Privacy policy

The service is operated by Northstar Infinity Works Ltd (“we”). For anything in this policy, write to [email protected]. We process personal data under the UK GDPR and the Data Protection Act 2018 and, where it applies, the EU GDPR.

For the data described in sections 3–5 (visitors to this website, waitlist sign-ups, account holders) we are the controller. For the monitoring data your own websites send us (section 6) you are the controller and we are your processor: we store and display it on your instructions and delete it when you delete it or close your account. A data processing agreement is available on request.

This website sets no cookies and uses no third-party analytics or advertising scripts. Your theme preference (light, dark, automatic) is kept in your browser’s local storage and is never sent to us. Our hosting and network providers (Vercel, Cloudflare) keep short-lived technical logs — IP address, user agent, requested URL — for security and abuse prevention, under their own retention periods. Legal basis: our legitimate interest in running a secure website.

If you join the waiting list we store your email address, the page you signed up from and the time. We use it to send you an invitation and, at most, occasional news about the launch; every email carries an unsubscribe link. Legal basis: consent, which you can withdraw at any time by unsubscribing or emailing us. We delete waiting-list entries twelve months after launch or on request, whichever is sooner.

• Sign-in data: email address, a salted password hash, any two-factor secrets or passkey public keys you enrol, and session records. Held by our authentication provider (Supabase, EU region).
• Push notifications: if you enable them, the subscription endpoint your browser issues, so we can deliver alerts to that device. Deleted when you disable notifications or when the endpoint expires.
• Billing: handled by Stripe — name, billing address, VAT number and card details are entered on Stripe’s pages and stored by Stripe; we keep Stripe’s customer and subscription identifiers and invoice records. Legal basis: performance of the contract and our legal obligation to keep accounting records (six years).
• Audit log: actions you take in the panel (resolving an error, revoking a key, changing an alert setting) with your user id and the time, kept for the life of the account for security and accountability.
• Support correspondence: emails you send us, kept for as long as needed to help you and for a reasonable period afterwards.

• Error reports: a context, a message, optionally a stack trace, a page or request URL, an application version, an environment and up to 30 metadata values. Before anything is written, email addresses and phone numbers in every text field are replaced with a mask. What else an error contains depends on what your application sends; you are responsible for not sending data you are not entitled to process.
• Heartbeats: the name of a scheduled job, whether it succeeded, and an optional count.
• Uptime checks: the URL you asked us to check, the status, response time and timestamp of each check. These concern your server, not a person.
• Analytics about your visitors: for each page view, the path, the referring domain, the country derived at the network edge, and a daily-rotating one-way hash used to count a visitor once per day. No IP address, no cookie, no identifier in the visitor’s browser and no per-visit record is stored; data is kept only as daily totals.
• Slack webhook URLs you paste in are stored so we can deliver alerts; they are readable only by the server, never shown back in the panel.

Retention: error reports stay until you resolve, archive or bin them; binned entries are deleted 30 days later; each error keeps its 30 most recent occurrences. Everything is deleted when you delete a website or close your account.

• Supabase — database and authentication, EU region (Frankfurt).
• Vercel — application hosting, Frankfurt region.
• Cloudflare — network, DDoS protection and web application firewall in front of the application.
• Stripe — payments and invoicing.
• Resend — transactional email (invitations, receipts, alerts by email where enabled).
• Slack — only if you connect a webhook: alert text is sent to the workspace you chose.

Data is hosted in the EU. Where a processor is established outside the UK or the EEA (Vercel, Cloudflare and Stripe are US companies), transfers are covered by the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as applicable. We do not sell personal data and do not share it with advertisers.

Encryption in transit (TLS 1.3 with hybrid post-quantum key exchange, measured) and at rest, row-level access control in the database, masking of personal data before storage, hashed reporting keys, two-factor sign-in, and an audit log. The details, and a command you can run to verify the transport, are on the security page.

You can ask for access to the personal data we hold about you, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Write to [email protected]; we answer within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk) or to your local supervisory authority. For monitoring data where we are your processor, requests from your visitors or users should go to you; we will help you fulfil them.

We will post changes here and update the date at the top. If a change materially affects account holders we will also email you before it takes effect.