Privacy Policy

Simrix Technologies LLC is the controller of the personal data described in this policy, except where section 3 says otherwise. Privacy questions and requests: [email protected].

We do not have a designated Data Protection Officer. Requests sent to the address above reach the people responsible for privacy at the company.

Account data. Your name, email address, hashed password (if you sign in with a password), workspace name, and team membership and roles. If you sign in with Google we receive your name, email address and profile image from Google.

Billing data. Plan, billing interval, subscription status and invoice history. Card details are collected and stored by our payment processor, Stripe; we never receive or store full card numbers.

Monitoring data. The addresses of the pages you ask us to check, your monitor settings, the notification addresses you enter, and the results of each check: screenshots, extracted page text, content hashes, HTTP status codes, timings, error messages, and any AI-generated summary of a change or failure. We do not store the HTML of your pages.

Free Checkout Health Check. The store address you enter and the email address you give us for the results, together with the screenshots and findings of that check.

Integrations you set up. API keys (stored as hashes and shown in full only once), webhook addresses and their signing secrets (stored sealed), and share links you create for reports.

Support and conversations. Support requests you send us and messages you exchange with the in-app assistant.

Usage and diagnostic data. Application logs, audit entries for significant workspace actions, error reports, API key usage counts, and product usage events that record which features an account uses (for example that a monitor was created), so we can see where people succeed or get stuck.

Technical data. Your IP address, in server logs and in the abuse limits that protect sign-up and sign-in (stored as a hash there), and the browser and device information your browser sends with every request. On the public website, Google Analytics also receives an approximate location derived from your IP address and a client identifier stored in a cookie, as described in section 10. While marketing cookies are on (in Europe only if you accept them, elsewhere unless you turn them off), Google Ads, and OpenAI for our ads in ChatGPT, also receive a record of the ad that brought you to us, and OpenAI a one-way code made from contact details you type into our forms, as section 10 also describes.

We do not collect sensitive personal data (such as health, biometric or government identifier data), and we ask you not to send it to us.

When a monitor runs a check, we capture whatever is on the page at that moment. If a monitored page displays personal data (customer names in an admin view, for example, or your own details in a logged-in workflow), that data will appear in the stored screenshot and extracted page text.

You control this. Point monitors at pages that do not expose personal data where you can, and watch a specific element or region to narrow what is captured. For any personal data captured this way, you are the controller and we process it on your behalf under the Terms of Service and our Data Processing Agreement.

• To operate the Service: check monitors, detect changes, take screenshots and send alerts.
• To authenticate you, keep your session secure and enforce workspace permissions.
• To bill your subscription and enforce plan limits.
• To generate plain-English summaries of detected changes and failures using an AI provider.
• To provide support, investigate incidents and diagnose errors.
• To understand how the website and the product are used, so we can improve them.
• To send service and account email, including the emails that guide you through a trial.
• To send marketing email only if you opt in; every marketing message includes an unsubscribe link (section 11).
• To comply with legal obligations, including tax and accounting records.

We do not sell personal data, and we do not use your monitoring data to train machine learning models.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (operating the Service and billing you); legitimate interests (securing the Service, preventing abuse, improving reliability, understanding usage); consent (analytics cookies on the public website, the cookies that measure our ads, and marketing email where consent is required); and legal obligation (tax and accounting records).

Service providers. We share data with the following providers so they can perform services for us. Each is bound by the confidentiality and security obligations of its terms of service.

• Railway: Application hosting and the PostgreSQL database holding all account and monitoring data
• Cloudflare (R2): Object storage for screenshots
• Stripe: Subscription billing and payment processing
• Resend: Transactional and alert email delivery
• OpenAI: Generating change summaries and failure explanations, suggesting monitors during setup, answering questions in MonitorBot, sorting support requests, and finding a product page during the free Checkout Health Check
• Sentry: Application error monitoring
• Google: Optional sign-in with a Google account
• Google (Analytics): Visit and campaign measurement on the public website only, with ad personalisation and Google Signals off, and only with your consent where a consent banner is shown
• Google (Ads): Counting which of our ads led to a sign-up or a free check, on the public website only; its cookies are set only while marketing cookies are on (in Europe only if you accept them, elsewhere unless you turn them off), and ad personalisation is off
• OpenAI (ChatGPT ads): Counting which of our ads in ChatGPT led to a sign-up or a free check, on the public website only, matched by a one-way code made in your browser from the email address or name entered in our forms; its pixel loads only while marketing cookies are on (in Europe only if you accept them, elsewhere unless you turn them off), and every event asks OpenAI not to use it for personalisation
• Cookiebot (Usercentrics): The consent banner on the public website, shown to visitors whose IP address places them in Europe, and the record of the choice made in it
• Twilio: delivery of the text messages our own administrators opt in to (section 11). It receives an administrator's mobile phone number for that purpose only; no customer data reaches it.

