Privacy Policy

1. Who is responsible

The data controller for the personal data described in this policy is Alexandros Kyrlis, a sole proprietorship trading as Netlayer (“Netlayer”), Eleftheriou Venizelou 31, 16675 Glyfada, Greece (General Commercial Registry no. 008078401000, VAT no. EL121157554). For anything about your personal data write to privacy@pingwise.com.

This policy covers pingwise.com, app.pingwise.com, the API, status pages we host, the emails and alerts we send, and the probe fleet. It applies to visitors, people who sign up, people invited into an account, people who subscribe to a status page, and people who use the free tools on our website.

Where a customer uses PingWise to process other people’s data (for example the email addresses of their status page subscribers), the customer is the controller and we are the processor. That relationship is governed by our Data Processing Agreement, and the customer’s own privacy policy tells those people what happens to their data.

2. What we collect and why

2.1 Account

Email address, password (stored only as a salted hash), optional display name, two-factor authentication secret and recovery codes (encrypted), account and organisation name, time zone, the date you joined, and the roles of the people you invite. If you sign in with Google, GitHub or Microsoft, that provider gives us your email address and name; we keep no tokens from it and can read nothing else there. A passkey, if you add one, is stored as its public key only. Purpose: to create and secure your account, to log you in, and to contact you about the Service. Basis: performance of our contract with you (GDPR art. 6(1)(b)); security measures are also our legitimate interest (art. 6(1)(f)).

We also record where you came from when you signed up: the page on pingwise.com you were on and, if you arrived through one of our advertisements, that ad’s identifier and the campaign parameters in its link. These values travel in the sign-up link itself; no cookie is set and nothing is stored in your browser. They are kept on your user record, are seen only by our staff (per user, and as counts by page and ad), are never shared, and are deleted with your user. Purpose: to measure which pages and ads bring sign-ups. Basis: legitimate interest (art. 6(1)(f)); you can object (section 7) and we will clear the values.

2.2 Monitors and configuration

The URLs, hostnames, IP addresses, ports, keywords, request headers and bodies, expected responses, intervals, maintenance windows and other settings of the monitors you create, plus heartbeat URLs and the domains you watch for expiry. Most of this is not personal data, but a URL or a custom header can contain some, and you decide what you put there. We advise against putting personal data or long-lived secrets in monitor configuration where a short-lived token would do. Purpose: to run the checks you asked for. Basis: contract.

2.3 Check results and incidents

For every check: which probe ran it, when, the outcome, timing, status code, a short error description and, during Alert mode, diagnostic details such as DNS answers, TLS certificate facts and network path measurements towards your target. We never store the body of your pages beyond what is needed to evaluate a keyword or an error page in the moment. From results we derive incidents, uptime figures and hourly statistics. Purpose: to confirm outages, alert you, show you history, and bill credits. Basis: contract; keeping aggregated statistics longer is our legitimate interest in showing you a year of history and in demonstrating how the Service performs.

2.4 Alert channels and deliveries

The email addresses, Telegram chat identifiers, webhook URLs and other channel details you configure, the rules you set for them, and a log of every alert we sent: when, to which channel, whether it succeeded, and the provider’s response. Purpose: to deliver alerts and to prove to you that they were delivered. Basis: contract.

2.5 Credits, purchases and billing

Your credit balance and every movement in it; for each purchase the pack, amount, currency, tax and time, the IP address from which it was started, and the name, email address, country, business name and VAT number that Link collects at checkout and passes to us, with the Stripe identifiers of the payment and of the invoice Link issued. We do not receive or store your card number; Stripe does. Credits are sold through Link, LLC, a Stripe company: for the data Link and Stripe collect on their checkout page they are independent controllers under their own privacy notices, and you may choose to create a Link account there. Purpose: to credit your purchase, to keep the accounting records the law requires, and to prevent fraud. Basis: contract; legal obligation for accounting records (art. 6(1)(c)); legitimate interest for fraud prevention.

2.6 Integrations

Credentials you give us for other services (Cloudflare API tokens, hosting-panel API keys, read-only keys of another monitoring service when you import monitors) and the identifiers of the sites, zones and organisations those services report back. If you ask for the 14-day comparison, also the alerts that service reports for the monitors you imported. Credentials are stored encrypted and used only for the feature you turned on. Basis: contract.

2.7 Status pages and subscribers

The page configuration, branding, announcements and custom domain you set; for each subscriber the email address, the confirmation token, the time of confirmation and unsubscription, and a log of the notices we sent and bounces or complaints we received. We also keep ordinary web server logs for status page visits (section 2.10). For subscriber data the customer who owns the page is the controller and we act under the Data Processing Agreement.

2.8 Free tools on the website

When you use “Is it down?”, the Cloudflare check, the TTFB, port or SSL checker or similar tools that run from our probes, we store the address, port or domain you entered, the results from each probe, your IP address and the time. The IP is used to limit how often one visitor can run checks and to stop abuse. Results are kept for 7 days so the link you get can be shared. For the lookups that run on our central server only (DNS, redirects, domain expiry) we keep your IP address and the time for one hour, for the same rate limit, and do not store what you entered. Basis: legitimate interest in offering the tool and protecting the targets being checked.

2.9 Waitlist, contact and support

If you leave your email to join the waitlist, we store it with the time, your IP address and the confirmation of your address, and we email you about your invitation. If you write to us, we keep the correspondence. Basis: consent for the waitlist (you can withdraw it by replying “stop” or using the link in the email); legitimate interest in answering you and keeping a record of what was agreed.

