Privacy Policy

Saturn Backups is a backup service for InfluxDB and Grafana, operated by milliwatt (Norway). We are the data controller for your account data, and a data processor for the InfluxDB and Grafana data we back up on your behalf. Questions: privacy@saturnbackups.no.

• Your email and a securely hashed password.
• The connection details you enter for your InfluxDB or Grafana: URL, InfluxDB organization, and an API or service-account token (the token is encrypted at rest and never shown back to you or anyone else).
• The backup contents: what your backup tasks select, meaning the data in your InfluxDB buckets and your Grafana dashboards, folders, data sources, alert rules and annotations, stored as compressed files.
• Operational metadata: your tasks and their run history, alerts, usage figures, and basic server logs (including IP addresses) needed to run and secure the service.

We don't use tracking or advertising cookies; the only browser storage is your login session and display preferences (theme, time zone).

We process your data to provide the service you signed up for (a contract, under GDPR Art. 6(1)(b)) and to keep it secure and reliable (our legitimate interest). We don't sell your data or use it for advertising.

Only the providers we need to run the service ("sub-processors"):

• Hetzner: object storage for your backups (EU region).
• A transactional email provider, for alerts and account emails.
• Our hosting provider, to run the application.

We don't share your data with anyone else, and we'll tell you before adding a new sub-processor that handles your data.

Your data is stored in the EU/EEA. We keep backups until you delete them or close your account; none expire on their own. A backup you delete waits 30 days under Recently deleted, so you can recover it, and is then erased for good. Deleting your account erases all of it (see your rights below).

Under the GDPR you can, at any time:

• Access / export your data: "Download my data" on the account page.
• Correct it, e.g. change your email on the account page.
• Delete your account and all its data: "Delete account" on the account page.
• Object to or restrict processing, and lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

InfluxDB and Grafana tokens are encrypted at rest, passwords are hashed (argon2), sessions are stored only as hashes, and we guard against requests to internal networks. If a breach ever puts your data at risk, we'll notify you and Datatilsynet as the law requires.