This Privacy Policy explains what personal data Alertly ("we", "us") collects when you use alertly.net and the Alertly monitoring service (the "Service"), why we collect it, and the choices you have. We collect as little as we need, we don't sell personal data, and we don't use advertising trackers.
Who is responsible
Alertly is the controller of the personal data described here. For data you put into the Service about other people, for example team members you invite or contacts on a status page, your organisation is the controller and we process that data on your behalf.
Contact us about privacy at [email protected].
What we collect
Account information
- Your name, email address and password (stored only as a secure hash).
- Two-factor authentication settings, if you turn them on.
- The teams you belong to and your role in each.
Billing information
Payments are handled by our reseller and Merchant of Record, Paddle. Paddle collects your payment details, billing address and tax information. We receive your subscription status, plan, invoice numbers and amounts, but never your full card number. See Paddle's Privacy Policy.
Monitoring data
- Server metrics sent by the Alertly agent: hostname, IP address, operating system and kernel, CPU, memory, disk, network, load, services, containers, listening ports with the names of the processes that own them, the busiest processes, counts of security events such as failed logins, and the number of pending package updates.
- Uptime checks: the URLs, hosts and ports you ask us to check, and the results (status, response time, SSL certificate and domain expiry details).
- Heartbeats: when your scheduled jobs check in, and the IP address they check in from.
- Alerts, incidents, comments and status pages that you or your team create.
The agent does not read your files, databases, application logs or command arguments, and does not collect your customers' personal data.
Notification settings
The email addresses, chat webhooks, bot tokens and webhook URLs you set up for alerts. Secrets such as tokens and webhook URLs are stored encrypted.
Usage and technical data
- IP address, browser and device type of signed-in sessions, so you can see and sign out of your devices.
- Server logs with IP addresses and requested pages, kept for security and troubleshooting.
- Error reports when something breaks on our side. These keep the page path and the error, never your form input, and email addresses are masked.
Status page subscribers
If someone subscribes to your public status page, we store their email address and confirmation status so we can send them updates. Every email has a one-click unsubscribe link.
Why we use it
| Purpose | Legal basis |
|---|---|
| Providing the Service: monitoring, alerting, status pages, team features | Performance of our contract with you |
| Billing and invoicing through Paddle | Contract, and legal obligations (tax, accounting) |
| Account security, fraud prevention and abuse prevention | Legitimate interests |
| Service emails: alerts, password resets, billing notices, important changes | Contract |
| Weekly and daily reports | Contract; you can switch them off in team settings |
| Improving reliability and fixing errors | Legitimate interests |
We do not send marketing emails without your consent, and we never sell or rent personal data.
AI features
Some optional features use an AI provider (such as OpenAI, Anthropic or Google, depending on our configuration) to explain alerts, summarise incidents, check server health and answer questions about your monitoring. When you use them, the relevant monitoring data (for example an alert, recent metrics and server names) is sent to the provider to produce the answer. We don't send passwords, tokens or payment details, and we use providers that do not train their models on data sent through their business APIs. Team owners can turn off all AI features for their team in team settings.
Who we share data with
We share data only with service providers that help us run the Service, under agreements that protect it:
- Paddle: payments, invoices, tax and refunds (Merchant of Record).
- Hosting and infrastructure providers: to run our servers and databases.
- Email delivery provider: to send alerts, reports and account emails.
- AI provider: only when a team uses AI features, as described above.
- Chat and notification services you connect, such as Slack, Telegram, Discord, Microsoft Teams or ntfy: we send your alerts to them because you asked us to.
We may also disclose data if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business, in which case this policy continues to apply.
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep data
- Server metrics: for the history period of your team's plan, then deleted automatically.
- Alerts, incidents and status page history: while your team exists, unless you delete them.
- Account data: while your account is open. When you delete your account, your personal data and the teams you own are deleted. Backup copies are overwritten on their normal rotation.
- Billing records: kept by Paddle and us for as long as tax and accounting laws require.
- Server logs and error reports: kept for a limited time for security and troubleshooting.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict some processing, and withdraw consent. You can do much of this yourself:
- Download your data from your profile page as a JSON file.
- Correct your name and email in your profile.
- Delete your account from your profile.
For anything else, email [email protected]. We will reply within 30 days. You also have the right to complain to your local data protection authority.
Security
We protect data with encryption in transit (HTTPS), encryption of secrets at rest, hashed passwords and agent tokens, optional two-factor authentication and strict access controls between teams. Read more on our Security page.
Cookies
We use only the cookies needed to sign you in and keep forms secure. See our Cookie Policy.
Children
The Service is not intended for children under 16, and we do not knowingly collect their data.
Changes
If we change this policy in a significant way, we will tell you by email or in the app before the change takes effect. The date at the top shows when it was last updated.