2.10 Technical logs and security

Our servers and our edge provider (Cloudflare) log requests: IP address, time, URL, user agent, response code, and for logged-in requests the account. Cloudflare Turnstile protects forms against bots and may set a cookie and process your IP and browser characteristics for that purpose. We keep records of logins, failed logins and security-relevant actions in your account. Basis: legitimate interest in running a secure service and in defending against abuse; legal obligation where the law requires logs.

2.11 Website visit statistics

To see how many people visit pingwise.com and which pages they read, the website (not the application) runs Matomo on a server we operate ourselves (analytics.hostbox.gr). It sets no cookies and stores nothing in your browser. For each page view it records the page, the referring site, the time, the browser, operating system and screen size, and the country and city derived from your IP address; the IP address itself is anonymised before it is stored. It also records how long the page stays open in a focused tab, how far down it is scrolled, and whether the price calculator, the price comparison or a sign-up button on the page was used, so that we can tell visits that read a page from visits that leave at once. Raw visit records are deleted after 6 months; aggregated reports are kept. The data is not shared with anyone and is not combined with your account. Basis: legitimate interest in understanding how our website is used. You can opt out by enabling “Do Not Track” in your browser.

2.12 What we do not do

We do not use advertising scripts on our website or application, the application has no analytics, we do not build profiles of you, we do not make automated decisions with legal effect about you, and we do not sell or rent personal data to anyone.

3. Cookies and local storage

We use only cookies that are needed for the Service to work, so we do not show a cookie banner:

Our website loads the fonts Outfit and JetBrains Mono from Google Fonts. When your browser fetches them, Google receives your IP address and the usual request headers. Google says it does not use this to set cookies or to track users, but it is a transfer to a US company; see section 6. The application does not load anything from Google.

4. How long we keep data

5. Who else sees your data

We use a small number of companies to run the Service. Each one processes data on our instructions, under a contract that meets GDPR article 28, and only to the extent needed for its job.

The probes see only what is needed to check a target: the address, the request you configured, and the response. They do not hold account data. What leaves the EU through them is the check traffic to your target and the result of that check.

Alert channels you configure (for example Telegram or a webhook endpoint) receive the alert content you asked us to send them; they are your choice and not our processors.

We disclose personal data to authorities only when the law requires it, and we tell you unless we are legally prevented from doing so. If Netlayer is sold or merges, your data may pass to the successor under this policy, and we will tell you before that happens.

6. Transfers outside the European Economic Area

Probes in the USA, Brazil, Japan, South Africa, Singapore, the United Kingdom, Australia, the United Arab Emirates and India, and providers based in the USA (Cloudflare, Postmark, Google, Link, LLC and Stripe, Inc.), mean that some data leaves the EEA. For a purchase, we pass your email address and the pack you chose to Stripe to open the checkout; what you enter on the checkout page goes to Link and Stripe directly, as independent controllers. Where it does, we rely on an adequacy decision of the European Commission (United Kingdom, Japan, Switzerland; the EU–US Data Privacy Framework for certified US companies) or on the Commission’s Standard Contractual Clauses with additional safeguards such as encryption in transit and at rest. For the United Arab Emirates and India, which have no adequacy decision, the probe traffic is covered by Standard Contractual Clauses with the provider, and the probes there hold no account data: they see the target address, the request you configured and the response, and nothing else. You can ask privacy@pingwise.com for a copy of the relevant safeguards.

7. Your rights

Under the GDPR you can ask us to:

• access the personal data we hold about you and get a copy;
• correct it where it is wrong (most of it you can edit yourself in the application);
• delete it (you can delete your account yourself; we must keep tax records regardless);
• restrict or object to processing based on legitimate interest;
• receive the data you gave us in a machine-readable format (your monitors can be exported from the application and the API);
• withdraw consent where processing is based on it, without affecting what was done before.

Write to privacy@pingwise.com from the email address on your account, or from any address with enough information for us to confirm who you are. We answer within one month; if a request is complex we may take up to two more months and will tell you why.

You also have the right to complain to a supervisory authority. Ours is the Hellenic Data Protection Authority, Kifissias 1-3, 11523 Athens, www.dpa.gr. You may complain to the authority of the EU country where you live instead.

8. Security

All traffic to our website, application, API and probes is encrypted with TLS. Credentials for integrations and two-factor secrets are encrypted at rest; passwords are hashed. Administrative access to our servers uses SSH with key-only authentication (no password logins), rate limiting and automated blocking of repeated attempts, and the application is protected by Cloudflare. Backups are encrypted before they leave the server. Access to production data is limited to the people who need it to run the Service. If a breach of security affects your personal data and is likely to put your rights at risk, we will tell you and the supervisory authority without undue delay, as the GDPR requires.

9. Children

The Service is not meant for people under 16, and we do not knowingly collect their data. If you think a child has given us personal data, tell us and we will delete it.

10. Changes to this policy

When we change this policy we update the date at the top. For changes that affect how we use your data in a way you would not expect, we email account holders beforehand. Earlier versions are available on request.

Contact

Netlayer · Eleftheriou Venizelou 31, 16675 Glyfada, Greece
Privacy questions and requests: privacy@pingwise.com
Everything else: hello@pingwise.com