Privacy Policy

This Privacy Policy explains how MASA Ventures Ltd ("MASA Ventures", "we", "us", "our") collects and uses personal data when you use SREmonitor at sremonitor.io (the "Service"). MASA Ventures is the data controller for the personal data described below.

1. Data we collect about you

When you use SREmonitor, we collect:

• Account data — your email address and authentication details, handled by our authentication provider (Clerk). We never see or store your password.
• Billing data — if you upgrade to Pro, your subscription status and a Stripe customer/subscription reference. Your card details are entered directly into Stripe and never reach our servers.
• Site data you provide — the URLs and labels of the websites you ask us to monitor.
• Google Search Console data — only if you choose to connect it. We store an OAuth refresh token, encrypted at rest, so we can pull Core Web Vitals and search performance figures for the site you connected. You can disconnect this at any time.
• Usage and support data — basic account activity (such as scans run) and anything you tell us directly if you contact us for support.

We do not collect personal data about the visitors to the websites you monitor. Our checks measure how your site performs and what its publicly published pages say — they don't read or store personal data belonging to your end users.

2. How we use your data

• To create and maintain your account, and authenticate you when you sign in;
• To run the uptime, Core Web Vitals, and compliance checks you've asked us to run, and show you the results;
• To process payments and manage your subscription;
• To send you service-related communications, such as account or billing notices;
• To maintain the security and reliability of the Service;
• To comply with our legal obligations.

3. Our legal basis for processing

We process your account, billing and site-monitoring data because it's necessary to perform our contract with you (providing the Service you've signed up for). We process limited technical data to keep the Service secure and working properly under our legitimate interest in running a reliable product, balanced against your rights. Where we ever rely on consent — for example for optional integrations like Google Search Console — you can withdraw it at any time.

4. Who we share data with

We share data with a small number of service providers who help us run SREmonitor, each acting under their own data protection obligations:

• Clerk — authentication and account management;
• Stripe — payment processing and subscription billing;
• Vercel — application hosting;
• Amazon Web Services (AWS) — runs the automated scan workers (uptime checks, Core Web Vitals audits, compliance scans) and, together with our database provider, stores your account and monitoring data;
• OpenAI — analyses the publicly available policy text from your monitored sites to help generate compliance scores and recommendations;
• Google — only if you connect Google Search Console, to retrieve performance data for your verified property.

We don't sell your personal data, and we don't share it with third parties for their own marketing purposes.

5. International transfers

Some of the providers listed above may process data outside the UK or European Economic Area, including in the United States. Where that happens, we rely on appropriate safeguards, such as those providers' own standard contractual clauses or equivalent transfer mechanisms, to protect your data.

6. How long we keep your data

We keep account and monitoring data for as long as your account is active. If you close your account or stop monitoring a site, we delete or anonymise the associated monitoring data within a reasonable period, except where we need to keep limited records (for example, billing records) to meet our legal or accounting obligations.

7. Your rights

Under UK GDPR, you have the right to access the personal data we hold about you, ask us to correct it, ask us to delete it, restrict or object to certain processing, and request a portable copy of the data you've given us. Many of these — like removing a monitored site or disconnecting Google Search Console — you can do yourself directly from your dashboard. For anything else, contact us using the details below.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we haven't handled your data properly, though we'd appreciate the chance to put things right first.

8. Cookies

We use only the cookies strictly necessary to keep you signed in and your dashboard working, set by our authentication provider, Clerk. We don't use advertising or third-party tracking cookies.

9. Security

We use reasonable technical and organisational measures to protect your data, including encrypting sensitive tokens (such as Google Search Console refresh tokens) at rest and relying on established providers (Clerk, Stripe) for the most sensitive parts of authentication and payment handling, so we never hold your password or full card details ourselves. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

10. Children's privacy

SREmonitor is a business tool and is not directed at, or intended for use by, children. We don't knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll take reasonable steps to let you know before they take effect.

12. Contact us

For any question about this Privacy Policy or to exercise your data protection rights, email us at privacy@sremonitor.io.