Privacy Policy

1. Data we collect

Account data: your email address, a password hash (when you sign up with a password), email verification and last sign-in timestamps, and your marketing email preference. When you sign in with Google, Google shares your name, email and profile picture with us; we store only your email address.

Organization data: the organization name, members and their roles, language and currency preferences, plan, trial dates and billing status.

Monitoring data: the monitors you create (name, schedule, grace period, alert settings) and each check-in your jobs send: time received, status, duration, exit code, the optional message and metrics in the JSON payload, the source IP address and the user agent of the request.

Alert destinations: the email addresses, Slack and Microsoft Teams webhooks, custom webhook URLs and WhatsApp numbers you configure. Integration secrets are stored encrypted.

Billing data: payments are processed by Stripe. We receive the customer and subscription identifiers, the plan, the amount and the renewal date. We never see or store your full card number.

Website usage: when you open the home page we record the address visited, the referrer, the IP address, the user agent, the browser language and a hashed device identifier, to count visits and fight abuse. If Google Analytics is enabled on the site, it collects usage data under Google's own policy.

2. Why we use it

To provide the service you signed up for (performance of a contract): authenticate you, run your monitors, detect late or failed runs and send the alerts you configured.

To bill paid plans and keep tax and accounting records (legal obligation and contract).

To keep the service secure and stable, prevent abuse and fix problems (legitimate interest).

To send product news, only if you opted in (consent). You can opt out at any time.

3. Who we share it with

We do not sell personal data. We share it only with providers that help us run the service, under contract and only for that purpose: Google (sign-in and, if enabled, analytics), Stripe (payments), SendGrid (email delivery), Twilio (WhatsApp alerts, when you enable them) and our hosting provider.

Alerts are delivered to the destinations you configure (Slack, Microsoft Teams, webhooks, WhatsApp). Once delivered, that content is also subject to the policies of those destinations.

We may disclose data when required by law or by a court order.

Some of these providers process data outside Brazil, including in the United States. In those cases we rely on the safeguards allowed by the LGPD, such as contractual clauses.

4. How long we keep it

Check-in and event history: 7 days on the Free plan and 365 days on Orbital. Older records are deleted automatically.

Alert deduplication records: 7 days. Home page visit records: 90 days. Synthetic check results: 90 days.

Account, organization and monitor settings: while your account is active. When you ask us to delete your account, we delete it within 30 days, except for records we must keep by law, such as billing records.

Backups: we keep an encrypted daily backup of the database on a server controlled by C&T Digital Tech, separate from the production server. Each backup is kept for up to 14 days (daily copies) or 8 weeks (weekly copies) and is then deleted, so deleted data disappears from backups within that period.

5. Security

Traffic to the site and the API uses HTTPS. Passwords are stored as hashes, integration secrets and backups are encrypted, and access to production systems is restricted to the people who operate the service. No system is completely secure; if a breach affects your data, we will notify you and the authorities as required by law.

6. Cookies and local storage

We use strictly necessary cookies to keep you signed in and to protect the Google sign-in flow. The site also stores a short-lived marker in your browser's session storage to avoid counting the same visit twice. If Google Analytics is enabled, it sets its own cookies.

7. Your rights

You can ask us to confirm whether we process your data, access it, correct it, export it, delete it, or object to or restrict its use, and you can withdraw consent you gave. You can also file a complaint with the Brazilian Data Protection Authority (ANPD) or your local authority.

Many settings can be changed directly in the app. For anything else, email us and we will reply within 15 days.

Our Data Protection Officer (Encarregado, under article 41 of the LGPD) is João Thomazinho, reachable at support@cronobserver.com.

8. Children

CronObserver is a tool for professionals and is not intended for anyone under 18.

9. Changes to this policy

We may update this policy. When a change is significant, we will notify account owners by email before it takes effect. The date at the top shows the latest version.