Privacy Policy

Account data: email address, full name, encrypted password. If you sign up via a third-party OAuth provider (Google, GitHub), we receive your name and email from that provider.

Billing data: subscription tier, payment history. Credit card details are processed by Paddle (our merchant of record) — we never store them.

Monitor configuration: URLs, domains, hostnames, IP addresses, ports, keywords, and other targets you configure for monitoring.

Check results: response times, status codes, uptime status, error messages, SSL certificate details, DNS records, screenshots, and other performance data generated by our workers. This data is retained according to your subscription tier.

Usage data: IP address, browser type, operating system, pages visited, features used, referring URLs, and session activity collected automatically.

Communications: messages you send via our contact form or support email.

• Provide, operate, and improve the monitoring service
• Execute monitoring checks and deliver alert notifications
• Process payments and manage your subscription
• Send transactional emails (account verification, password resets, alert notifications)
• Respond to support requests and customer inquiries
• Send important service announcements (cannot be opted out of)
• Detect and prevent fraud, abuse, or security threats
• Analyse aggregated, anonymised usage to improve our product
• Comply with applicable legal obligations

We do not sell your personal data to third parties. We do not use your monitoring data for advertising purposes.

We share data only with the following service providers, strictly to deliver our service:

We may also disclose data if required by law, court order, or to protect our rights and the safety of users.

We retain your account data for as long as your account is active. Check result data is retained according to your subscription tier:

Aggregated hourly and daily summaries may be retained longer for historical reporting purposes. Account data (profile, monitor configurations, alert channel settings) is retained for as long as your account is active.

Upon account deletion, all personal data is permanently removed within 30 days. You may request deletion at any time by contacting us.

Your data is stored in Supabase (PostgreSQL) with Row Level Security (RLS) policies that enforce strict data isolation between accounts.

• All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption
• Passwords are hashed using bcrypt — we never store plain-text passwords
• API keys are stored as SHA-256 hashes and shown only once on creation
• Session tokens use HTTP-only cookies with secure and SameSite attributes
• Security measures include rate limiting, input validation, CSRF protection, and Content Security Policy (CSP) headers
• Database access is restricted by Row-Level Security (RLS) policies
• Regular security patches are applied to all infrastructure

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but we take every reasonable precaution.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data ("right to be forgotten")
• Right to restriction: request that we limit processing of your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing of your personal data for certain purposes
• Right to withdraw consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

• Essential cookies: required for authentication, session management, and security — cannot be disabled
• Preference cookies: remember your theme (dark/light mode), sidebar state, and language settings
• Analytics cookies: Google Analytics (anonymised) to understand how visitors interact with our marketing website. These are only used on monitorion.com, not in the application at app.monitorion.com.

You can control cookie settings through your browser. Disabling essential cookies may prevent you from using the Service.

Your data may be processed in countries outside your country of residence, including the United States and the European Union, where our service providers operate. We ensure appropriate safeguards are in place for all international transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable.

Monitorion is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

We may update this policy periodically. Material changes will be communicated via email or an in-app banner at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this policy or your data?