Privacy Policy

1. Introduction

Welcome to Stillpoint (“Platform”, “we”, “us”, or “our”), operated by •[LEGAL_ENTITY_NAME] (“Company”). We are committed to safeguarding the privacy of our registered users, website visitors, and organizations utilizing our synthetic uptime monitoring, SSL certificate surveillance, and incident alerting services.

This Privacy Policy explains how personal data is collected, handled, and safeguarded when you create an account, configure synthetic monitors, visit our marketing website, or integrate our APIs. It also details the technical operational data generated when our distributed probe nodes execute automated synthetic health checks against endpoints you submit for monitoring.

2. About Website Health Monitor

Stillpoint is a software-as-a-service (SaaS) observability platform designed for software engineers, site reliability teams, devops practitioners, and online business owners. The Platform enables subscribers to schedule automated, recurring synthetic HTTP/HTTPS health checks, monitor SSL/TLS certificate validity dates, measure DNS resolution latencies, and receive incident notifications across email and webhook channels.

In delivering these services, Stillpoint acts primarily as an independent Data Controller regarding your user account, billing, and profile information, and as a technical Data Processor regarding the endpoint surveillance telemetry and server diagnostics collected on your behalf.

3. Information We Collect

We collect both personal data directly provided by you and technical machine telemetry generated automatically during service execution.

A. Account and Profile Information

• Full Name and Email Address: Collected upon account registration to authenticate your identity and dispatch critical outage alerts.
• Authentication Credentials: Passwords stored strictly as salted, one-way bcrypt cryptographic hashes; session refresh tokens stored as cryptographically hashed identifiers.
• Organization and Workspace Details: Optional team or company name, default operational timezone, and localized configuration preferences.
• API Credentials: User-generated secret API keys for programmatic status automation and integrations.

B. Billing and Subscription Information

• Subscription Tier: Free, Pro, or Business subscription records, billing frequency (monthly or annual), plan status, and lifecycle timestamps.
• Payment Gateway References: Masked payment method metadata, transaction timestamps, and payment gateway references provided by authorized processors (such as Razorpay or Stripe). We do not store raw credit card numbers or banking passwords on our servers.
• Invoicing Details: Business billing address, state, postal code, and applicable GSTIN or tax identification numbers supplied for invoicing compliance.

C. Monitored Target URLs and Endpoint Metadata

• Target Endpoint Specifications: Destination URLs, hostnames, IP addresses, custom port numbers, and monitor friendly names configured in your workspace.
• Synthetic Configuration Parameters: Selected check intervals (30s, 60s, 5m), request timeout thresholds, HTTP methods (GET, HEAD, POST), redirect following toggles, and SSL verification preferences.

D. Synthetic Telemetry and Monitoring Results

• HTTP Response Metrics: HTTP status codes (e.g., 200 OK, 503 Service Unavailable), total response latency in milliseconds, and network socket error messages.
• SSL/TLS Certificate Attributes: Certificate validity start/expiration timestamps, issuing Certificate Authority (CA) chain details, and subject alternative domain names.
• DNS and Network Diagnostics: Public DNS resolution timings, resolved IP addresses, probe region identifiers, and consecutive check failure logs.

E. System Logs and Usage Analytics

• Access and Security Logs: Internet Protocol (IP) addresses, browser user-agent headers, timestamped access logs, and failed authentication attempts recorded for brute-force prevention.
• Audit Trail Events: Workspace audit logs documenting monitor creations, pauses, threshold changes, and user profile adjustments.

4. How We Collect Information

We obtain information through three primary mechanisms:

1. Direct User Interaction: Information you voluntarily input during account signup, profile edits, monitor configuration, billing transactions, or customer support communications.
2. Automated Synthetic Probing: Routine, automated network requests initiated by our synthetic monitoring worker nodes directed to the public target URLs you configure.
3. Platform Telemetry and Session Cookies: Automated server logs and essential session tokens generated as you navigate the web application dashboard.

