Privacy
How hiccup handles your data
hiccup analyses SIP and H.323 traces. Those traces routinely contain phone numbers and IP addresses, so this page is specific about what happens to them rather than generic.
Who is responsible
The data controller is:
Spotlight.Riviera (Gavin McFadyen)1460 chemin des Plaines
06370 Mouans-Sartoux
France
SIRET: 999 113 319 00019
Full publisher and hosting details are on the legal notice.
For any question about your data, or to exercise any right below, email [email protected].
What is stored, and why
| Data | Why | Legal basis |
|---|---|---|
| Your email address and a hash of your password | To let you sign in and to keep your captures separate from everyone else's | Performance of a contract |
| The capture files you upload, and the analysis derived from them | This is the service. A trace may contain phone numbers, IP addresses, SIP URIs and, if present in the file, media | Performance of a contract |
| Vendor guides you upload to the library | To ground configuration advice in your own documentation | Performance of a contract |
| Feedback you choose to send | To fix and improve the tool | Legitimate interest |
| A server access log line per request: time, a shortened form of your IP address, the page asked for, and your browser identification string | To see whether the site is working and how much of its traffic is automated scanning rather than people. The address is shortened before it is written — the last part of an IPv4 address, and all but the first three groups of an IPv6 one, are dropped — so it is enough to tell one network from another but not enough to identify you. Full addresses are never stored unless the operator changes a setting to do so. | Legitimate interest |
| A session cookie | To keep you signed in. HttpOnly, SameSite=Lax, and Secure over HTTPS | Strictly necessary |
Things hiccup deliberately does not do
- No analytics, no tracking, no advertising cookies. There is no third-party analytics script and nothing follows you between sites. The only cookie is the one that keeps you signed in, which is why there is no cookie banner — there is nothing to consent to. The server does keep the short access log described above; that is not the same thing, but it is not nothing either, so it is listed rather than glossed over.
- Your traces are not sent anywhere. Analysis happens on the server you are using. Where an AI feature is available it runs against a language model on that same machine, not a third-party API.
- Your data is not sold, shared or used to train anything.
Automatic protection of phone numbers
By default hiccup masks caller and callee digits in the analysis it derives
from your upload, so a number appears as
sip:+3361…[email protected] — still enough to follow a call across
legs, without the full number sitting on screen. Credentials in
Authorization headers are always removed, and that is not
optional.
The file you uploaded is kept exactly as you sent it and is never rewritten — masking your own evidence in place would destroy it. You can turn masking off per upload in Settings.
If you are on a team
A team shares one library. Everyone on your team can see the captures, projects and guides in it, and that is the point of the feature — but it means you should treat anything you upload as visible to your teammates. Deleting your own account does not delete the team's shared library.
How long it is kept
Captures are kept until you delete them, unless a retention period is configured on the instance you are using, in which case older captures are swept automatically. The current setting for this instance is shown in Settings. Your account is kept until you delete it. Sessions expire on their own.
Who else is involved
- Cloudflare carries traffic between you and the server and terminates TLS, so it necessarily handles your connection in transit.
- Google only if you choose "sign in with Google", and only to verify who you are. It is off unless configured.
- Resend only if email is configured on the instance, and only to deliver notification email.
The server itself is in France.
Your rights
Under the GDPR you can:
- See and take a copy of your data — Settings → Download my data gives you everything, as JSON.
- Have it erased — Settings → Delete my data removes your captures and library while keeping your account, or Delete my account removes both.
- Correct it, object to processing, or restrict it — email the address above.
- Complain to the CNIL (cnil.fr), the French supervisory authority, if you think something here is wrong.
Deletion is immediate and cannot be undone; there are no backups from which an erased capture could be recovered.
Changes
If this notice changes materially, the date at the top changes with it. hiccup is free while in beta and the service may change or end.