Log in|Register|
    Legal

    Privacy Policy

    Last updated: April 2026

    1. Introduction

    Security Monitor ("we", "us", "our") operates the securitymonitor.io website and platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

    2. Information We Collect

    2.1 Information you provide

    • Account data: Email address, password, and display name when you create an account.
    • Domain data: Domain names you submit for scanning and monitoring.
    • Payment data: Billing information processed securely through Stripe. We do not store credit card numbers.
    • Communications: Messages you send through our contact form.

    2.2 Information collected automatically

    • Usage data: Pages visited, features used, scan frequency.
    • Device data: Browser type, operating system, screen resolution.
    • Log data: IP address, access times, referring URLs.

    3. How We Use Your Information

    We use the information we collect to:

    • Provide, operate, and maintain our security scanning and monitoring services.
    • Send you scan results, alerts, and security notifications.
    • Process payments and manage your subscription.
    • Improve our platform and develop new features.
    • Respond to your inquiries and provide customer support.
    • Comply with legal obligations.

    4. Data Storage & Security

    All data is stored on EU-based infrastructure. We use industry-standard encryption (AES-256 at rest, TLS 1.3 in transit) to protect your data. We conduct regular security audits of our own platform.

    5. Data Sharing & Sub-processors

    We do not sell, trade, or rent your personal data. We do share limited data with the following categories of sub-processors, all of whom are contractually bound (DPA + Standard Contractual Clauses where applicable) to process data only on our instructions:

    • Infrastructure: Lovable (EU hosting), Supabase (Frankfurt, DE — database & auth), Cloudflare (CDN, DDoS, bot protection).
    • Payments: Stripe (Ireland, EU) — handles all card data; we never see or store card numbers.
    • Analytics & marketing (consent-based only): Google LLC operating Google Tag Manager, Google Analytics 4, Google Search Console and Google Ads. Loaded only after you grant consent in our cookie banner. Google may transfer data to the United States; we rely on the EU-US Data Privacy Framework (Google LLC is a certified participant) and Standard Contractual Clauses as transfer safeguards under GDPR Art. 44–49.
    • Security intelligence: Google Safe Browsing, VirusTotal, Have I Been Pwned, Shodan, crt.sh, URLhaus, Spamhaus, Firecrawl. We send domain names only (no personal data) for the security checks you have requested.
    • Legal requirements: When required by law, regulation, or legal process.

    A complete and up-to-date list of sub-processors is published at /trust. We notify customers at least 30 days before adding a new sub-processor that processes personal data.

    6. Your Rights (GDPR)

    Under the General Data Protection Regulation, you have the right to:

    • Access your personal data.
    • Rectify inaccurate data.
    • Erase your data ("right to be forgotten").
    • Restrict processing of your data.
    • Data portability — receive your data in a machine-readable format.
    • Object to processing of your data.
    • Withdraw consent at any time, including for cookies, via /cookie-preferences. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
    • Lodge a complaint with your national supervisory authority.

    To exercise these rights, contact us at privacy@securitymonitor.io. We respond within one month.

    7. Cookies & Similar Technologies

    We use a layered consent model based on Google Consent Mode v2. By default, all non-essential cookies and trackers are denied until you actively choose in our cookie banner. Categories:

    • Strictly necessary — authentication (Supabase session cookies), CSRF protection, load-balancing, Cloudflare bot protection, and storing your cookie preference itself. These cannot be disabled.
    • Functional — remembers your language, theme and other UI preferences. Off by default.
    • Analytics — Google Analytics 4 and Google Tag Manager (IP-anonymised, aggregated). Off by default. Also enables Google Search Console insights.
    • Marketing — Google Ads conversion measurement and retargeting. Off by default.

    You can review the exact cookies in each category, update your choice, or withdraw consent at any time via /cookie-preferences. Your choice is stored in a first-party cookie (sm_consent) on the .securitymonitor.iodomain and is shared across all subdomains for 6 months, after which we will ask again.

    8. Data Retention

    We retain your account data for as long as your account is active. Scan results and monitoring data are retained according to your plan tier. You can request deletion of your account and data at any time.

    9. Children's Privacy

    Our services are not directed to individuals under 16. We do not knowingly collect data from children.

    10. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes via email or through our platform.

    11. Contact

    For questions about this Privacy Policy, contact us at:
    privacy@securitymonitor.io