5. How We Use Your Information

We process personal and technical information strictly for lawful, legitimate business operations, including:

• Core Service Delivery: Executing scheduled health probes, computing uptime percentiles, and maintaining live incident status timelines.
• Outage Alerting and Escalation: Dispatching real-time email notifications and webhook payloads when configured endpoints transition between operational and degraded states.
• Billing Administration: Calculating subscription renewals, generating tax-compliant commercial invoices, and processing subscription tier transitions.
• Platform Security and Abuse Prevention: Enforcing rate limits, detecting Server-Side Request Forgery (SSRF) attempts, preventing probe infrastructure misuse, and mitigating unauthorized account intrusion.
• Platform Engineering: Diagnosing distributed probe latency, refining multi-node consensus algorithms, and debugging system errors.
• Statutory and Legal Compliance: Complying with financial recordkeeping obligations, responding to lawful governmental processes, and enforcing our Terms of Service.

6. Website Monitoring and Technical Data

When you register a target URL for uptime monitoring, our synthetic monitoring infrastructure executes automated network requests from designated regional probe servers. These synthetic probes:

• Send automated HTTP or HTTPS requests accompanied by a designated identification header (e.g., User-Agent: WebsiteHealthMonitor/1.0).
• Query authoritative public DNS servers to resolve domain name system address records.
• Negotiate TLS/SSL handshakes to inspect publicly broadcasted X.509 certificate expiry parameters.
• Do not scrape private customer database records, execute intrusive vulnerability exploits, or harvest end-user browsing data from the monitored website.

You warrant and represent that you have legal authority to monitor all target endpoints entered into your workspace, as strictly mandated under our Acceptable Use Policy.

7. Cookies and Similar Technologies

We employ cookies and browser local storage mechanisms essential for session authentication, CSRF defense, and interface preference retention.

We distinguish between strictly necessary authentication cookies (which are required for account login and platform operation) and optional functional or analytics cookies. Detailed cookie classifications, retention intervals, and preference controls are set forth in our dedicated Cookie Policy.

8. Third-Party Services and Integrations

To maintain reliable, 24/7 global monitoring operations, we engage vetted third-party vendors for specialized infrastructure services:

• Cloud and Hosting Infrastructure: Virtual private cloud compute, container hosting, and managed PostgreSQL database infrastructure.
• Transactional Email Services: Automated transactional email relay providers utilized exclusively to deliver outage notifications, password reset emails, and account security notices.
• Customer Notification Gateways: External notification endpoints explicitly authorized by you, including Slack, Discord, Telegram, or custom webhooks.

All third-party service providers are contractually bound to process data solely in accordance with our instructions and under strict confidentiality and security standards.

9. Payment Processing

Paid subscriptions (Pro and Business tiers) are billed in INR or applicable local currencies through authorized, PCI-DSS Level 1 compliant payment gateways (such as Razorpay or Stripe).

Your sensitive payment details (such as full credit/debit card numbers, CVV codes, or netbanking credentials) are captured directly by the payment processor and are never stored or transmitted through our application servers. The payment processor provides us with an anonymized transaction identifier, masked card expiration year, payment status, and order reference to fulfill your subscription.

10. Data Storage and Security

We maintain rigorous technical, administrative, and organizational safeguards designed to protect personal data and monitoring telemetry against unauthorized disclosure, alteration, loss, or destruction:

• Encryption in Transit: All data transmitted between your browser and our platform, as well as data exchanged between our probe nodes, is encrypted using modern TLS 1.3 / HTTPS encryption.
• Credential Hashing: User passwords are encrypted using one-way adaptive bcrypt hashing with robust work factors. Passwords cannot be decrypted or viewed by platform personnel.
• SSRF and Network Protection: Monitored URLs undergo pre-flight SSRF inspection, resolving against prohibited private RFC-1918 subnets and cloud metadata endpoints to prevent internal probe manipulation.
• Role-Based Access: Administrative access to database clusters is strictly limited to authorized engineering personnel using multi-factor authentication and principle of least privilege.

While we implement industry-standard safeguards, no internet transmission or electronic storage architecture is unconditionally impervious. Subscribers are responsible for maintaining strong unique passwords and securing their access tokens.

