashed on your node) and members of your workspace (name, email, sign-in and audit records).
4. Instructions and confidentiality
Belvador processes data only on your documented instructions — your settings in the product — and makes sure everyone with access is bound to confidentiality. Belvador staff can view your workspace only if an owner turns on read-only support access, and every view is recorded in your audit log.
5. Security
Belvador applies the technical and organisational measures described on the Security page, including encryption in transit, sealed buffering, encrypted backups, two-step verification for sensitive actions, and an append-only, hash-chained audit log.
6. Sub-processors
You authorise the sub-processors listed above. Belvador imposes data protection obligations on them that are no less protective than this agreement and remains responsible for their performance.
7. Assistance and data subject requests
Belvador helps you answer data subject requests and carry out impact assessments. Because error data lives on your node, you can search and delete it there directly.
8. Personal data breaches
Belvador notifies you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
9. Deletion at the end of the service
When you delete a workspace, Belvador waits 24 hours (you can cancel), then deletes your node and its data, wipes stored credentials, and lets encrypted backups expire under the retention above.
10. Transfers
Your node runs in the Hetzner location you choose. Cloudflare and other sub-processors may process data in other countries; where required, transfers rely on the providers' Standard Contractual Clauses.
11. Audits
Belvador makes available the information needed to demonstrate compliance with this agreement, and answers reasonable written questions about its controls.
Last updated Oct 24, 2026