Privacy Policy
Draft — last updated 17 September 2026
The controller of your personal data is [Company legal name, address]. Privacy questions: [privacy@ email].
What we process
| Data | Details |
|---|---|
| Account | Email address, password hash (we never store your password), account and team roles, email confirmation date. |
| Monitoring setup | Domains, target countries and providers, campaigns and daily budgets, tracker connections. Tracker credentials are encrypted at rest. |
| Notifications | Telegram chat IDs you connect, email addresses and webhook URLs you add. Webhook secrets are encrypted at rest. |
| Check history | For each check: result, HTTP status, timings, which detection rules matched and a hash of the response — not the page itself. Kept for 12 months. |
| Technical | IP address and browser details in server logs and for rate limiting; strictly necessary cookies. |
Why and on what legal basis
- Providing the Service you signed up for, including service emails and the alerts you configure — performance of a contract (GDPR Art. 6(1)(b)).
- Security, abuse prevention and rate limiting — our legitimate interests (Art. 6(1)(f)).
- Meeting legal obligations such as tax records — Art. 6(1)(c).
Who receives data
- Hosting provider: [name, region].
- Email delivery provider: [name].
- Proxy network providers: they receive only the URLs being checked and standard browser headers — no personal data about you.
- Telegram, for the chats you connect, and the tracker platforms you connect, using the credentials you provide.
[International transfers, if any, and safeguards.]
How long we keep it
- Account and monitoring setup: while your account exists, then deleted within 30 days.
- Check history: 12 months.
- Server logs: [period — configure log rotation to match].
Cookies
We use only strictly necessary cookies: a session cookie that keeps you signed in, a security token for forms, and an authorization cookie for live dashboard updates. We use no analytics or advertising cookies.
Security
Passwords are hashed, stored secrets are encrypted (XChaCha20-Poly1305), traffic is served over HTTPS, outgoing webhooks are signed with HMAC-SHA256, and sign-in, sign-up and password reset are rate limited.
Your rights
You can request access to, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You can also complain to your local data protection authority.
Changes
We will notify you by email about material changes to this policy.