11. Data Retention

We retain data only as long as necessary to fulfill the purposes detailed in this policy:

• Account Data: Retained for the duration of your active account subscription. Upon account deletion, user profile records and workspace configurations are permanently purged or anonymized.
• High-Frequency Check Results: Detailed individual synthetic check records (latencies and HTTP status codes) are retained on a rolling window basis (typically 30 to 90 days depending on your subscription tier) before being consolidated into aggregated statistical averages.
• Incident History: Incident logs and timeline annotations are preserved throughout the lifecycle of your active monitor to supply historical availability reporting.
• Financial Records: Invoices, transaction identifiers, and tax records are preserved for statutory periods mandated under applicable tax and commercial bookkeeping laws (typically 7 years).

12. Sharing and Disclosure of Information

We do not sell, rent, monetize, or trade your personal data or monitoring results to advertising brokers or data aggregators.

We disclose information solely under the following limited circumstances:

• With Your Consent: When you elect to publish a public Status Page, the names and uptime status of designated monitors become publicly visible on the internet.
• Subprocessors and Infrastructure Vendors: To vetted technology providers who assist in hosting, database administration, payment settlement, and email dispatch under strict confidentiality agreements.
• Legal and Statutory Compliance: When compelled by valid legal process, judicial summons, or applicable regulatory mandates issued by competent law enforcement bodies.
• Corporate Reorganization: In connection with any merger, acquisition, corporate restructuring, or asset sale, subject to standard confidentiality protections and notice provisions.

13. International Data Transfers

Stillpoint operates globally distributed synthetic probe nodes to evaluate website availability from diverse geographic regions. Consequently, technical synthetic probe metrics may be processed across multiple cloud jurisdictions.

Where personal account information is transferred internationally outside your country of residence, we implement appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent statutory cross-border transfer agreements, ensuring your data receives equivalent levels of protection.

14. User Rights and Privacy Requests

Depending on your jurisdiction (including the European Economic Area, the United Kingdom, India, and California), you may be entitled to statutory privacy rights regarding your personal data:

• Right of Access: You may request a confirmation of whether we process your personal data and obtain a readable copy of that information.
• Right to Rectification: You may update or correct inaccurate or incomplete profile data directly in your account settings or by contacting our team.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal account data, subject to legitimate legal and statutory retention requirements.
• Right to Restriction and Objection: You may object to or request restrictions on certain processing activities where applicable under statutory law.
• Right to Data Portability: You may request an export of your account configuration and monitor metadata in a structured, machine-readable format.
• Grievance Redressal (India DPDP Act): If you are located in India, you have the statutory right to nominate a representative and submit privacy grievances to our designated Grievance Officer.

To exercise any of these rights, submit a written request via our Contact Page or email •[PRIVACY_EMAIL]. We verify identity prior to fulfilling requests and respond within the statutory timeframes established by applicable law (typically 30 calendar days).

15. Account Deletion and Portability

Subscribers may terminate their account and request complete data purging at any time. When an account is terminated:

• All active synthetic monitoring probes associated with the account are immediately halted.
• Configured monitor URLs, alert escalation rules, and notification endpoints are deactivated.
• Personal profile records and telemetry logs are scheduled for permanent deletion from active database tables within thirty (30) days, except where retention is legally required for financial audits.

16. Children’s Privacy

Stillpoint is a professional developer SaaS platform intended exclusively for commercial, organizational, and adult use. We do not knowingly solicit, collect, or process personal data from individuals under eighteen (18) years of age (or the applicable age of majority in your jurisdiction).

If we discover that an individual under the age of majority has provided personal data without verified parental consent, we will take immediate steps to delete such information from our records.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect technological advancements, platform feature releases, or evolving statutory compliance mandates.

When material modifications occur, we will provide advance notice via platform dashboard banners, email notifications to registered account holders, or by updating the “Last Updated” date at the top of this document. Continued use of Stillpoint following the effective date of an updated policy constitutes your acknowledgment of the revised terms.

18. Contact Information

For privacy inquiries, statutory rights requests, or questions regarding our data governance protocols, contact our team through the following designated channels: