Privacy policy
- We watch websites and servers. We don't watch people: no advertising, no trackers, no profiling, and we never sell data.
- We keep what running the service needs - your account, your monitors and their results - and delete it on a schedule.
- Data stays in the EU, except checks run from New York and Singapore, the email that passes through our backup provider in both directions, the mail you send us and what the Help assistant reads to answer you, all covered by EU safeguards.
- Delete your account yourself at any time (Account > Delete your account), and a workspace's admins can delete it; or ask us for a copy of your data, a correction or its deletion: privacy@centocular.com.
1. Who we are
Centocular is operated by MB Erven (company code 307537155, registered at Beržų al. 1, Laumėnų k., LT-53118 Kauno r., Lithuania) - “we”, “us”. You can reach us about anything in this policy at privacy@centocular.com.
We are the controller of the personal data about visitors to centocular.com, people on our waitlist and people with a Centocular account (section 3). For data our customers put into Centocular - their monitors, their status page subscribers, their team's contact details - we are the customer's processor: we handle it only on their instructions, under our data processing agreement (section 4).
2. Visiting centocular.com
Our website sets no cookies and loads nothing from other companies - the one exception is the payment page, which shows Paddle's checkout when you choose to pay (section 6). We count visits ourselves, as daily totals only: how often each page is viewed, the site a visit came from (its name), and how many different visitors came that day. That last number is worked out from your IP address and browser with a key that changes every day and is kept only in memory, so you aren't recognised the next day and your address is never stored. We do this in our legitimate interest (6(1)(f)) in knowing which of our pages are useful. Our servers record an IP address in their logs only when something goes wrong or looks like an attack (failed sign-ins, errors), to keep the service secure; these logs are kept for up to 30 days. Our web servers keep no access logs.
3. Data we are responsible for
| What | Why | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|
| Waitlist: your email address and when you joined | To invite you when your place is ready | Steps you asked for before a contract (6(1)(b)) | Until you're invited or ask to be removed, and no longer than 12 months after the public launch |
| Your account: email address, a hash of your password (Argon2 - we never see the password), your two-factor secret and recovery codes (hashed) if you turn it on, your passkeys' public keys and the names you give them if you add any, your settings (such as Simple or Advanced) | To give you the service and keep your account yours | Contract (6(1)(b)) | While your account exists; one whose address is never confirmed is removed 48 hours after signing up |
| Tips while you try Centocular: which of the few tips went to your workspace, and whether you stopped them | To send a workspace's admins up to three short tips on using Centocular during its trial, each with a link to stop them | Legitimate interest (6(1)(f)) | While your account exists |
| Sign-ins: your sessions with the IP address, browser and time of last use; browsers you trusted | To keep you signed in, show you where you're signed in, and protect against account takeover | Contract (6(1)(b)) and our legitimate interest in security (6(1)(f)) | Sessions 7 days; a trusted browser until a year after its last use |
| Whose first payment was refunded: a one-way hash of the inbox your address reaches (never the address itself) and Paddle's customer number - and what didn't work for you, if you told us | To refund a first payment once per customer, as the refund policy says; to learn what to make better | Our legitimate interest in the refund not being taken again and again, and in improving the service (6(1)(f)) | The hash and the number also after the account is deleted; what you told us 2 years, or until the account is deleted |
| Why you cancelled or left, if you told us (it's optional) | To learn what to make better | Our legitimate interest in improving the service (6(1)(f)) | 2 years; when you delete your account, what you told us then is kept without your name |
| Which inboxes have had a free trial: a one-way hash of the inbox your address reaches - never the address itself | To give the free trial once per inbox | Our legitimate interest in the trial not being taken again and again (6(1)(f)) | Also after the account is deleted |
| Audit log: what was changed in a workspace, by whom, when and from which IP address | Security, and so workspace admins can see who changed what | Legitimate interest (6(1)(f)) | 12 months |
| Your contact methods for on-call: phone numbers, email addresses, Telegram chat, ntfy topic, browser push | To page you when you're on call | Contract (6(1)(b)) | Until you remove them, or the account is deleted |
| What you ask us through Help: your messages and ours, and what the app adds so you needn't type it - your workspace and plan, the monitor you ask about with its recent results and incidents, the page and browser you asked from | To help you | Contract (6(1)(b)) | Until the account or the workspace is deleted, or 2 years after the conversation is closed |
| What you ask the Help assistant: your questions and its answers, and what it reads to answer them - your workspace and plan, its monitors with their recent results and outages, its alert channels and status pages, the page you asked from | To answer you, and to pass the conversation to us when you press "Ask a person" | Contract (6(1)(b)) | 30 days (a conversation you pass to us is kept with your request, as above); what each answer cost us, without its words, 90 days |
| Emails we send you: the address, kind of email, subject and whether it was delivered; addresses that bounced or marked us as spam | To deliver email reliably, limit abuse, and stop sending where it isn't wanted | Legitimate interest (6(1)(f)) | The record 90 days; a stopped address until it asks to receive email again |
| A paid plan: the plan, whether it's paid and until when, and Paddle's references for your workspace's customer, subscription and payments - never your card or bank details, which only Paddle sees | To keep your workspace on the plan it pays for | Contract (6(1)(b)) | While the workspace exists; what Paddle told us about payments, without your details, 13 months |
| What you write to us | To answer you | Legitimate interest (6(1)(f)) | As long as needed to help you, and no longer than 2 years |
Paid plans are sold by our reseller Paddle (Paddle.com Market Limited), the merchant of record: you give your name, billing address, tax number and payment details to Paddle, not to us, and Paddle keeps them, with the invoices, as its own privacy policy says.
