Privacy Policy

1. Controller and contact

The controller for the processing described here is SOFTIVO INNOVATIONS S.R.L., Bucureşti Sectorul 1, Strada Lt. Radu Beller, Nr. 3-5, România (Romania). You can reach us about privacy at office@softivo.ro.

We are established in the EU and are not required to appoint a representative under Article 27 GDPR. We are not legally required to appoint a Data Protection Officer, but the address above reaches the people responsible for data protection at SOFTIVO INNOVATIONS S.R.L..

2. Who this policy covers

This policy applies to:

• visitors to our website;
• account holders and people who sign up for or administer the Service;
• people whose contact details or other personal data a customer chooses to enter into the Service — for example an email address, Slack, Discord or Telegram destination configured to receive alerts, or a name or identifier contained in a monitored URL or an incident note.

Where a business customer decides why and how personal data is entered into the Service, that customer is the controller and SOFTIVO INNOVATIONS S.R.L. acts as its processor under the Data Processing Addendum. This Privacy Policy governs the data for which SOFTIVO INNOVATIONS S.R.L. is itself the controller (such as account, billing and security data).

3. Personal data we process

3.1 Account data

• name and email address;
• a hashed password (we never store your password in readable form) and email-verification status;
• if you use “Sign in with Google”: your Google account identifier, name, email address and profile-picture URL, received from Google.

3.2 Technical and session data

• IP address, browser user-agent string, and session timestamps, stored with your login session;
• a “remember me” token if you choose to stay signed in;
• server logs and security events (for example failed login attempts and rate-limiting data).

3.3 Billing data

Paid plans are processed by Paddle as merchant of record. Paddle provides us with your name, email, billing country, tax identifier where applicable, and transaction details (amounts, currency, invoice numbers, status). We never receive or store your full payment-card details — those are handled by Paddle.

3.4 Service configuration and content

• the endpoint URLs you monitor, which may contain hostnames, paths or parameters that identify individuals or internal systems;
• monitor names, status-page titles and descriptions, and free-text incident notes you write;
• notification-channel settings, which we store encrypted: destination email addresses, Slack and Discord webhook URLs, and Telegram bot tokens and chat identifiers. These may contain personal data of your colleagues or other third parties;
• notification delivery logs: the channel used, a subject line (which may include a monitor name or URL), delivery status, and any error message returned by the provider.

3.5 Correspondence

Emails and messages you send us for support or other enquiries, and our replies.

We do not intentionally collect special categories of personal data. Please do not put sensitive information into free-text fields such as monitor names or incident notes.

4. Purposes and legal bases

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask for information about that balancing test, and you can object to processing based on legitimate interests (see clause 10).

5. No profiling, automated decisions or AI training

We do not carry out profiling, and we do not make decisions producing legal or similarly significant effects about you by automated means (Article 22 GDPR). We do not use your personal data or your content to train artificial-intelligence or machine-learning models. If this changes, we will update this policy and provide the information and choices required by law.

6. Children

The Service is not directed to children. We do not knowingly process the personal data of anyone under 16 years of age (the age of digital consent under Romanian Law No. 190/2018). If we learn that we hold such data, we will delete it. Contact office@softivo.ro if you believe a child has provided us with personal data.

7. Recipients and sub-processors

We share personal data only with service providers that process it on our behalf under contract, and with others where necessary for the purposes above. Our current sub-processors are listed, with their roles and locations, on our Sub-processors List. They include:

• Paddle — payment processing, checkout, subscription management, invoicing and tax as merchant of record;
• Resend — delivery of our transactional emails (verification, password reset and incident-alert emails), which involves the recipient’s email address and the email content;
• Google — only if you choose “Sign in with Google”, for authentication;
• our hosting and infrastructure provider, which hosts the application, database and queue;
• the Have I Been Pwned “Pwned Passwords” service, which receives only a short, irreversible partial hash of a chosen password (no username, email or other identifier) to check it against known breaches.

When you configure alerts to Telegram, Slack or Discord, the Service sends the alert content to the destination you specify, acting on your instructions. Those platforms are independent controllers for what they then do with that content, under their own terms.

We may also disclose personal data to professional advisers, to authorities where legally required, and to a successor entity in a merger, acquisition or asset sale (with continued protection under this policy).

8. International data transfers

Some recipients listed above process personal data outside the European Economic Area, including in the United States. Where they do, we rely on one or more of the following safeguards:

• the European Commission’s Standard Contractual Clauses (2021/914), together with a transfer impact assessment and, where needed, supplementary technical and organisational measures;
• an adequacy decision for the destination country, where one applies;
• the EU–US Data Privacy Framework, where the recipient is certified. The Framework’s status is subject to ongoing legal challenge, so we treat the Standard Contractual Clauses as our primary and fallback mechanism.

