Privacy Policy

Who we are

SensaCat ("we", "us") operates the monitoring service at sensacat.com and its dashboard. For the personal data described below we are the data controller, except for the monitoring data you send us, where you are the controller and we are your processor.

Privacy questions, access requests and deletion requests go to [email protected]. We answer within 30 days.

What we collect

When you visit the website

Nothing that identifies you. The marketing site uses privacy-friendly analytics that set no cookies and build no cross-site profile; we see aggregate page views, referrers, country and browser type, and cannot tie any of it back to a person.

The free tools at /tools need no account. Most of them run entirely in your browser and send us nothing at all. The four that need a server — the SSL checker, the domain checker, the header checker and the webhook tester — receive only the hostname or URL you type.

When you fill in a form

The early-access and contact forms store what you type: your name, email address, and whichever optional fields you completed (company, team size, current tooling, your message). We also record which page or campaign sent you, and the time of submission. We do not store your IP address with the submission.

When you have an account

• Identity — name, email address, and a salted hash of your password. We never store the password itself. If you sign in with Google or through your employer's single sign-on, we receive your email address and name from that provider instead.
• Account — company name, time zone, plan, your role, and which accounts you belong to.
• Sessions — a session identifier and an expiry, so that signing out on one device actually ends that session.
• Alert destinations — the email addresses, Slack and Discord webhook URLs and phone numbers you choose to send alerts to.
• Billing — your plan, billing period and invoice history. Card details never reach us; they are handled entirely by our payment provider.
• Audit trail — who invited, removed or changed the role of whom, and when.

The monitoring data you send us

Events are metadata only: a timestamp, which monitor or flow the event belongs to, the identifier of the record moving through it (an order number, a user id) and a status. We do not ask for payload contents and do not store them. If your identifiers are themselves personal data — an email address used as a flow entity id, for example — then that is personal data you have chosen to send us, and it is covered by the retention rules below.

Why we are allowed to hold it

• To perform our contract with you — running the service, sending the alerts you configured, billing you for the plan you chose.
• Legitimate interests — keeping the service secure and available, stopping abuse of the free tools and the public forms, and answering your support messages.
• Consent — when you submit a form asking us to contact you about early access. You can withdraw it at any time by replying to any message from us or emailing us.
• Legal obligation — keeping invoices and tax records for as long as the law requires.

We do not sell personal data, we do not share it with advertisers, and we do not use it to train machine learning models.

Who else processes it

We use a small number of providers to run the service. Each one sees only what it needs:

Some of these providers operate outside the EEA and the UK. Where they do, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent mechanism. A current list of named subprocessors is available on request from [email protected].

Cookies and local storage

We set no advertising cookies and no tracking cookies, which is why this site has no cookie banner. What we do set:

• A session cookie, set only after you sign in. It holds your session token, is restricted to our own site (SameSite=Lax), and is deleted when you sign out. Without it you cannot stay signed in.
• A theme preference in your browser's local storage, remembering whether you chose the light or dark theme. It never leaves your browser.
• A bot-protection token, set by Cloudflare Turnstile on pages with a form, to tell a person from a script. It carries no identity and expires quickly.

How long we keep it

• Alerts are kept for the retention period of your plan — 7, 30 or 90 days, or indefinitely on Enterprise — after which closed alerts are deleted automatically.
• Uptime history follows the same plan retention, except that individual check records are capped at 90 days on every plan. Daily summaries are kept for longer.
• Webhook-tester bins from the free tools are deleted 24 hours after they are created, and never store Cookie headers at all.
• Account and monitoring data is kept while your account is open, and deleted within 30 days of the account being closed.
• Form submissions are kept until you ask us to delete them, or for two years without contact, whichever comes first.
• Invoices are kept for as long as tax law requires, normally six to seven years, whatever else has been deleted.

How it is protected

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes. API keys, provider secrets and SSO client secrets are encrypted at rest, and secrets are never shown again after they are saved — rotating one replaces it outright rather than adding a second working key. Access to production data is limited to the people who need it to run the service.

We make no certification claim we cannot evidence. If your procurement process needs a specific questionnaire or a data processing agreement, email [email protected] and we will answer it honestly, including where the answer is "not yet".

If you believe you have found a vulnerability, please tell us at the same address before disclosing it publicly. We will not pursue anyone who reports in good faith.

Your rights

If you are in the UK, the EEA or another territory with comparable law, you can ask us to:

• give you a copy of the personal data we hold about you, in a portable format;
• correct anything that is wrong;
• delete your data, subject to the invoice retention above;
• restrict or object to a particular use of it;
• withdraw a consent you previously gave.

Email [email protected] and say which of these you want. We do not charge for it and we do not require a specific form of words. If you think we have got it wrong, you may also complain to your national data protection authority — in the UK, the Information Commissioner's Office.

Children

SensaCat is a tool for people running software in production. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change materially affects what we do with your personal data, we will email account holders before it takes effect rather than relying on you to re-read the page.

Questions: [email protected].