Privacy Policy

Data	Purpose	Legal basis	How long
Account and workspace details, monitors and alert data	Provide accounts, shared monitoring, alerts and service notices	Contract	Account data until account deletion; workspace data until workspace deletion
Sign-in and SSO records and settings	Complete and secure sign-in and keep you signed in	Contract	Temporary records for minutes; sessions until sign-out or expiry; SSO settings until changed or workspace deletion
Stripe ids, plan and status, and any company name and VAT number given at checkout	Manage your plan and billing	Contract; legal obligation for required retention	Until workspace deletion, or longer where the law requires
Your email address for Netonica news	Send Netonica news	Legitimate interests in keeping customers informed	Until account deletion
Workspace activity records	Show who changed what and keep accountability and security evidence	Contract; legitimate interests in workspace accountability and security	Until older than the longest history any plan shows, or workspace deletion
Usage analytics from your browser and our servers, without cookies	Measure how people find and use Netonica and improve it	Legitimate interests in understanding and improving Netonica	1 year
Usage analytics after analytics consent, linked across visits, including session recordings	Understand returning visits and how people use Netonica	Consent	1 year; recordings 30 days
If you accept advertising cookies: Reddit's and Google's cookies, and what their tags send them from your browser about your visit	To learn which of our ads bring visitors and customers, and show our ads to past visitors	Consent	We keep none of it; Reddit and Google keep it under their own privacy policies (Reddit's, Google's)
Technical logs, including email and IP addresses and targets checked	Run and secure Netonica, stop abuse and fix faults	Legitimate interests in service operation and security	Up to 30 days

An email address is required for an account. Other information is optional, but features cannot work without the information they need. News emails have an unsubscribe link. If you sign in through Google, Microsoft or your company's identity provider, it tells us who you are; we keep only your email address.

Workspace members see each other's email addresses. We record activity on all plans. Plans that show the log let current and future members view and download it, including former members' email addresses until entries expire. Downloaded copies belong to the workspace and fall outside these time limits.

We use PostHog to understand how Netonica is used, from your browser and from our servers. We collect your browser information, your IP address and the location it suggests, the pages you visit, how you reached them, and what you do on them or through our API. Without analytics consent, PostHog stores nothing in your browser and links your visits for a day at most. With it, cookies link your visits and sessions may be recorded. Once you sign in, this links to your account and workspace.

We scan hosts, URLs and domains users name and public addresses we find for research. Scans record public certificates, DNS records, response headers, MCP server listings and payment quotes. These can include personal data, such as names in certificates or email addresses in DNS records.

We rely on legitimate interests: users' interest in watching systems they rely on and ours in recording how internet systems change. We keep scan history indefinitely for statistics and research. Published results omit personal data found in scans and do not show who monitors what.

You can object or ask us to stop scanning your systems at support@netonica.com; the scanner page explains how. We may stop scanning, but keep earlier results because deleting parts would defeat the record's statistical and research purpose.

These providers work for us under data processing agreements:

Provider	Role	Location
Railway	Application and working databases	EU (Netherlands)
Neon	Main database	EU (Frankfurt)
Bunny	Website delivery	EU company; servers worldwide
Resend	Email	EU (Ireland)
PostHog	Usage analytics and consented session recordings	EU (Frankfurt)

Browsers reach PostHog through x.netonica.com, its proxy on our domain, which Cloudflare runs for it. Some providers are US companies. For data leaving the EU, we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards.

Link, a Stripe company, sells paid plans and takes payments, in the EU and the US, as a separate controller under its own privacy policy. We receive only the billing details in section 1. Webhook and Slack alerts go wherever you point them. The workspace chooses your company's identity provider under its own agreement with that provider. It is not one of our providers. Google and Microsoft, when you sign in with them, work under your own agreement with them.

When DNS checks run, Cloudflare's and Google's public resolvers see the domain being looked up.

If you accept advertising cookies, Reddit, Inc., in the US, and Google Ireland Limited, with Google LLC in the US, receive what section 1 lists under them. We and each of them together decide to collect it on our pages and send it to them, so for that step we are joint controllers, and you can ask either of us about it. What each then does with it falls under its own privacy policy (Reddit's, Google's). It leaves the EU under the EU-US Data Privacy Framework, in which Reddit, Inc. and Google LLC take part.

We share data with authorities when required by law, and with authorities or affected parties when needed to stop abuse, fraud or harm. If another company takes over Netonica, your data passes to it under this policy.

On request, we delete your account, your workspaces and their monitoring and activity data. Log and backup copies expire within 30 days. Statistics that identify no one remain.

Activity entries stay after a member leaves or is removed, until they expire. When we delete your account, entries in workspaces you did not own remain without naming you.

Removing a monitor stops it and hides its history. Its records remain until workspace deletion. Scan history stays under section 2.

No third party reads our own cookies:

Our cookie	Purpose	Lifetime
Sign-in session	Keep you signed in	The session
Cookie choice	Remember your choice, then ask again	6 months
Free check	Retrieve a check's answer	As long as the answer is kept, a short time
SSO sign-in	Complete and secure SSO sign-in	Minutes
Remembered SSO workspace	Offer the same SSO sign-in again	1 year
Theme	Keep the light or dark theme you picked; set only when you use the theme switch, and needs no consent as it keeps only that choice	1 year
Conversion	Report a sign-up or purchase after advertising consent	Minutes
Analytics	Link visits with a random id after analytics consent	6 months; removed when you decline, sign in or sign out

With analytics consent, PostHog sets its analytics cookie (ph_<project key>_posthog) to link visits for 1 year. PostHog has access and keeps the same data in local storage.

With advertising consent, Reddit's pixel sets _rdt_uuid and Google's tag sets _gcl_au, and _gcl_aw after an ad click, to measure our ads. Each company has access to its own cookies and sets their lifetime, currently about 3 months; see Reddit's policy and Google's. After you decline, our pages load neither. Earlier cookies stay unread until they expire or you clear them.

Stripe's checkout sets its own cookies on Stripe's site under Link's policy.

You can withdraw analytics or advertising consent at any time, as easily as you gave it: open Cookie settings at the foot of every page. Withdrawal does not affect the lawfulness of earlier consent-based processing or stop server analytics.

Under the GDPR, you can ask to see, copy, correct or delete your data, restrict or object to its use, or receive it in a machine-readable form. Write to support@netonica.com, using your account email if you have one. We answer within one month; complex requests can take two more months, with notice within the first month.

If you own a workspace others use, tell us who should own it next; otherwise we may delete it with your account.

You may complain to the authority where you live or work, or to the Estonian Data Protection Inspectorate (aki.ee).

Netonica is not for anyone under 18, and we do not knowingly hold data about children.

We tell you before material changes take effect. The date above marks the current version. We may update the provider list in section 3 without notice.