Privacy
Last updated: 4 November 2026
In short: to use EveryLog you need an account registered with your professional e-mail address. We confirm the address by e-mail, and an administrator approves each account by hand (usually within 24 hours). We keep your name, organisation, e-mail address, your phone number if you give one, and a hash of your password for as long as you have an account (an account not used for 12 months is deleted), and you can delete it yourself at any time. For statistics, we keep a short record of each conversion (its id, the country you connected from, the type and model of the log, and whether it worked), without your IP address or account. The only cookie is the sign-in cookie; there are no analytics and no advertising. Your uploaded file is deleted as soon as it has been converted, and the report is deleted when you click Delete now or after its viewing time ends (30 minutes by default). Nothing is shared or sold.
Who is responsible
The controller for the data processed by everylog.net is Abdelhakim Hamzaoui, based in Morocco. Contact: support@everylog.net.
What is processed, why, and for how long
| Data | Why | How long |
|---|---|---|
| Your account: full name, company or organisation, professional e-mail address, phone number (optional), your password (stored only as a salted scrypt hash, never in readable form), the account's status (e-mail not confirmed, awaiting approval, active, rejected or disabled), the dates of registration, e-mail confirmation, approval decision and last sign-in, the reason for a rejection if one was given, your report access level (which report sections you can see, set by the administrator), and the version and date of the Terms and Privacy notice you accepted. | To create and run your account, to check that the service is used for professional purposes, and to let you sign in (Art. 6(1)(b) GDPR). The phone number is optional. If you give it, it is used only by the administrator, to check a registration or to contact you about your account (for example about a problem with it), based on our legitimate interest (Art. 6(1)(f)); it is never used for marketing, SMS campaigns or sign-in codes, and is not shared. You can ask us to remove it at any time. Keeping the acceptance date is our legitimate interest in being able to show what you agreed to (Art. 6(1)(f)). | As long as you have an account. Deleted at once when you delete it on Your account, or when the administrator deletes it. A registration whose e-mail address is never confirmed is deleted after 7 days; a rejected registration is deleted 30 days after the decision. An account that has not been signed in to for 12 months is deleted automatically; we warn you by e-mail 30 days before, and signing in keeps the account. |
| E-mail confirmation and password reset codes (6 digits, sent by e-mail and typed on the site). Only a SHA-256 hash of each code is stored, with the number of wrong attempts. | To check that the address is yours, and to let you choose a new password. | A confirmation code is valid for 24 hours and a reset code for 60 minutes; each works once and stops working after 5 wrong attempts, and the hash is removed when it is used or replaced. |
| The mail domain check. When you register, the domain of your address (the part after the @) is looked up in the public DNS to make sure it can receive e-mail, and compared with a list of personal, forwarding and disposable mail services, which are not accepted. | To accept professional addresses only and avoid sending e-mail to addresses that do not exist (legitimate interest). | Not stored: only the result decides whether the registration is accepted. |
| The e-mails we send you: the confirmation code, the notice that your account awaits approval, the approval or rejection, password reset codes, the warning before an inactive account is deleted, and the confirmation that your account was deleted. They contain no links. No newsletters or marketing. | Needed to run your account (Art. 6(1)(b) GDPR). | We do not keep copies. The e-mail delivery provider keeps delivery logs (recipient, time, result) for a limited time under its own retention rules. |
| Manual approval. When your address is confirmed, the administrator receives an e-mail saying that a registration awaits approval, without your details, and sees your name, organisation, e-mail address and phone number (if given) on the administrator dashboard. The administrator may call you on that number to confirm your registration. To decide, the administrator may look at public information about your organisation and its e-mail domain. | To keep the service for IT professionals and protect it from misuse (legitimate interest, Art. 6(1)(f) GDPR). | The decision is stored with your account (see above). Every decision is taken by a person: there is no automated decision-making or profiling. |
The sign-in cookie (__Host-everylog_session): a random identifier, linked on the server to your account and to the address you signed in from. | To keep you signed in. Strictly necessary, so no consent banner is needed. | Until you sign out, after 12 hours without activity, or at the latest 7 days after signing in. Sessions are held in memory only and all end when the service restarts. |
| Your uploaded file. Diagnostic logs can contain serial numbers, part numbers, firmware versions, network settings, event messages and other configuration data. In HPE logs, user and host names are usually masked by the server that created the log. EqualLogic bundles also contain IP addresses, group, member, pool and volume names, iSCSI initiator names and administrator account names; CHAP secrets, SNMP community strings and passwords found in them are replaced by [redacted] in the report. MSA store logs also contain pool, disk group and volume names, host initiator IDs, user account names and notification e-mail addresses; SNMP community strings and passwords are replaced by [redacted], and the log header's contact details are not copied into the report. EVA captures also contain the management server's name and IP address, host names, host port WWNs and comments typed by administrators; only their configuration and event files are read. 3PAR InSplores also contain host, volume and CPG names, host port WWNs, user names, licence information and the event log (including commands run by administrators and the addresses they connected from); only the command outputs, event logs and each node's slow-disk monitor log are read, and the nodes' other files and the raw licence keys are skipped and never shown in the report. Huawei iBMC dumps also contain the iBMC's host name, IP and MAC addresses, its