Privacy policy

Who handles your data

Rookflare is operated by [legal entity, registration number and registered address]. For account, billing and support information, we act as the data controller. Contact us through our contact page. Before launch: publish a dedicated privacy email address.

When you ask us to monitor pages containing other people’s personal data, you determine the purpose of that monitoring. Where we act as your processor, a data processing agreement must cover that processing. Before launch: confirm these roles and make the agreement available.

Information we process

• Account: name, email, password hash, sign-in and session information, organization and team membership. If you sign in with Google, we receive your name, email address and Google account ID from Google.
• Monitoring: the URLs you add, desktop and mobile screenshots, approved baselines, technical results (HTTP status, redirects, broken images, JavaScript error messages, page title and search settings), uptime check results and issue history. Captured pages and error messages may contain personal data.
• Alert destinations: email addresses of alert recipients, Slack webhook addresses and, if you turn on SMS and call alerts, phone numbers. Phone numbers and Slack webhook addresses are stored encrypted.
• Billing: Stripe customer and subscription references, payment status and billing records. Stripe handles payment card details; Rookflare does not store card numbers.
• Contact form: name, email, optional company and your message. We store a keyed hash of your IP address to spot repeat submissions, not the IP address itself.
• Free website tools: the URL you submit and the result of the check. Results are cached for 10 minutes so repeated checks of the same page are not run again; they are not stored after that. Your IP address is used for rate limits (10 checks a minute and 100 a day), and a Cloudflare Turnstile check may run in your browser to block automated abuse.
• Security and errors: technical logs, IP addresses, user agents and account activity used to investigate failures or abuse, error reports from the dashboard, and the audit log of changes to your organization.

Information comes from you, your team, the pages you select and connected services. Only submit pages you are authorized to monitor; avoid sensitive information that is not needed for the service.

Why we use it

We use account and monitoring data to provide requested features and support, billing data to administer subscriptions, and technical records to maintain security and diagnose problems.

Where GDPR applies, processing relies on the relevant basis: performing a contract with you, complying with legal obligations, legitimate interests in operating a secure service, or consent where required. For representatives of business customers, account administration may rely on legitimate interests. Legal review: confirm each purpose and legal basis before launch.

Cookies

The dashboard uses essential cookies to maintain sign-in and protect sessions. Optional analytics or advertising technologies, if introduced, require their own disclosure and consent where applicable. Before launch: confirm cookie names, purposes and lifetimes against the deployed service, including any set by Cloudflare and Turnstile.

Service providers

These providers process data on our behalf:

Provider	What it does	Data it receives
Hetzner (Germany, EU)	Hosts our servers and database	All data described above
Cloudflare	Network and security in front of our sites, Turnstile on the free tools	Requests to our sites, including IP addresses
Cloudflare R2	Stores screenshots	Screenshots of monitored pages
Stripe	Payments and subscriptions	Billing details, payment card details you enter in the payment form
Resend	Sends emails (alerts, account and contact emails)	Recipient addresses and email content
Twilio	Sends SMS and makes calls for phone alerts	Phone numbers and the short alert text
Google	Sign-in with Google, if you choose it	Sign-in request and the account details Google returns
Sentry	Error monitoring	Error details and technical context, with personal data removed where possible

Slack notifications send alert content to the workspace and channel you choose. Only connect destinations you are authorized to use.

Before launch: confirm each provider’s processing locations and the safeguards for any transfer outside the EU (for example Standard Contractual Clauses), and sign data processing agreements. We may also disclose information where legally required or necessary to address security incidents and legal claims.

Retention

• Scan history and screenshots: kept for the history period of your plan (shown on the pricing page and in your account). Approved baselines are kept while the page is monitored, and evidence for open issues is kept until the issue closes.
• Uptime checks: individual check results for 30 days; daily summaries are kept longer for uptime history and reports.
• Dashboard error reports and support reports: 90 days after they were last seen or sent.
• Audit log: 1 year.
• Free tool results: 10 minutes.
• After a free trial ends: monitoring stops. Your websites, settings, approved baseline screenshots and issues stay in your account until you delete it; as on any account without a plan, scan history and screenshots older than 30 days are removed.
• Free trial records: which person started a free trial is kept with the organization’s billing record, and a one-way hash of each website domain monitored on a free trial is kept so the same site can’t start another trial within 12 months. Neither shows who used the trial to anyone else.
• Account deletion: deleting your account removes your name and email and deletes organizations where you are the only member.

Before launch: confirm retention for contact-form messages, billing records (including legally required accounting retention), backups and server logs, and how closure requests affect each category. Access controls, encryption of secrets and other safeguards reduce risk, but no online service can guarantee complete security.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your data, and object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to your competent data protection authority.

Use our contact page to make a request. We may need to verify your identity. For personal data inside a customer’s monitored pages, contact that website’s operator; we will assist where required as its processor.

Updates

We will update this page when our processing changes and communicate material changes where required. The date above identifies the latest draft. Confirm the completed policy before collecting data under it.