SteadyNode – Privacy Policy
Controller: Wild Protection Korlátolt Felelősségű Társaság (Wild Protection Kft.)
Registered seat: Aranyág Kert 23, Hódmezővásárhely 6800, Hungary
Company reg. no.: 06-09-029431
Privacy contact: [email protected]
Version: 1.1 | Effective date: 2026-10-28
1. Summary
SteadyNode is a business monitoring service. We process account and security data, monitor configurations and results, and information needed to deliver service messages. Monitor output and screenshots can incidentally contain personal data even though the Service is designed for infrastructure monitoring.
- Persistent application data is hosted in DigitalOcean's Frankfurt region. Cloudflare, Clerk, and Resend process data for web delivery/security, authentication, and email delivery as described in Section 6.
- We do not currently use analytics or advertising tags or create advertising profiles.
- We do not ask customers to submit real end-user data through monitored targets or synthetic-test content. Account and alert-recipient contact details are processed as described below; incidental personal data may also appear in URLs, responses, or screenshots.
- The Service is currently in beta and free; we do not process payment-card data for subscriptions.
2. Who We Are and Our Role
2.1. SteadyNode is an uptime and infrastructure monitoring platform for businesses (agencies, developers, and DevOps teams). It is not offered to consumers.
2.2. We are the controller (Art. 4(7) GDPR) for account data, website and service-security data, and operational data that we process for our own purposes.
2.3. Where you determine the purposes and means of processing personal data in monitor configurations or results, you are the controller and we are your processor. Our Data Processing Agreement, which forms part of our Terms of Service, governs that processing. The parties' roles depend on the actual processing.
2.4. This policy describes our processing as controller. Processing of personal data in monitor content on a customer's behalf is governed by the DPA. This policy does not replace the privacy information you must provide to your own users or other data subjects.
3. Data We Process
3.1. Account Data
| Data | Purpose | Source |
|---|---|---|
| Name | Identify the account holder and team members | You, via sign-up |
| Email address | Account login, security notices, service and alert notifications, legal notices | You, via sign-up |
| Authentication identifiers and session data (user ID, session tokens, sign-in timestamps) | Log you in and keep your session secure | Generated by our authentication provider, Clerk |
Account registration and authentication are handled by Clerk (see Section 6). If you sign in through a third-party identity provider that Clerk supports, Clerk receives the identity data that provider shares (typically name, email, and profile image). We only use the name and email.
3.2. Telemetry Data (Monitoring Data)
When you create monitors, we process:
- Target definitions: URLs, hostnames, endpoints, ports (where configured), HTTP methods, check intervals, and assertions you configure;
- Network information about monitored targets: IP addresses that targets resolve to or respond from;
- DNS and SSL/TLS metadata: DNS records, certificate details (issuer, validity dates, chain), and related results;
- Uptime and performance metrics: status codes, response times, error messages, and check results;
- Request and response content: headers, bodies, assertions, and execution output when configured or returned by a monitored system;
- Screenshots: images captured by synthetic browser tests, which may contain content from monitored pages;
- Alert-recipient details: email addresses configured to receive monitor alerts;
- Audit and execution logs: actions in your account, check status, timestamps, and the acting user ID.
We receive alert-recipient email addresses from the customer that configured the monitor, not from the individual.
This data is collected to monitor infrastructure, not to profile people. URLs, IP addresses, request or response content, account identifiers, and screenshots may still identify or relate to individuals and are treated as personal data where the law requires.
3.3. Technical and Security Data
Our servers automatically log the IP address, user agent, request time, and basic request metadata of people accessing the web application and API. We use these logs to secure the Service, detect abuse, and fix faults. They are not used for profiling or advertising.
3.4. Support and Communications
If you email us, we process your email address, the content of your message, and any information you choose to send, to respond to you.
3.5. What We Do Not Collect
We do not knowingly collect payment card data (the beta is free), special categories of personal data (Art. 9 GDPR), or data about children. We do not buy or enrich data about you from third parties.
