Privacy Policy

What we collect

Account data: your name, email address, organisation name, and — for paid plans — the billing details required to issue an invoice. Payment card details are handled by our payment provider and never reach our systems.

Store data: the URLs you ask us to monitor, the settings of each monitor, and any credentials you choose to store for authenticated checks. Credentials are encrypted at rest.

Run data: the outcome of each check, timings, and — for failed runs — a screenshot, a browser trace, a network log and console output from your own storefront.

Usage data: sign-in times, IP address and browser user agent, kept for security and abuse prevention.

Redaction

Evidence is redacted at the moment of capture, before anything is written to disk. Cookies, authorisation headers, session and CSRF tokens, passwords and card numbers are removed at that point. This is a property of how capture works, not a cleanup step that runs later and can be skipped.

Evidence is still taken from your own storefront. If your store renders personal data of your customers into a page MageSentinel visits, that data may appear in a screenshot. Use dedicated test data where you can.

Why we may use it

To provide the service you signed up for (performance of a contract): running checks, storing results, sending alerts.

To charge you and meet accounting obligations (legal obligation).

To keep the service secure and prevent abuse (legitimate interest).

We do not sell personal data, and we do not use your run data to advertise to you.

How long we keep it

Evidence from runs: 3 to 90 days depending on your plan, then deleted automatically.

Run outcomes and incident history: for the life of your account, so trends stay meaningful.

Account and billing records: for the life of your account, and afterwards for as long as tax and accounting law requires.

After you close your account we delete your data within 30 days, except records we are legally required to retain.

Who else sees it

Sub-processors we rely on to run the service — hosting, email delivery, payment processing, error reporting. Each is bound by a data processing agreement and processes data only on our instructions. Write to us for the current list.

Alerts go only to the channels you configure. If you send them to a third-party service such as a chat workspace, that service receives the alert content under its own terms.

Where it is stored

Where a sub-processor operates outside the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.

Your rights

You may request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Write to [email protected]; we answer within 30 days.

You may also complain to your national data protection authority.

Cookies

The dashboard sets only the cookies it needs to work: a session cookie that keeps you signed in, and a preference cookie that remembers your language. There is no advertising or cross-site tracking, which is why this site has no consent banner.