1. Introduction

PulseWatch ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and applicable national privacy laws.

By using PulseWatch you acknowledge that you have read and understood this policy.

2. Data controller

The data controller responsible for your personal data is the operator of PulseWatch. PulseWatch is hosted exclusively at https://pulsewatch.pignatiello.online. You may contact us at the email address provided in the contact section below.

3. What data we collect

3.1 Account data

When you register an account we collect:

• Email address: used for account authentication and optional alert notifications.
• Clerk user ID: Clerk handles authentication, sign-up, sign-in, SSO, and session management. PulseWatch never sees or stores your password.
• TOTP secret: if you enable two-factor authentication, we store an encrypted TOTP seed for your account.

3.2 Monitoring configuration data

To provide the service, we store information you enter about your monitors:

• Monitor names, URLs, and check intervals
• Webhook URLs and webhook secrets (HMAC keys)
• Status page configuration and incident records

3.3 Operational and technical data

We automatically collect minimal technical data to operate the service:

• HTTP response times and status codes from monitored endpoints
• Server resource metrics (CPU, RAM, disk) collected by the platform
• Application logs for error diagnosis and security (may include IP addresses and timestamps)

3.4 Donations via NowPayments

PulseWatch is free. It is supported by donations only, processed by NowPayments. When you donate, NowPayments collects and stores the data needed to complete the payment, such as your name, email address, billing details, and transaction history.

PulseWatch does not store full card numbers. We keep only the minimum donation records needed to acknowledge support, such as a donation status and NowPayments transaction identifiers. NowPayments acts as an independent controller for payment data. Their use of that data follows the NowPayments privacy policy.

3.5 Email delivery via Resend

We use Resend to send transactional and product emails, including monitor alerts, status updates, and marketing or product announcements. Resend processes the email address and message content needed to deliver these emails. We do not sell these addresses.

3.6 Data we do not collect

PulseWatch does not use advertising trackers or sell data to any third party. No cookies beyond session management are set.

Web Analytics: This website uses PostHog for web analytics. It tracks page views and basic navigation patterns to help us improve the website experience.

3.7 Probes and third-party providers

Probes are a feature that lets other people share their own bandwidth to run multi-region checks for PulseWatch users. PulseWatch cannot ensure the quality or security of probes, and probe results are highly dependent on their provider. Be careful when routing your checks through community probes.

4. Legal basis for processing (GDPR Art. 6)

• Art. 6(1)(b) Contract performance: processing necessary to provide the monitoring service you signed up for.
• Art. 6(1)(c) Legal obligation: retaining security logs as required by applicable law.
• Art. 6(1)(f) Legitimate interest: detecting and preventing abuse, fraud, or service misuse.
• Art. 6(1)(a) Consent: for any optional features (e.g. marketing emails), if introduced in the future.

5. Data storage and retention

We store your data on the infrastructure that runs the PulseWatch hosted platform. We do not sell your data or share it with third parties, except the providers strictly required to operate the service: hosting infrastructure, Clerk for authentication, NowPayments for donations, and Resend for email delivery.

• We keep account data as long as your account is active.
• We keep monitor check history for a rolling window as configured (default: 30 days).
• We keep server access logs for up to 90 days.
• On account deletion, we permanently erase all personal data within 30 days.

6. Data transfers

We host PulseWatch exclusively at https://pulsewatch.pignatiello.online on infrastructure located in the European Union (EU/EEA). Your monitoring data stays there and we do not transfer it between regions by default. If you make a donation, NowPayments processes your payment data under its own terms and may process it outside the EU/EEA with its own safeguards.

7. Your rights under GDPR

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us using the details in Section 11. We will respond within 30 days.

8. Cookies and session data

PulseWatch uses a single session cookie (HTTP-only, Secure flag when HTTPS is enabled) solely to maintain your authenticated session. Website analytics are provided by PostHog and used only to understand aggregate usage. No advertising cookies are used.

9. Security

We implement appropriate technical and organisational measures to protect your data:

• Passwordless-friendly authentication delegated to Clerk (SSO, secure sessions)
• HMAC-signed webhook payloads
• Authentication and bot protection via Clerk on sign-up and public endpoints
• HTTPS enforced for all deployments
• Access to production data limited to the application processes

Despite these measures, no method of transmission over the internet is 100% secure. Use PulseWatch at your own risk for highly sensitive environments.

10. Children's privacy

PulseWatch is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Contact and complaints

For any privacy-related questions or to exercise your rights, contact the data controller at the email address published on the hosted instance dashboard.

You also have the right to lodge a complaint with your national Data Protection Authority (DPA) if you believe your data has been processed in violation of the GDPR.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by posting a notice on the dashboard. Continued use of PulseWatch after the effective date constitutes acceptance of the updated policy.