Privacy Policy
Last updated: October 19, 2026
This policy explains which personal data we process when you use monitory.app, why, on what legal basis, for how long, and which rights you have. It covers the website and the Monitory application.
1. Controller
The controller under the General Data Protection Regulation (GDPR) is: Cyrus Badde, Triq il-Marfa, Bay Blue 2, MLH9065, Mellieha, Malta.
Contact for all privacy questions: hallo@seooptimierung.de.
2. Principles
We only process the data needed to run, secure and bill Monitory. We do not sell personal data, we do not use advertising or tracking cookies and we do not use web analytics services. No automated decision-making with legal effect takes place.
3. Hosting and server logs
Monitory runs on servers of Hostinger International Ltd. located in Germany. When you open the site, the web server processes technically necessary data such as IP address, date and time, requested address, status code and browser identifier to deliver the page and detect abuse.
The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Logs are deleted after a short time unless needed to investigate a security incident.
4. Account and sign-in
For an account we process your email address and password (as a hash, never in plain text). Our service provider Supabase manages account and sign-in data (authentication and database).
If you sign in with Google, we receive your email address, name and Google identifier from Google and request no other data. Google processes data under its own privacy policy.
The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We keep account data as long as your account exists.
5. Protection against abuse at sign-up
For sign-up attempts we store the email address, IP address, time and whether the attempt was blocked (for example because of disposable addresses, "+" aliases or too many attempts). This prevents mass-created accounts that cause costs.
The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f) GDPR). These records are only reviewed internally.
6. Queries, monitors and results
When you ask a query or create a monitor, we store your input (for example question, URL, keyword, brand, prompt), the settings, and the results, histories and alerts. This is necessary to provide the service (Art. 6(1)(b) GDPR). Please do not enter personal data of third parties or confidential content you may not have processed.
To run them we pass the necessary input to providers that deliver answers, search results or web pages:
- Anthropic, OpenRouter and Perplexity: AI models that answer questions and structure text (also to check whether your brand is named in AI answers).
- DataForSEO: search engine results and positions, SEO metrics.
- Firecrawl: fetching and evaluating web pages you have us watch.
- NewsAPI and GDELT: news sources for media monitoring (a plan feature, not available to everyone).
7. Payments
Payments for paid plans are handled by Stripe Payments Europe Ltd. (Ireland). You enter payment data directly with Stripe; we do not receive full card or account numbers, only subscription status, customer number and periods. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and, for retention duties, Art. 6(1)(c) GDPR.
8. Emails
We send system emails (confirmation, password reset, alerts, credit notices, team invitations) through Supabase and Resend. For this we process your email address and the content of the message. We do not send a marketing newsletter. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
9. Slack, webhooks and team
If you have alerts sent to Slack or a webhook address, we transmit the alert content to the address you provide. You are responsible for being entitled to use that address.
If you invite team members, we process their email addresses to send the invitation and enable shared access. Please only invite people who agree.
10. Public report links
If you create a public report link for a monitor, anyone with the link can read the report (results, chart, current data). Alerts, settings, email addresses and webhook URLs are not shown. The page is blocked for search engines. You can end the link at any time; it stops working immediately.
12. Recipients and transfers to third countries
Recipients are the providers named above who support us as processors or independent controllers (hosting, authentication and database, AI and data services, payment, email). Some are located in or process data in the United States. Transfers rely on an adequacy decision (EU-US Data Privacy Framework) or EU standard contractual clauses with supplementary measures.
13. Retention
We keep account data, monitors and results as long as your account exists. If you delete a monitor, its data is deleted with it. After your account is deleted we delete your data unless a statutory retention duty applies (for example invoices) or we need it to defend legal claims. Sign-up records (section 5) are deleted after a reasonable time.
14. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future.
Write to hallo@seooptimierung.de for this. You can also lodge a complaint with a supervisory authority: in Malta the Office of the Information and Data Protection Commissioner (IDPC), https://idpc.org.mt, or the authority where you live.
15. Obligation to provide data
Without an email address and password (or Google sign-in) we cannot create an account. To use the query and monitor features the respective input is required.
16. Changes
We update this policy when the service or the law changes. The version published here applies.