4. Why We Process Data and Our Legal Bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and manage accounts; provide the Service and alerts | Account data | Art. 6(1)(b) where the data subject is a party to the contract; otherwise Art. 6(1)(f), our legitimate interest in providing and administering the Service for the customer's users |
| Run monitors and store results | Customer-configured telemetry and results | We act as processor; the customer, as controller, determines the legal basis. |
| Deliver monitor alerts to recipients configured by a customer | Alert-recipient email addresses | Art. 6(1)(f), our legitimate interest in delivering alerts requested by the customer. Alert recipients may object by contacting us or the customer that configured the monitor. |
| Secure the Service; prevent abuse, fraud, SSRF attempts, and prohibited use under our AUP | Technical data, telemetry, audit logs | Art. 6(1)(f), legitimate interest in the security and integrity of our infrastructure and third parties |
| Produce aggregated, de-identified operational statistics | Telemetry | Art. 6(1)(f), our legitimate interest in operating and improving the Service; the statistics do not identify customers, targets, or individuals |
| Send service and security messages (not marketing) | Email address | Art. 6(1)(b) / (f) |
| Respond to your requests and support questions | Support data | Art. 6(1)(b) / (f) |
| Comply with legal obligations; handle legal claims | Any relevant data | Art. 6(1)(c) and 6(1)(f) |
Providing your name and email address is necessary to create an account. Without it we can't provide the Service.
For our processing as controller, we do not rely on consent for the purposes described above. Customers determine the legal basis for personal data in monitor content processed on their instructions. We do not engage in automated decision-making or profiling that has legal or similarly significant effects on you (Art. 22 GDPR). We do not send marketing emails. If this changes, we will update this policy and ask for consent where required.
5. Data Minimization and Your Obligations
5.1. SteadyNode is built to monitor infrastructure, not to collect personal data about monitored systems' users. We apply data minimization (Art. 5(1)(c) GDPR) and ask you to use synthetic, non-personal test data.
5.2. Do not intentionally configure monitoring targets or test scripts to collect or process real customer, employee, or other end-user personal data from monitored systems. You must not intentionally process special categories of personal data (Art. 9 GDPR), personal data relating to criminal convictions and offences (Art. 10 GDPR), payment-card data, or real users' financial credentials.
5.3. These restrictions apply to target URLs and query strings, HTTP headers and bodies, assertions, scripts, variables, labels, and data returned by monitored systems.
5.4. Use synthetic, non-personal test data and dedicated test accounts. Avoid putting credentials or other secrets in URLs.
5.5. Monitor results, responses, and screenshots may incidentally include personal data. Where we process that data on your behalf, we do so on your documented instructions under the DPA. You are responsible for your purposes, lawful basis, required notices, and the data you configure, subject to the parties' roles and mandatory law. We do not routinely inspect or filter monitor content for personal data. If you include personal data in monitor configurations or scripts contrary to this Section, you do so at your own risk, you act as the controller of that data, and, as between you and us and to the extent permitted by law, you are solely responsible for it. We have no obligation to detect, filter, or review such data. This does not limit rights that data subjects have against us under mandatory law.
5.6. If you become aware that prohibited or unnecessary personal data has been included, notify us at [email protected], remove it from the configuration, and request deletion of affected results where needed. We may suspend affected monitors and remove data in accordance with the Terms and AUP.
6. Sub-processors and Other Disclosures
6.1. We share personal data with the direct sub-processors below only as needed to provide and protect the Service. We may also disclose it to other recipients in the limited circumstances in Section 6.3. We do not sell personal data or share it for advertising.
