Who controls your data
J.Ekedahl is the controller for personal data processed through Advisory.watch.
Privacy requests can be sent to Contact by email .
What we collect
We keep the data needed to operate and secure the service. This can include your name, current email address, a pending replacement email during an email-change request, account and membership details, email-verification status, notification preferences, login/session IP address and user agent, two-factor status, security/audit events, and a limited first-party product-usage history linked to your account/login.
When you contact support, your message and reply address are processed through the configured email provider. Payment and billing information may also be processed by a payment provider when paid billing is enabled; payment card details are not intended to be stored by Advisory.watch itself.
Monitoring data primarily describes Drupal sites and their software environment. It may still count as personal data where a site name, URL, note, or account name identifies an individual, so we treat it with the same access controls.
Why we use it
- Provide the service: create and manage accounts, monitor configured sites, generate findings and reports, and send requested operational notifications. The legal basis is performance of the service contract.
- Improve the product: record a small allowlisted set of authenticated page visits and meaningful actions so we can understand which features are actually useful. We do not record arbitrary clicks, monitored-site URLs, Site Guardian keys, or form contents for this purpose. The legal basis is our legitimate interest in improving the service while keeping measurement proportionate.
- Protect the service: authenticate users, prevent abuse, investigate faults, and maintain security/audit records. The legal basis is our legitimate interest in running a secure and reliable service.
- Meet legal obligations: retain or disclose limited records where applicable law requires it.
- Optional communications: if we later offer marketing that requires consent, it will be separate from operational service messages and can be withdrawn.
Drupal monitoring
Advisory.watch uses a read-only Site Guardian connection to retrieve technical maintenance data such as Drupal/core/project versions, update information, environment details, site-health information, and configured site notes. It does not log into Drupal as a user, read Drupal user accounts or content, or make changes to the monitored site.
How long we keep data
- Active account/profile data: while the account or login remains active.
- Unverified self-registrations: normally 7 days.
- Raw monitoring checks: normally 90 days, while longer-lived health snapshots may be kept to provide history.
- Notification delivery history: normally 180 days.
- Privileged security/audit history: normally 365 days.
- Detailed first-party product usage events: normally 180 days.
- Support correspondence and backups: retained only as long as reasonably needed for support, security, recovery, or legal requirements.
Deletion from live systems may not immediately remove data from encrypted backups. Backup copies are allowed to expire through the normal backup-retention cycle and are not restored for ordinary use after a deletion request.
Service providers and international transfers
We use infrastructure and service providers needed to host the application, deliver email, store backups, and process payments when billing is enabled. Those providers act under their own terms and, where they process personal data for us, we use appropriate processor arrangements where required.
If personal data is transferred outside the European Economic Area, we use an available lawful transfer mechanism where required, such as an adequacy decision or standard contractual clauses. You can contact us for current provider and transfer information.
Cookies and local storage
The service uses strictly necessary session/security storage and browser local storage for preferences such as theme and interface size. Authenticated product usage is measured server-side without adding an analytics cookie or cross-site identifier. We do not currently use advertising cookies or cross-site behavioural tracking. If non-essential browser analytics or marketing technologies are introduced later, this policy and any consent mechanism will be updated first.
Your rights
Where the GDPR applies, you may have rights to information, access, correction, erasure, restriction, portability, and objection. You can download a machine-readable copy of application-held personal data from Settings. You can also delete your login there when account-ownership safeguards permit it.
Some rights are not absolute. For example, limited information may need to be retained for legal claims, fraud prevention, or security obligations. If your login is the only owner of an account that still has other members, ownership must first be transferred so their shared portfolio is not accidentally destroyed.
You may also lodge a complaint with the data-protection authority that applies to you. Privacy requests can be sent to Contact by email .
Security
We use measures intended to limit access to personal and monitoring data, including encrypted Site Guardian credentials, password hashing, optional two-factor authentication, role-based access, and privileged audit logging. No online service can guarantee absolute security.
Changes to this policy
We may update this policy as the service, providers, or legal requirements change. Material changes will be reflected by a new effective date and, where appropriate, communicated to account users.