operation and security logs (user names and the addresses they connected from), BIOS settings, screen captures and the serial console output of the server; the iBMC's own configuration stores (accounts and password hashes, SNMP, SSH and web settings), licence files and memory dumps are skipped and never shown in the report. IBM / Lenovo IMM2 service data also contains the system and IMM host names, IP and MAC addresses, UEFI setting changes and the event log (including the user names that signed in to the IMM and the addresses they connected from); the IMM's account, key, certificate, SNMP and e-mail alert and UEFI settings stores and its authentication logs are skipped and never shown in the report, and UEFI settings whose name suggests a secret are hidden. DSA output also contains the host's operating system logs, installed software, drivers and services, user accounts, environment variables, processes, configuration files, the Windows security log and IMM / UEFI settings; accounts, environment variables, processes, configuration files, the Windows security log, Linux authentication, mail and cron logs, SNMP communities and activation keys are skipped and never shown in the report, and settings whose name suggests a password, key, account or alert recipient are hidden. Brocade supportshow captures also contain the switch's name, IP addresses, the WWNs, names and aliases of the connected servers and storage, the zoning, and the event log (user names that signed in and the addresses they connected from); account lists, authentication settings, certificates and licence keys are never shown, and passwords and SNMP communities in configuration outputs are masked. Storwize / FlashSystem snaps also contain the system's name, IP addresses, the names and WWPNs / iSCSI names of the connected hosts, volume names, the event log, the audit log of commands run (user names and the addresses they connected from), the nodes' system logs, performance statistics and the call home contacts; only the files the report needs are read (node dumps and traces are skipped), certificates, key servers and cloud accounts are never shown, the user list shows names and groups only, and CHAP secrets, passwords and licence keys are masked. HPE BladeSystem Onboard Administrator SHOW ALL captures also contain the enclosure, blade and iLO names, IP and MAC addresses, the WWNs of blade adapters, the OA user list (names and rights), the OA, IML and iLO logs (user names that signed in and the addresses they connected from) and the OA configuration script; SNMP communities and passwords, including passwords the OA wrote in its own logs, are masked, and installed keys and certificates are never shown. | To produce the report you asked for. | Kept in a private temporary workspace while it waits and while it is converted, then deleted, whether the conversion succeeds or fails. |
| The report made from your file. | So you can open and download it. | Until you click Delete now, or until the viewing time shown on the page ends (30 minutes by default). Everything left is also deleted whenever the service restarts. It cannot be recovered afterwards. |
| The file name. | To show it back to you and to name the report. | In memory only, together with the job, and gone at the latest 15 minutes after the report is deleted. It is not written to logs and is not shown to the administrator. |
| Conversion statistics, one record per conversion: the conversion's random id, the date and time it ended, the country of the connection it was uploaded from, the type of log (for example HPE Active Health System or Brocade supportshow), the model of the server, storage array or switch named in the report (for example "ProLiant DL380 Gen10"), and the result (successful, or the reason it was not, such as "not a valid log" or "cancelled"). The country is looked up from your IP address at the moment of the upload, on our own server, in an offline database (IP Geolocation by DB-IP); the IP address is not stored for this and is not sent to anyone. The record contains no account, e-mail address, IP address, file name, serial number or other content of your file. | To know how the service is used (which log types and models, from which countries, how often conversions succeed), to improve the converters and to plan capacity (legitimate interest, Art. 6(1)(f) GDPR). | 24 months, then deleted automatically. Until the service restarts, the same conversion id also appears in the administrator's in-memory list of recent conversions, which shows the account (see the next row); after that, a statistics record can no longer be linked to you. |
| Which account ran each conversion: the account's e-mail address next to the technical facts of each conversion (size, duration, result). | To apply upload limits per account and to find the account behind misuse (legitimate interest). | In memory only, in the administrator's list of active and recent conversions (at most the last 200), until the service restarts. It is not written to logs. |
| Your IP address. | To apply upload and sign-in limits and protect the service from abuse (legitimate interest), and, at upload time only, to look up the country for the conversion statistics (see above). | In memory only: for one hour for upload and registration limits, 15 minutes for failed sign-ins, with your sign-in session while it lasts, and in the administrator's list of recent conversions (at most the last 200) until the service restarts. It is not written to logs. If an address is blocked for abuse, it is stored until it is unblocked. |
| Technical logs: time, job number, file size, duration and result; for account events (registration, confirmation, approval, password reset, deletion) and e-mails, only the event and the e-mail domain. No IP addresses of users, e-mail addresses, file names or file contents. | To run the service and find faults. | Overwritten by log rotation, which keeps a fixed amount of log data per service. |
| Service statistics: CPU, memory and storage use, conversion times and daily counts. | To size and monitor the server. | Daily figures for up to 31 days, plus all-time peak values. These are numbers only and are not linked to you. |
Who can see your report
Only you: a report opens only for the account that uploaded the file, signed in, with the report's secret link. The link is created for your browser when you upload, and it is not sent anywhere else. The administrator dashboard shows only technical facts about each conversion (account, size, duration, result and IP address). It does not show file names or reports. Files are not looked at except where strictly needed to keep the service secure.