| Direct sub-processor | Role | Data | Location |
|---|---|---|---|
| Clerk, Inc. | Authentication and user management | Account identifiers, contact details, and session data | United States-based provider; remote processing or support access may occur outside the EEA |
| DigitalOcean, LLC | Cloud hosting, databases, and file storage | Account records, monitor configurations and results, audit logs, and screenshots | EU, Frankfurt (Germany) data centers |
| Cloudflare, Inc. | Website and API delivery, reverse proxy, and security | Visitor IP addresses, request and security metadata, and traffic content needed to deliver and protect the Service | Global edge network; processing may occur outside the EEA |
| Resend | Transactional service and alert email delivery | Recipient email addresses, message content, and delivery event metadata | Resend states its primary processing operations take place in the United States. The AMS (Amsterdam) region is configured for production email delivery and may describe where mail is sent from; provider and sub-processor processing may occur elsewhere. |
6.2. We use these direct sub-processors under their applicable data-processing terms: Clerk, DigitalOcean, Cloudflare, and Resend. We will update this list and give customers prior notice of additions or replacements to our direct sub-processors as described in Section 13 and the DPA. Sub-processors of our providers are listed on the providers' own pages.
6.3. We may also disclose data to other recipients: (a) professional advisers (lawyers, accountants, auditors) under confidentiality duties, (b) authorities where legally required, (c) parties as needed to protect our rights or investigate abuse, and (d) a successor in a merger or sale of our business, subject to this policy.
7. International Transfers
7.1. Persistent application and database data is hosted in Frankfurt, Germany. Cloudflare operates a global network and Clerk provides authentication. Resend states that its primary processing operations take place in the United States; the AMS (Amsterdam) region configured for email delivery may describe where mail is sent from, not where all processing occurs.
7.2. Some providers are based outside the EEA or operate globally, so personal data may be accessed or processed outside the EEA. For transfers to the United States, we rely on EU-U.S. Data Privacy Framework certification where the provider holds an active certification; otherwise, or if the EU-U.S. Data Privacy Framework ceases to be a valid transfer mechanism, we rely on Standard Contractual Clauses. For other restricted transfers, we rely on an applicable adequacy decision or Standard Contractual Clauses, together with supplementary measures where required. The providers' current DPAs describe their transfer mechanisms; copies or further information are available by emailing us.
8. Data Retention
8.1. We keep personal data only as long as needed for the purposes in this policy.
| Data | Retention |
|---|---|
| Metrics, incidents, audit logs, and execution records | Deleted by the scheduled retention job according to the workspace's configured retention policy. The default is 7 days when no positive value is configured; available policy presets include 30 days and 365 days. The 365-day preset also covers audit logs containing acting user IDs, which we retain for security investigations and dispute handling. The configured value may vary by workspace. |
| Synthetic-test screenshots | The screenshot cleanup retains the latest successful execution and the five most recent critical executions for each synthetic test. This is count-based, not a fixed number of days; older screenshots are removed as newer runs supersede them or when the associated data is deleted. |
| Monitor configurations | While the workspace is active and the monitor exists; on termination, deletion follows Section 8.5 of the Terms and Section 8 of the DPA. |
| Account and authentication data | While the account is active; deleted or anonymised from active systems within 30 days after account closure, subject to legal obligations and legal claims. |
| Server and security logs | We retain these logs for as long as reasonably necessary for security, abuse prevention, troubleshooting, and incident investigation. Production application-container logs are size-rotated to no more than three 10 MB files per container, so their retention duration varies with log volume. Logs held by Cloudflare or other providers follow those providers' retention schedules. Records relating to a specific incident or legal claim may be retained longer as necessary. |
| Support correspondence | For up to 24 months after the last support interaction, except where longer retention is required by law or needed to establish, exercise, or defend legal claims. |
| Backups | If enabled, DigitalOcean retains native Droplet backups for four weeks on weekly schedules or seven days on daily schedules; usage-based backups follow their configured retention period, and snapshots remain until deleted. Separately configured application-consistent backups follow the retention period set for their private destination. Backup copies are protected and not used for ordinary service operations. Resend deletes its customer data within 90 days after termination under its DPA. |
8.2. We may keep limited data for longer where law requires (for example, accounting or tax duties if we introduce paid plans), or where needed to establish, exercise, or defend legal claims, or to enforce bans for abuse.
8.3. Because the Service is in public beta, we may reset or delete beta data as permitted by our Terms.
9. Cookies, Local Storage, and Trackers
9.1. We do not currently use analytics or advertising tags, marketing profiles, or social-media pixels.
Our emails do not contain tracking pixels or click-tracking links.