4. Data our customers put in Centocular
A customer decides what to monitor and whom to tell; for that data the customer is the controller and we follow their instructions, under the data processing agreement. It includes:
- Monitors and their results - addresses, settings, responses, and for some checks the content or a screenshot of the page. If a monitored page shows personal data, it may be in a result. Raw results are kept 30 days, the results around each outage 13 months (its evidence), hourly summaries longer; all of it goes when the monitor or workspace is deleted.
- Status page subscribers - the email address or webhook of someone who subscribed to a customer's status page. Subscribing takes a confirmation, and every email has a link to unsubscribe at once.
- Alert recipients and team members - the addresses and contact methods a customer gives us to alert and page their people. Email alerts go only to addresses that confirmed they want them, each with a link to stop.
- An agency's clients - the addresses a monthly report goes to, each confirmed and with a link to stop; a client's login with its name and sign-ins; the work an agency logs for a client. They go when the agency removes them or its workspace is deleted.
- Sites an agency reviews for someone it's pitching - the site's address and what its public pages said, kept a year unless they become a client.
- DMARC reports sent to a customer's report address - the addresses of the servers sending mail as its domain, kept as daily totals for 400 days.
If you're a subscriber or recipient and want your data changed or removed, use the link in the email, or ask the organisation that runs the page - or write to us and we'll pass it on and help.
5. Cookies and storage in your browser
Only what's needed to sign you in and remember choices you made - no tracking, so no cookie banner:
| Name | What it does | Lasts |
|---|---|---|
centocular_session | Keeps you signed in | 7 days |
centocular_device | Remembers a browser you've signed in from, so a lockout of your account after attacks doesn't lock you out | 1 year |
| Sign-in steps | The two-factor step, and returning you to the page you opened after signing in | 5-15 minutes |
| Private status page | Remembers you entered a private status page's password | 30 days |
| Paddle's checkout | On the payment page only, when you choose to pay: what Paddle's checkout needs to take the payment, under Paddle's own policies | Paddle's to say |
| Browser storage | Your choices of light or dark, Simple or Advanced, and how the overview and the monitors list are shown | Until you clear it |
| Browser session storage | During sign-in, the address you typed (to offer another confirmation email) and whether you chose a recovery code; whether the extra menu tabs are open | Until you close the tab |
6. Who else handles data
We use a few providers to run Centocular, each bound by a data processing agreement:
| Provider | For | Where |
|---|---|---|
| DigitalOcean, LLC | Servers and storage | Frankfurt (Germany) and Amsterdam (Netherlands); checks also run from New York (USA) and Singapore |
| Scaleway SAS (Transactional Email) | Sending our email | Paris (France) |
| ActiveCampaign, LLC (Postmark) | Sending our email when Scaleway can't (a backup) | USA |
| Anthropic, PBC | Answering the questions you ask the Help assistant (only when you use it) | USA |
| Google Ireland Limited (Google Workspace) | Our mailbox: email you send to our addresses | Ireland; Google's data centres also outside the EU |
Paddle.com Market Limited (UK) sells our paid plans and takes the payments as merchant of record, so it's responsible for the payment data you give it, under its own privacy policy, rather than handling data for us. Backups are also kept on our own server in Lithuania. When you connect Slack, Telegram, PagerDuty, Twilio or another service to Centocular, what we send there is handled under that service's terms with you. Browser notifications travel through your browser maker's push service, encrypted so that service can't read them. The current list of providers is in the data processing agreement, and we announce changes before they happen.
7. Outside the EU
Checks run from New York and Singapore receive what's needed to check - the address and the request's settings - and send back the result. Our backup email provider, Postmark, is in the USA, and replies to our support email and DMARC reports reach us through it; our main one, Scaleway, is in France. What you ask the Help assistant, and the workspace data it reads to answer, goes to Anthropic in the USA. Paddle is in the UK, which the EU recognises as protecting personal data adequately. Mail you send to our addresses is kept in Google Workspace, which may hold it in Google's data centres outside the EU. The transfers outside the EU rely on the EU Standard Contractual Clauses and, for the USA where the provider is certified, the EU-US Data Privacy Framework.
8. Keeping it safe
Everything travels encrypted (TLS). Passwords are hashed with Argon2; sessions, API tokens, and the links we email to sign up, reset a password or join a workspace are stored hashed. Two-factor sign-in is available and a workspace can require it. Access within a workspace follows roles, and changes are audited. The database is backed up daily, and a standby in a second data centre can take over. More in annex 2 of the data processing agreement.
9. Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to limit what we do with it, to receive it in a portable format, or object to our processing based on legitimate interest. Write to privacy@centocular.com; we answer within one month. You can delete your account yourself (Account > Delete your account) - with it, the workspaces you're the only member of - and a workspace's admins can delete the workspace (Administration > Delete workspace); or ask us the same way and we'll do it within that month. When an account is deleted, what stays in workspaces it was part of no longer names it: it reads "a deleted account".
You can also complain to a data protection authority - in Lithuania the State Data Protection Inspectorate (vdai.lrv.lt), or the authority where you live or work.
10. When data goes
When a workspace is deleted, its monitors, results, status pages and subscribers are deleted with it at once. Backups that still contain them are overwritten within 30 days. A workspace on a trial or the free plan that nobody has signed in to for 12 months is deleted the same way, after its admins are told by email at least 14 days before.
11. Children
Centocular is a service for businesses and not meant for anyone under 16.
12. Changes
We'll post any change here with a new date. If a change matters to how we use your data, we'll tell account holders by email before it takes effect.