Legal requirements. We may disclose personal data where required by law, regulation, legal process or a governmental request, or to protect the rights, safety and property of our customers, the public or ourselves.

Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction; we will tell you before your data becomes subject to a different privacy policy.

We will tell you about any significant change to who we share data with, and where the law requires it, ask for your consent.

We are established in the United States, and our servers and database are there. If you use the Service from outside the United States, including from the European Economic Area, the United Kingdom or Switzerland, the personal data you give us is processed in the United States, and by the providers in section 6 where they operate, protected as this policy describes.

Where the law requires a mechanism for personal data leaving those regions, for example when a provider moves data between its own locations on our behalf, we rely on the European Commission's Standard Contractual Clauses, the United Kingdom's International Data Transfer Addendum and the Swiss addendum to them, or on a provider's certification under the EU-US Data Privacy Framework.

Account and billing records are retained for as long as your account is active and afterwards as required for tax and legal purposes. Conversations with the in-app assistant, including anything you type into it, are retained for 90 days and then deleted automatically. Results from the free Checkout Health Check, including the address you gave us and the screenshots taken, are deleted seven days after the check completes.

Screenshots and the extracted page text from each check are deleted after 7 days. One page of text is the exception: the most recent we hold for a monitor is what its next check compares against, so that one is kept until a newer check replaces it. On a monitor that checks monthly, that means one page of text for a month.

The check record itself (its status, timing, summary and whether anything changed) is retained while your workspace is active. That is your monitoring history; it is the raw page text above that ages out of it. Product usage events are kept in aggregate for reporting; when a workspace is deleted, the identifiers on them are removed so they no longer point at anyone.

An owner can delete a workspace from Account → Account profile. It removes the workspace and everything in it, cancels the subscription first, and takes with it the account of anyone on your team who belongs to no other workspace. It is immediate and cannot be undone. Screenshots already in storage age out on their own schedule rather than at that moment, and we keep the records we are required to keep by law. If you would rather we handled it, email us at [email protected] from the address on the account.

Data is encrypted in transit. Passwords are stored salted and hashed, never in plain text. API keys are stored as hashes and shown in full only once, at creation. The webhook signing secrets you give us are sealed with a key held separately from the database. Access to production systems is limited to personnel who need it. We monitor the Service for errors and unusual activity, review the code and its configuration for security problems, and act on reports sent to [email protected].

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and any relevant regulator as required by law.

Cookies are small files placed on your device that let a website remember you between requests. We use them as follows.

Strictly necessary. Cookies that keep you signed in, protect against cross-site request forgery, remember a plan you picked on the way to signing up, and remember the choice you make in the consent banner. These do not require consent.

Statistics. On our public pages (not inside the signed-in application) we use Google Analytics to count visits and see which pages and campaigns bring people here. It sets cookies whose names begin with _ga. We have turned off Google Signals and ad personalisation. We also set one first-party cookie, sm_attr, for up to 90 days; it records how you first arrived at our site (campaign parameters in the link, the referring site and the landing page) and when, so we can attribute sign-ups to the channels that brought them. It contains no personal information and is not shared with anyone.

Advertising measurement. We advertise on Google and in ChatGPT, and measure those ads with marketing cookies. In Europe they stay off until you accept them in the consent banner; elsewhere they are on unless you turn them off, as described under Your choices below. While they are on, Google Ads may set cookies (their names begin with _gcl) that record that you arrived from one of our ads, so we can count which ads lead to sign-ups and free checks. While they are off no advertising cookie is set, and Google receives only signals without cookies, which it uses to estimate those counts in aggregate. Ad personalisation is turned off, so this is not used to show you ads elsewhere or to build audiences of our visitors.

For our ads in ChatGPT, OpenAI's measurement pixel loads on the public website only while marketing cookies are on, and never on a free check's results page, whose address is your private link to it. Each time it loads it sends OpenAI the address of the page, and it tells OpenAI when you create an account or start a free check, so we can count which ads lead to those. To match those to an ad, it also reads contact details you type into our sign-up or free check form, such as your email address or name, turns them into a one-way code (a SHA-256 hash) in your browser, and sends OpenAI only that code, never the details themselves. OpenAI compares it with codes made the same way from its own users' details, to tell whether you came from one of our ads. It sets three cookies: __oppref, for up to 30 days, which records that you arrived from one of our ads in ChatGPT; __obref, for up to a year, a random reference for your browser on our site; and __oaiq_consent, for up to 30 days, which records that it may measure. We pass it nothing else about you, and every event asks OpenAI not to use it for personalisation. While marketing cookies are off the pixel does not load and OpenAI receives nothing from it.

