Privacy Policy

This policy describes data processing in CloudVigil, a website and API monitoring service. It applies to the website, dashboard, notifications, and public status pages. The service operator’s identification and contact details appear at the end of this document.

Organizations using a workspace decide which services to monitor, whom to invite, and what to publish. They are also responsible for personal data they submit to the service and the instructions they provide to the operator.

We process the information needed to provide the service you configure:

• Account and team: name, email address, hashed password, workspace, access role, and invitations.
• Monitoring: service names, URLs, groups, intervals, check rules, keywords, and visibility settings.
• Results: availability, response times, HTTP status codes, SSL certificate information, errors, and incident history.
• Destination identification: the last observed public IP, estimated country, DNS name and HTTP server reported by the destination, plus a cached favicon. These technical details stay in the private dashboard and are not repeated in every historical check.
• When you configure a keyword, response content may be read temporarily to check for that term. The full response body is not saved in check history.
• Integrations: alert recipients, chat identifiers, and credentials for the providers you connect.
• Publishing: title, description, logo, website link, and other settings for each status page.
• Connection and security: the IP address used for rate limiting and technical information needed to deliver pages. Hosting infrastructure may also generate access logs.

We use this data to create and secure accounts, separate workspaces, run checks, produce history, send requested alerts, and display the status pages you publish.

Depending on the activity and applicable law, processing may rely on performance of the requested service, compliance with legal obligations, or legitimate interests in operating and securing the service, subject to individuals’ rights. When an optional activity requires consent, it must be requested separately.

Do not include secrets, sensitive personal data, or third-party information in URLs, names, keywords, and descriptions when they are not necessary for monitoring.

The session cookie keeps you signed in. It lasts for up to 30 days and is invalidated on the server when you sign out. The browser prevents page JavaScript from accessing this cookie.

Language and theme preferences stay in your browser’s local storage until you change them or clear site data. Blocking or deleting this data may sign you out or restore default preferences.

When you dismiss the cookie notice, we store that acknowledgement in this browser’s local storage for 180 days. You can remove it by clearing site data.

This version of CloudVigil does not include advertising cookies or marketing analytics tools. Customer-provided logo images may load from external services, which receive the connection data needed to deliver the image.

When you publish a status page, you make the selected monitors’ names, availability, check history, incidents, and configured branding accessible. Response times and resolved incidents can be hidden in page settings.

Group pages show only public monitors from the selected group. Monitor URLs, integration credentials, and private diagnostics are not included in public page responses. Anyone who can access a published address may view or copy its content, and search engines may index it. Unpublishing a page does not remove copies made by third parties.

When you request an AI incident explanation, a snapshot of metrics, dates, failure categories, and technical settings is sent to OpenAI. Names, URLs, keywords, credentials, and response bodies are not sent. The explanation is available only within the workspace. Cached copies are removed after 30 days during periodic cleanup; daily usage counts are removed after 31 days.

When you use the chat assistant, your recent messages and the names, identifiers, metrics, and monitoring records it consults are sent to OpenAI. Read tools do not send monitor URLs, keywords, raw errors, credentials, or response bodies. URLs and other data you include in messages are sent with them; do not include credentials. Members with editing permissions can request changes to monitors and groups. The app displays the proposed fields and effects and only executes a change after the user confirms, rechecking permissions and current records. Proposals expire after 15 minutes. The conversation and proposals are private to your account within the workspace: we keep at most the six most recent completed exchanges and their proposals, removed after 30 days without an update during periodic cleanup. You can clear the conversation in the dashboard. Daily usage counts are kept for up to 31 days.

The infrastructure hosting CloudVigil processes data needed to operate the service. When you connect email or Telegram, recipients and alert contents are sent to the corresponding provider. Available integrations include Mailtrap, Amazon SES, and Telegram; the provider used depends on the operator’s and your workspace’s configuration.

Checks make requests to the addresses you configure. Monitored services receive those requests and their connection data. We do not send your account password to monitored services.

To obtain favicons, we request the destination’s home page and the icon addresses it specifies, without sending cookies or credentials. Those servers receive the necessary connection data. Country estimates use a DB-IP database downloaded to the server; monitor IPs are not sent to a geolocation API.

Providers may process data in other countries. Hosting regions and applicable safeguards depend on the deployment and providers engaged; ask the operator for these details. Data may also be disclosed when a valid legal obligation requires it.

Individual checks are available for up to 7 days; up to one additional hour may be retained to preserve period calculations. Aggregated history is retained for up to 7 days on Free, 30 days on Starter, and 90 days on Pro. The operator may apply a lower limit. Completed notification records are retained for 90 days by default, adjustable by the operator. Expired sessions and invitations are removed periodically.

Account data, workspace settings, and incidents may remain for as long as needed to provide the service, maintain security, and meet legal obligations. Deleting a monitor removes its associated checks and incidents. Deleting only a status page preserves monitors and their history.

Requests to delete an account or data without a dashboard deletion option must be sent to the operator. Any backups follow the infrastructure’s retention cycle and may not be erased immediately, subject to applicable legal requirements.

The service uses hashed passwords, encryption for stored integration credentials, and access controls by workspace and role. These measures reduce risk, but no system offers absolute security. Protect your password and limit team members’ access.

Depending on applicable law, you may request confirmation of processing, access, correction, information about sharing, and deletion where available, as well as other rights such as portability, objection, or withdrawal of consent in the circumstances provided by law. You may also complain to the appropriate authority.

You can edit your profile and manage monitors in the dashboard, subject to your permissions. For other requests, use the operator contact at the end of this page. We may need to verify your identity and connection to the workspace before providing or deleting data.

This policy will be updated when the service or data processing changes materially. The revision date appears at the top of the page. Changes requiring specific notice or new consent will follow applicable law.