9.2. The Service may use:
- Session cookies needed by Clerk to sign you in and secure your session;
- Security cookies or identifiers that Cloudflare may use to protect and deliver the website;
- Legal-consent cookies:
steadynode_legal_consentrecords your signed consent receipt for up to one year.steadynode_legal_consent_intentrecords your signed pre-registration consent for up to seven days and is cleared after completion. Both cookies are HttpOnly, SameSite=Lax, and Secure in production; - Browser local storage:
steadynode-themestores your theme preference. On authenticated dashboards,steady-node:website-monitor-sort:<websiteId>andsteady-node:website-incident-sort:<websiteId>store sorting preferences.
Clerk and Cloudflare set provider-specific cookie names and durations that may depend on your session or security checks.
9.3. We do not currently use optional analytics or advertising technologies. Blocking cookies or local storage may affect sign-in, security checks, or saved interface preferences.
9.4. If we add technologies that require consent under applicable law, we will provide the required choice before they are used.
10. Security
10.1. We use appropriate technical and organisational measures under Art. 32 GDPR. These include encryption in transit (TLS), access controls, least-privilege access for staff, network isolation, and logging of administrative access.
10.2. As processor, we notify affected customers without undue delay after becoming aware of a personal-data breach, as described in the DPA. As controller, we notify the competent supervisory authority within 72 hours where required and affected individuals without undue delay where required by law.
10.3. Please protect your login credentials and API tokens. We recommend using least-privilege, dedicated test credentials in monitors.
11. Your Rights
You have the following rights under the GDPR, for the personal data that we process as controller:
- Access (Art. 15): get confirmation of whether we process your data, and a copy.
- Rectification (Art. 16): have inaccurate data corrected or incomplete data completed.
- Erasure (Art. 17): have your data deleted where the legal grounds apply.
- Restriction (Art. 18): have processing limited in certain situations.
- Data portability (Art. 20): receive data you provided in a structured, commonly used, machine-readable format, where processing is based on contract and carried out by automated means.
- Objection (Art. 21): object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.
- Lodge a complaint with a supervisory authority (Art. 77), see 11.3.
11.1. How to exercise your rights: email [email protected]. We may ask you to verify your identity. We respond within one month (extendable by up to two further months for complex requests, with notice). Exercising your rights is free, unless requests are manifestly unfounded or excessive.
11.2. If you are an employee or client of a customer and your data appears in a customer's monitor data, please contact the customer that configured the monitor, which is responsible for handling your request under its role. We will assist customers with data-subject requests as set out in the DPA.
11.3. Supervisory authority. You may complain to the authority in your EU/EEA Member State of residence, workplace, or the place of the alleged infringement. The Hungarian supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH), Nemzeti Adatvédelmi és Információszabadság Hatóság:
- Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
- Postal address: 1363 Budapest, Pf. 9
- Phone: +36 (1) 391 1400
- Website: naih.hu
For current complaint and filing options, see the official NAIH website. You also have the right to bring proceedings before a competent court.
12. Data Protection Officer
We have not appointed a Data Protection Officer. For data-protection enquiries, contact [email protected].
13. Changes to This Policy
We may update this policy to reflect changes in the Service, our providers, or the law. We will post the updated version with a new effective date and notify account holders by email or in-app notice at least 30 calendar days before a material change takes effect, except where a shorter period is required by law or reasonably necessary to address an urgent security issue. We will give at least 30 calendar days' prior notice before adding or replacing a direct sub-processor and provide a right to object on reasonable data-protection grounds under the DPA. Where an urgent replacement is necessary because of provider failure, a security risk, or a legal requirement, we may give shorter notice and will inform customers as soon as reasonably possible. Customers may object on reasonable data-protection grounds after the change under the DPA.
14. Contact
Wild Protection Kft. – Aranyág Kert 23, Hódmezővásárhely 6800, Hungary Email: [email protected]