For transfers from the United Kingdom we use the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses; for transfers from Switzerland, the Swiss-specific amendments. You can request a copy of the relevant safeguards from office@softivo.ro.

9. How long we keep data

• Account data — for as long as your account is open. After you close your account, we delete or irreversibly anonymise your account data and configuration within 90 days, except data we must keep for the purposes below.
• Monitoring history, incidents and notification delivery logs — retained for the period set by your plan and then automatically deleted (currently 7 days on the free plan and 30 days on the paid plan). We keep only daily aggregated statistics, not per-request records.
• Billing and accounting records — kept for the periods required by Romanian law, generally 5 years for supporting accounting documents and 10 years for financial statements, calculated from the statutory start date.
• Session records — removed after the session expires (inactivity of about two hours) and swept periodically thereafter.
• Security logs — kept for a short period (typically up to 12 months) unless needed for an ongoing investigation.
• Backups — kept on a short rolling cycle and overwritten in the ordinary course; data deleted from the live system is removed from backups as they cycle.
• Correspondence — kept for as long as needed to handle your request and for a reasonable period afterwards.

10. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive data you provided to us in a portable, machine-readable format and have it transmitted to another controller where technically feasible;
• withdraw consent at any time, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not carry out such processing).

You can exercise several of these directly in the Service: use Settings → Export to download a copy of your profile, monitors, status pages, notification channels and incidents, and use the account-closure option in Settings to close your account. For anything else, or to make a formal request, contact office@softivo.ro.

We will respond within one month, extendable by two further months for complex requests. We may need to verify your identity. We do not charge a fee unless a request is manifestly unfounded or excessive.

You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the country of your residence or work. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul General Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania, anspdcp@dataprotection.ro, https://www.dataprotection.ro. We would appreciate the chance to address your concerns first.

11. Security and breach notification

We use technical and organisational measures appropriate to the risk, including encryption of traffic in transit (TLS), encryption at rest for notification-channel secrets, password hashing, access controls on a least-privilege basis, checks against known-breached passwords, protections against server-side request forgery and abuse of the monitoring engine, logging, and an incident-response process. No method of transmission or storage is completely secure.

If a personal-data breach occurs, we will notify the competent supervisory authority within 72 hours where required, and will inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

12. Cookies

We use only strictly necessary, first-party cookies to run the website and keep you signed in. We do not use analytics, advertising or third-party tracking cookies. Details are in our Cookie Policy.

13. Regional disclosures

13.1 United Kingdom

Where the UK GDPR and the Data Protection Act 2018 apply, references to the GDPR should be read as references to the UK GDPR, and the supervisory authority is the Information Commissioner’s Office (ico.org.uk).

13.2 Switzerland

Where the Swiss Federal Act on Data Protection applies, references to the GDPR also cover the Swiss FADP, and the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

13.3 United States (California and other state privacy laws)

This section supplements the policy for residents of US states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others). In the preceding 12 months we have collected the categories of personal information described in clause 3 (identifiers, account and login information, internet and network activity, commercial and billing information, and content you submit), for the purposes in clause 4, and disclosed them to the service providers in clause 7.

• We do not “sell” personal information and do not “share” it for cross-context behavioural advertising, as those terms are defined under California law. We do not process personal information for targeted advertising, and we do not knowingly process the personal information of consumers under 16 for sale or sharing.
• We do not use or disclose sensitive personal information for purposes that would trigger a right to limit its use.
• We do not use personal information to make decisions that produce legal or similarly significant effects through solely automated processing.
• Subject to your state’s law, you may request to know, access, correct, or delete your personal information, opt out of sale/sharing/targeted advertising (not applicable here as none occurs), and appeal a refused request. We will not discriminate against you for exercising these rights.
• To make a request, email office@softivo.ro. You may use an authorised agent; we may ask the agent for proof of authorisation and may verify your identity directly.
• California’s “Shine the Light” law: we do not disclose personal information to third parties for their own direct-marketing purposes.

13.4 Brazil, Canada and Australia

Where the Brazilian LGPD applies, our processing relies on the legal bases in clause 4 (which map to the LGPD bases), you have the rights set out in Articles 17–22 LGPD, and you may contact the Brazilian data protection authority (ANPD). Where Canada’s PIPEDA or Australia’s Privacy Act applies, you have the access and correction rights those laws provide and may complain to the Office of the Privacy Commissioner of Canada or the Office of the Australian Information Commissioner respectively. Contact office@softivo.ro to exercise any of these rights.

14. Changes

We may update this policy from time to time. If we make a material change, we will notify you by email or in-app before it takes effect. The version and date at the top of this page always show the current revision.

15. How to contact us

SOFTIVO INNOVATIONS S.R.L.
Bucureşti Sectorul 1, Strada Lt. Radu Beller, Nr. 3-5, România
Privacy enquiries: office@softivo.ro
General enquiries: office@softivo.ro

See the Legal Notice for full company identification details.