Privacy Policy

Data controller

The data controller is Garp s.r.l.s. a socio unico, with registered office at Via Mazzini 321, 41049 Sassuolo (MO), Italy, VAT number 03841550365, REA MO422314, share capital 9.000 € ("Garp", "we"). For any privacy request you can write to info@garp.it.

Who this policy is for, and roles

This policy covers visitors to the monitora.re website, customers and registered users of the application, subscribers to status page updates and people who receive notifications from the service.

For personal data that a customer enters into the service about other people (for example contacts to alert, team members they invite, subscribers to the customer’s status pages) the customer is the controller and Garp acts as processor under Article 28 GDPR, as set out in the Terms of Service.

Data we process

Browsing data: IP address, date and time, requested page, browser and operating system, recorded in the servers’ technical logs.

Account data: name, email address, password (stored only in non-reversible hashed form), two-factor authentication factors (encrypted TOTP secrets and passkey public keys), role in the organisation, active sessions with IP address and browser.

Service data: monitor configuration (addresses, hosts and options; any credentials and headers are encrypted at rest), check results, incidents and their timeline, alert contacts (emails, webhook URLs, Telegram identifiers, integration keys), maintenance windows, status pages and the audit log (who did what, when and from which IP address).

Status page subscribers: email address, date of subscription and confirmation.

Billing data: payments are handled by Stripe; we only keep customer and subscription identifiers, the plan, the type and last four digits of the payment method and the data needed for invoices. We never receive or store the full card number.

Purposes and legal bases

Providing the requested service (account, monitoring, notifications, status pages, API, support): performance of the contract, Article 6(1)(b) GDPR.

Protecting the service and its users (email verification, two-factor authentication, rate limits, audit log, abuse prevention): legitimate interest, Article 6(1)(f) GDPR.

Sending status page updates to those who subscribe: consent, Article 6(1)(a) GDPR, which can be withdrawn at any time through the unsubscribe link in every email.

Complying with legal obligations, in particular tax and accounting: Article 6(1)(c) GDPR.

Service communications (security, changes to the terms, account issues): performance of the contract and legitimate interest. We do not send promotional newsletters without your consent.

How we protect data

Communications are encrypted (HTTPS/TLS), check credentials are encrypted in the database, two-factor authentication is mandatory for every user, and administrative access to servers is restricted and logged. Check nodes only receive the monitor configuration for their region and do not store customers’ personal data.

Where data is located and who receives it

The application and database are hosted on servers of Hetzner Online GmbH in Germany. Check nodes run on servers in the European Union (IONOS) and on Garp’s infrastructure in Italy, where backups are also stored.

Stripe Payments Europe Ltd (Ireland) processes payments as an independent controller for payment data; Stripe may transfer data to the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses.

Service emails are sent from our own servers, without third-party email platforms.

Notifications sent to services chosen by the customer (Slack, Microsoft Teams, Telegram, PagerDuty, webhooks) contain incident and monitor data and are processed by those providers under their own terms, including outside the European Union; using them is the customer’s choice.

The website loads a styling library from cdn.tailwindcss.com, which receives the browser’s IP address and technical information in order to serve the file.

We do not sell or hand over personal data to third parties for marketing purposes. Data may be disclosed to authorities where required by law.

How long we keep it

Individual check results: 30 days; hourly uptime statistics: 400 days; audit log: 400 days.

Unconfirmed status page subscriptions: 48 hours; confirmed subscriptions: until you unsubscribe or the status page is closed.

Account and service data: for as long as the relationship lasts; after the account is closed it is deleted within 30 days, except for backup copies, which are overwritten according to their rotation cycle.

Tax documents: 10 years, as required by law. Server technical logs: for as long as needed for security and troubleshooting.

Your rights

You can request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15-22 GDPR), by writing to info@garp.it. We reply within one month.

If you believe the processing breaches data protection law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of your country.

If your data was entered into the service by one of our customers (for example as a contact to alert), please contact them first: they are the controller of that data. We will help you exercise your rights in any case.

Cookies and browser storage

We only use technical cookies needed for the service to work: the session cookie and the form protection (CSRF) cookie. Your light or dark theme preference is stored in the browser’s local storage. We do not use profiling, analytics or third-party cookies, so no consent is required.

Minors

The service is intended for professionals and businesses, not for people under 18.

Changes

We may update this policy; the date at the top shows the latest version. We notify registered users by email of any material change.