Privacy Policy

We collect minimal data needed to provide our services:

• Email addresses— when you sign up for vendor monitoring alerts via magic link authentication.
• Usage analytics— pages visited, features used, and general interaction patterns. This data is anonymized and used to improve the platform.
• Device and browser information— browser type, operating system, and screen size collected automatically through analytics tools.

We do not collect passwords (we use passwordless magic link authentication), payment information, or personal data beyond what is listed above.

• Vendor monitoring— your email is used to send alerts when vendors you are tracking have status changes.
• Service communications— magic link login emails and essential service notifications.
• Platform improvement— analytics data helps us understand which features are useful and where to focus development.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use the following third-party services that may process your data:

• PostHog— product analytics and session tracking. PostHog processes anonymized usage data to help us understand how the platform is used. PostHog's privacy policy applies to their processing of this data.
• Google Analytics— website traffic analytics. Google Analytics collects anonymized browsing data including pages visited, referral sources, and general demographics.
• Resend— transactional email delivery. Resend processes your email address solely to deliver magic link authentication emails and vendor monitoring alerts on our behalf.

We use cookies and similar technologies for the following purposes:

• Analytics cookies— PostHog and Google Analytics set cookies to distinguish unique visitors and track sessions. These help us understand traffic patterns.
• Authentication cookies— session cookies are used to keep you logged in after magic link authentication.

You can disable cookies through your browser settings. Disabling analytics cookies will not affect core site functionality.

We retain your data only as long as necessary:

• Email addresses— retained as long as your monitoring account is active. Deleted within 30 days of account deletion request.
• Analytics data— retained for up to 12 months, then automatically purged.
• Session data— authentication sessions expire after 30 days of inactivity.

You have the following rights regarding your personal data:

• Access— request a copy of all personal data we hold about you.
• Deletion— request that we delete your personal data, including your email address and any associated monitoring configurations.
• Correction— request correction of any inaccurate personal data.
• Opt-out— unsubscribe from monitoring alerts at any time via the link in any alert email, or by contacting us directly.
• Data portability— request your data in a machine-readable format.

To exercise any of these rights, contact us at [email protected]. We will respond to all requests within 30 days.

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Consent— when you provide your email address for vendor monitoring.
• Legitimate interest— for analytics data that helps us improve the platform, balanced against your privacy rights.

You may withdraw consent at any time by deleting your account or contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We implement reasonable technical and organizational measures to protect your personal data, including encrypted data transmission (HTTPS), secure authentication (magic links instead of passwords), and access controls on our infrastructure.

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the site after changes constitutes acceptance of the updated policy.