Your choices. If you are in Europe, including the European Economic Area, the United Kingdom and Switzerland, a consent banner on your first visit to the public website lets you accept all cookies, decline everything but the strictly necessary ones, or choose by category. Until you choose, and if you decline, you are measured without cookies and the attribution cookie is not set. Elsewhere there is no banner, and statistics and marketing cookies are on when you arrive. Wherever you are, the Cookie settings link in the website footer opens the same choices, so you can turn either kind off, or back on, at any time. If your browser sends the Global Privacy Control signal we treat it as a refusal wherever you are: you are not measured, no advertising cookie is set, OpenAI's pixel does not load and the attribution cookie is not set.

The full list of cookies, their purposes and their lifetimes is shown in the consent banner's details view.

We send marketing email only with your consent where the law requires consent, and never without a way to stop it. Every marketing email includes an unsubscribe link, and we honour it promptly. Emails about your account, your checks, your alerts and your trial are service emails, not marketing, and are sent for as long as you use the Service. We do not send marketing by text message or telephone.

Text messages. Simrix Monitor sends text messages only to members of our own team who have opted in to system notifications and alerts from the administrator area of the Service, never to customers. Our text message notifications page describes the program. This Privacy Policy is the only privacy policy that applies to it.

For that program we collect the mobile phone number an administrator enters, the date and time they ticked the opt-in box, the consent wording they agreed to, and a record of each message sent and whether it was delivered. We use this information only to send the messages the administrator opted in to and to honour an opt-out. Message frequency varies. Message and data rates may apply. An administrator can opt out at any time by unticking the box in the administrator area or by replying STOP to any message, and can reply HELP for help.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. Mobile information and text messaging opt-in data and consent are excluded from every category of sharing described elsewhere in this policy: they are not shared with any third party for any purpose other than delivering the messages you opted in to, which our messaging provider does on our behalf and may not use for anything else.

Depending on where you live, you have rights over your personal data. Where the GDPR or UK GDPR applies, they are:

• Access (Art. 15): to obtain a copy of the personal data we hold about you and information about how we process it.
• Rectification (Art. 16): to have inaccurate or incomplete data corrected.
• Erasure (Art. 17): to have your data deleted when it is no longer needed for the purposes it was collected for, among other grounds.
• Restriction (Art. 18): to have processing restricted in certain circumstances.
• Portability (Art. 20): to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection (Art. 21): to object to processing based on legitimate interests, and at any time to processing for direct marketing.
• Withdrawal of consent (Art. 7(3)): where processing is based on consent, to withdraw it at any time, without affecting processing that took place before.
• Complaint (Art. 77): to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where you believe an infringement occurred.

To exercise a right, email [email protected] from the address on your account, or tell us how to reach you. We may need to verify your identity before acting on a request. We respond within the time the applicable law allows, which under the GDPR is one month, extendable where a request is complex. Exercising a right costs nothing unless a request is manifestly unfounded or excessive.

Much of this you can do yourself: account details can be changed in the application, and an owner can delete the whole workspace as described in section 8.

We are a New Jersey company. Residents of New Jersey, California and other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have rights under those laws where they apply. Those laws apply to businesses above a size threshold, and we honour these rights for anyone who asks, wherever they live and whether or not a threshold is met.

• Right to know. You may ask what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we share it with. Sections 2 and 6 describe these; we will confirm what applies to you.
• Right to delete. You may ask us to delete the personal information we have collected about you, subject to the exceptions the law allows (for example records we must keep).
• Right to correct. You may ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. If that ever changed, we would provide an opt-out link on the website before doing so. You can still turn off the visit and ad measurement described in section 10 at any time, from the Cookie settings link in the website footer or with Global Privacy Control.
• Right to opt out of targeted advertising and profiling. New Jersey and several other states let you opt out of targeted advertising and of profiling in furtherance of decisions with legal or similarly significant effects. We do neither.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information.
• Right to non-discrimination. We will not treat you differently for exercising any of these rights.

Submitting a request. Email [email protected]. We will compare the information you give us with our records to verify the request; an authorised agent may submit a request on your behalf with written permission, and we may ask the agent to prove it. We respond within 45 days of receiving a request, and may extend that once by a further 45 days when reasonably necessary, telling you why. Exercising these rights is free, at least once in any twelve-month period. If your browser sends the Global Privacy Control signal we treat it as an opt-out request for the measurement described in section 10.

Appeals. If we decline all or part of a request, we will tell you why and how to appeal. Appeal by replying to our response within 60 days and explaining why you believe the decision was wrong. We answer an appeal in writing within 45 days, and if we deny it, we tell you how to contact your state's consumer protection office; for New Jersey that is the Division of Consumer Affairs in the Office of the Attorney General.

The Service is not directed to children. You must be at least 18 to open an account, and we do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, email [email protected] and we will delete it.

We may update this policy. If a change is material we will give reasonable notice by email or in the application before it takes effect, and where a change concerns how we share your data or use cookies, we will ask for your consent where the law requires it. The effective date at the top of this page tells you when it was last changed.

Privacy questions and requests: [email protected]. Security reports: [email protected].

Simrix Technologies LLC, 495 Route 70 #1035, Brick, NJ 08723, United States