Confidentiality of your files
Diagnostic files often hold confidential details about your or your customer's infrastructure. EveryLog treats every upload as confidential: the file is processed automatically in an isolated sandbox without network access, it is deleted as soon as the conversion ends, and the report is deleted when you click Delete now or when its viewing time ends. Nobody at EveryLog opens your files or reports, except where strictly necessary to investigate a security incident or abuse, and they are never used for any other purpose, such as training or marketing.
You decide what is uploaded. Please upload a file only if you are authorised to share it, that is, it comes from equipment you or your organisation own or manage, or the equipment's owner has allowed it. If the file contains personal data of other people (for example user names or IP addresses in event logs), EveryLog processes that data only to produce your report and deletes it with the file, as described above.
Who can see your account
The administrator of EveryLog sees your name, organisation, e-mail address, phone number (if given), account status and dates, to approve, reject, disable or delete accounts. Your password cannot be seen by anyone. Your account details are not shown to other users.
In your browser
The site sets a single cookie, the sign-in cookie described above (HttpOnly, so scripts cannot read it; sent over HTTPS only). While a conversion is running, the page keeps the job number, its secret key and the file name in your browser's session storage, so that a reload does not lose your report. Session storage is cleared when you close the tab, and the entry is also removed when your report is deleted or the conversion fails. The site loads no third-party scripts, fonts, trackers or analytics.
Sharing
Your account data, files and reports are not sold, shared or used for any other purpose, such as training or marketing. Data may be disclosed if the law requires it. These service providers process data for EveryLog, only on our instructions and under a data processing agreement:
- Contabo GmbH (Munich, Germany) hosts the EveryLog server, in a data centre in Germany. Everything the service stores or processes is on this server: accounts, uploaded files while they are converted, reports, statistics and logs.
- OVH SAS (Roubaix, France) runs the support@everylog.net mailbox and delivers EveryLog's e-mails, from data centres in France: it handles the recipient address and the content of each e-mail, and keeps delivery logs under its own retention rules.
Two further providers receive no personal data of users: Cloudflare answers DNS queries for the everylog.net domain only (visits to the site do not pass through Cloudflare), and Let's Encrypt issues the site's HTTPS certificate.
Your data is therefore stored on servers in the European Union (Germany and France). EveryLog is run from Morocco: the administrator can open the administrator dashboard and the support@everylog.net mailbox from there, so the account details shown there (see Who can see your account) and the technical facts about conversions can be viewed from Morocco, a country without an EU adequacy decision. Uploaded files and reports are not accessible this way. You can ask us for more information about this at support@everylog.net.
Security
Connections use HTTPS. Passwords are stored as salted scrypt hashes, sign-in attempts are limited, and changing or resetting your password signs out your other sessions. Each file is checked first, then converted in an isolated sandbox with no network access and strict time and memory limits. Reports are served in a restricted mode that cannot load or send data.
Legal basis
Running your account and processing your file and report are necessary to provide the service you request (Art. 6(1)(b) GDPR). The professional e-mail requirement, the mail domain check, manual approval, upload and sign-in limits, security logs, blocking and the conversion statistics are based on our legitimate interest in keeping the service for professional use, running it safely and improving it (Art. 6(1)(f) GDPR). You can object to processing based on legitimate interest; contact us.
Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where you think the infringement took place (see the European Data Protection Board's list of authorities). In Morocco, the authority is the CNDP. You can see your account details and delete your account yourself at any time on the Your account page, and delete a report with Delete now. Because files and reports are deleted so quickly, there is usually nothing else left to request. For anything else, such as a copy of your account data or a correction or removal of your name, organisation or phone number, contact support@everylog.net.
Changes
This notice may be updated. The version published on this page applies from the date shown at the top.