Privacy Policy

1. Information we collect

php4u Limited, trading as Watchtower ("Watchtower", "we", "us"), is the data controller for the personal data described in this policy. We collect information you provide directly, information generated automatically as you use Watchtower, and information your Magento connector reports on your behalf.

1.1 Information you provide

Your name, email address and password, your organization name, discount codes you redeem, and any alert-recipient email addresses or webhook URLs you configure.

1.2 Billing information

Payment card details are entered directly into Stripe's own Checkout and never reach our servers. We store Stripe customer/subscription identifiers and the plan and shop counts needed to bill you correctly.

1.3 Store data from the Magento connector

Once you install the connector on a Magento store, it reports operational signals (cart activity, checkout, customer-account, and integration-health metrics) so we can detect anomalies. This is aggregate store-performance data, not your shoppers' personal browsing activity.

1.4 Information collected automatically

Device and log data (IP address, approximate location derived from IP, browser type, pages viewed, and timestamps), collected to operate, secure, and troubleshoot the Service.

1.5 Account security credentials

Your password is stored only as a salted hash, never in plain text. Two-factor authentication is mandatory on every account; the underlying TOTP secret is stored encrypted and used solely to verify your sign-in, never to identify or profile you.

2. How we use it

We use the information we collect to (for EEA/UK users, the GDPR legal basis for each purpose is noted in brackets):

• provide, maintain, and improve Watchtower (performance of our contract with you);
• detect anomalies in your Magento stores and send you the alerts you asked for (performance of our contract with you);
• process transactions, calculate metered overage, and send billing-related communications (performance of our contract with you; legal obligation for tax and accounting records);
• detect, prevent, and address fraud, abuse, and security issues (legitimate interests in keeping the Service secure);
• communicate with you about your account, trial, and product updates (legitimate interests; consent, where required for marketing emails);
• remember non-essential preferences such as light/dark mode (consent, via the cookie banner);
• comply with our legal obligations.

Anomaly alerts are generated by rules and statistical thresholds over your store's own metrics. They are informational signals for you to act on, not a decision made solely by automated means that produces legal or similarly significant effects on you, so the additional safeguards under GDPR Article 22 do not apply. You always remain in control of what happens as a result of an alert.

3. Cookies & tracking

We use a small number of cookies to keep you signed in, protect against cross-site request forgery, and remember your display preferences. We do not use any third-party advertising or analytics cookies. See our Cookie Policy for the full list, and use the cookie banner or that page to manage your preference for non-essential cookies. We also honor the Global Privacy Control (GPC) signal as a valid opt-out/no-consent request wherever it is legally recognized.

4. Data sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We disclose information only to the following categories of recipients, each acting as our service provider/processor under a data processing agreement (except law enforcement, where applicable):

• Stripe, Inc., to process payments and manage subscriptions;
• our infrastructure and email-delivery providers, to host the Service and deliver alert/account emails;
• anyone you configure yourself: the webhook URLs and alert email addresses you add to your own organization;
• professional advisors (e.g. accountants, lawyers) bound by confidentiality, and any successor in the event of a merger, acquisition, or sale of assets;
• law enforcement or other parties, only when required by law, legal process, or to protect our rights, users, or the public.

A current list of sub-processors is available on request at [email protected].

5. Data retention

We retain your account and store-monitoring data for as long as your account is active, plus a short grace period after a trial lapses or a subscription ends so you can resume without losing history. After account closure, we delete or anonymize personal data within 90 days, except where a longer period is required for legal, tax, or security purposes (for example, billing records are generally kept for 6 years to meet UK tax-record obligations).

6. Your rights (EU/UK GDPR)

If you are in the European Economic Area, the UK, or Switzerland, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten"), subject to our legal retention obligations;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where processing is based on consent, without affecting processing that already took place;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 2 on how our anomaly alerts work).

To exercise these rights, contact us at [email protected]. We aim to respond within one month, extendable by a further two months for complex requests, as permitted under Article 12 GDPR. You also have the right to lodge a complaint with your local data protection authority, or, for UK residents, the Information Commissioner's Office (ICO) at ico.org.uk.

7. Your rights (California and other US states)

This section covers the California Consumer Privacy Act as amended by the CPRA, and materially similar comprehensive privacy laws in states including Colorado, Connecticut, Virginia, Utah, and others as they take effect.

7.1 Categories of personal information we collect

We use sensitive personal information only to provide and secure the Service (verifying your sign-in), which is a permitted purpose under Cal. Civ. Code § 1798.121(a) that does not require a "Limit the Use of My Sensitive Personal Information" link. We do not collect biometric, health, precise geolocation, or racial/ethnic-origin data.

7.2 No sale or sharing

We have not sold or shared (as those terms are defined by the CPRA) any personal information in the preceding 12 months, and have no plans to. Because we don't sell or share personal information, no "Do Not Sell or Share My Personal Information" link is required or shown on this site. We also do not use personal information for cross-context behavioral advertising, and we do not disclose personal information to third parties for their own direct marketing (so no "Shine the Light" disclosure list applies).

7.3 Your rights and how to exercise them

You have the right to know/access the personal information we hold about you, request its deletion, request correction of inaccurate information, receive it in a portable format, and not be discriminated against for exercising any of these rights. To submit a request, email us at [email protected] from your account's registered email address, or write to our registered office address below. An authorized agent may submit a request on your behalf with your written permission. We will verify your identity before acting on a request, and will respond within 45 days, extendable once by a further 45 days where necessary. If we decline a request, you may appeal by replying to our decision; Colorado and Connecticut residents may also contact their state Attorney General if an appeal is denied.

We honor the Global Privacy Control (GPC) signal as a valid opt-out preference signal where your browser sends it.

8. International transfers

Watchtower is operated from the United Kingdom. We and our service providers (for example Stripe, which processes payments in the United States) may process your data outside the UK and EEA. When we transfer personal data out of the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; when we transfer data out of the EEA or Switzerland, we rely on the EU Standard Contractual Clauses or an applicable adequacy decision, and, where relevant, mechanisms such as the EU-U.S. Data Privacy Framework and its UK extension.

9. Security & breach notification

Passwords are hashed, never stored in plain text. Two-factor authentication is required on every account. We use industry-standard technical and organizational measures to protect your data, but no method of transmission or storage is 100% secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and, where required, the ICO or relevant EU supervisory authority, without undue delay and within the timeframes required by applicable law (including the 72-hour notification window under GDPR/UK GDPR, where applicable).

10. Children's privacy

Watchtower is a business tool not directed to children, and we do not knowingly collect personal data from anyone under 16 (or, where a lower age applies, such as 13 under the US Children's Online Privacy Protection Act, that lower age). If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service and update the "Last updated" date above.

12. Contact us

Questions about this policy or your data?

[email protected]
php4u Limited, trading as Watchtower · Registered in England and Wales, Company No. 11345512 · Registered office: 124 City Road, London, EC1V 2NX, United Kingdom