Legal
Privacy policy
Last updated
Template covering the data the Service actually handles. Not legal advice — have counsel review before commercial reliance.
What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Email, hashed password, organization name, TOTP secret (encrypted at rest) | Authentication and tenancy |
| Monitoring configuration | Domains you add, maintenance windows, webhook URLs | To run the Service |
| Observation data | DNS records, certificates, routing and registration data for those domains | The product itself |
| Operational logs | Request metadata, IP address, audit-log entries for account actions | Security, abuse prevention, debugging |
| Billing | Handled by our payment processor; we store only plan state and identifiers | Subscriptions |
What we do not collect
We do not read your traffic, place code on your sites, or require access to your DNS provider or registrar. Every measurement is a query any resolver on the internet could make. Observation data about public infrastructure is not personal data, though registration records can occasionally contain personal details published by a registry — we store those as returned.
Retention
Raw observations are retained for a fixed window (90 days by default for a deployment; your plan's stated history retention governs what you can see). Derived history — state intervals, change events, incidents and evidence records — is kept for the retention period of your plan. Removing a domain removes its history from your organization. Closing your account removes account data, subject to any retention we are legally required to keep.
Sharing
We do not sell personal data. We share it only with the infrastructure and service providers listed under Subprocessors, and where legally required.
Security
Transport is TLS throughout. Passwords are hashed; TOTP secrets and other sensitive material are encrypted at rest. Access controls are enforced per organization on every request. See Security.
Your rights
Depending on your jurisdiction you may request access, correction, export or deletion of your personal data, and object to certain processing. Contact us from your registered email address and we will respond within the period applicable law requires.