1. Who we are
SITE QWALITY INC., a Delaware corporation, is the controller of the personal data described in section 3.
SITE QWALITY INC.
254 Chapman Rd Ste 208 # 10720
Newark, Delaware 19702
United States
Privacy requests: privacy@siteqwality.com. Security: security@siteqwality.com. Support: support@siteqwality.com.
Shawn Allen, Chief Executive Officer (ceo@siteqwality.com), is accountable for data protection. We have not appointed a Data Protection Officer, as we do not consider one required under Article 37 GDPR. We have not appointed a representative in the EU under Article 27 GDPR or in the UK, and do not intend to. Send anything meant for a representative to privacy@siteqwality.com or the address above.
2. Controller and processor
We are the controller for data about our account holders, billing contacts, people who contact us, visitors to our websites, domain registrants returned by WHOIS lookups, and our staff.
We are a processor for data our customers collect through the Services: real user monitoring and session replay, logs, metrics, traces, check results, alert recipients and status page subscribers. Our customer decides what is collected and why, and our Data Processing Addendum governs that processing. If you are a visitor to a website that uses Site Qwality, contact that website’s operator about your data. If you contact us instead, we will forward your request to them where lawful and tell you.
3. What we collect
| Who | What we collect | Why |
|---|---|---|
| Account users | Name, email, sign-in credentials (password hash or federated identity, two-factor secrets and passkey public keys), role, time zone, sessions, API key digests, and audit records with IP address and user agent. With your consent, our own real user monitoring and session replay of the dashboard (see the Cookie Policy). | Providing the Services, security, support and finding errors in the dashboard. |
| New sign-ups | Where your first visit came from (from the sq_ft cookie, if you allowed analytics) and, if you answer, how you heard about us. |
Understanding which channels bring customers. |
| Billing contacts | Name, email, Stripe customer, subscription and invoice identifiers, and an affiliate referral identifier if you arrived through one. Card details go directly to Stripe and never reach us. | Payment, invoicing, tax and accounting. |
| People invited to an account | Email, role and invitation details, provided by the person who invited you. | Sending and managing the invitation. |
| Website visitors | IP address, cookie and device identifiers, pages viewed and referrer, through the tags listed in the Cookie Policy. | Analytics, advertising measurement, session recording and affiliate attribution. |
| People who contact us | Name, email, topic, message and IP address. The form uses Cloudflare Turnstile to block spam. | Answering you. We do not add you to a marketing list. |
| “Is it down?” alert subscribers | Email, the service you chose, and sign-up and confirmation times. | Sending the alerts you asked for. Unconfirmed sign-ups are deleted after 2 days; confirmed ones are kept until you unsubscribe. |
| “Is it down?” problem reports | The service, problem type and time window, with a daily-rotating keyed hash of your IP address. Your IP address is not stored. | Showing report counts and preventing repeat reports. Deleted after 3 days. |
| Domain registrants | Registrant contact details returned by a domain’s registry or by Whoxy when a customer monitors that domain. | Domain-expiry monitoring. We need the expiry date; the contact details come with it. |
| Our staff | Identity, IP address, user agent and every administrative action, including the reason for accessing a customer account. | Access control and accountability. |
Data we process for customers. As a processor we store what a customer configures or sends: real user monitoring and session replay data about visitors to their websites (pages, performance, interactions, errors, device and approximate location, and any user details the customer attaches); alert destinations and delivery records; status page subscribers; check results, including request headers and response extracts; and logs, metrics and traces as sent. The SDK removes query strings and credentials from URLs before storage. The DPA and our documentation describe these categories and the customer’s privacy controls in detail.
The Services are not designed to hold special categories of data under Article 9 GDPR. Please do not send them.
4. Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing your account and the Services, billing | Contract, Art. 6(1)(b) |
| Tax and accounting records | Legal obligation, Art. 6(1)(c) |
| Security, audit logs and abuse prevention | Legitimate interests, Art. 6(1)(f): running a secure service and showing what happened in it |
| Invitations, answering inquiries and domain-expiry lookups | Legitimate interests, Art. 6(1)(f): providing what a customer or you asked for |
| “Is it down?” report counts and how-you-heard-about-us answers | Legitimate interests, Art. 6(1)(f): showing reliable report counts and knowing which channels reach customers |
Analytics, advertising, session recording and our own real user monitoring, including the sq_ft cookie | Consent, Art. 6(1)(a) and ePrivacy Art. 5(3), where the consent gate applies (section 5) |
| “Is it down?” alerts and marketing email | Consent, Art. 6(1)(a) |
| Data we process for customers | Determined by the customer as controller |
Account and billing details are needed to provide the Services; without them we cannot open an account. Everything else is optional. Where we rely on legitimate interests, you can object (section 9).
5. Cookies and tracking
Our websites use Google Analytics 4, Google Ads, Microsoft Clarity, PromoteKit and our own real user monitoring. In the EEA, the UK and Gibraltar these run only after you consent. Elsewhere they run by default and you can turn them off with Cookie preferences. We treat Global Privacy Control and Do Not Track as a refusal on our marketing sites. Your consent choice is stored only in your browser. The Cookie Policy has the details.
We do not sell personal data. Our use of Google Ads conversion tags may count as “sharing” for cross-context behavioral advertising under some US state laws. You can opt out by rejecting the Advertising category or by sending Global Privacy Control.
6. How long we keep data
We keep account data while your account exists, and other categories for the periods on our Data Retention page. Some records, such as account and audit records, have no automatic deletion today; that page lists them, and we delete them on request (section 9).
7. Who we share data with
We use service providers to run the Services, listed with their locations on our Subprocessors page. We also disclose data when the law requires it, to professional advisers, and to a buyer or successor in a merger or acquisition, in which case we will update this policy first.
8. International transfers
We are a US company. Our infrastructure is in the United States (AWS us-east-1, with a standby copy of public status pages in us-west-2). Customers can run checks from locations in other countries; results are stored in the United States. Our content delivery network serves requests from edge locations worldwide, including Europe. Some providers process data in other countries, as listed on the Subprocessors page. Our dashboard host, AWS Amplify, keeps access logs (IP address, user agent and address requested) for as long as the application exists.
For transfers of personal data from the EEA or the UK, Standard Contractual Clauses (with the UK Addendum where needed) are available through our DPA. We are not certified under the EU-US Data Privacy Framework.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, to object to processing based on legitimate interests or to direct marketing, and to withdraw consent at any time. We do not make decisions with legal or similarly significant effects based solely on automated processing.
Email privacy@siteqwality.com. We reply within one month, may ask you to confirm your identity, and will tell you if we need up to two more months. There is no fee unless a request is manifestly unfounded or excessive. Our staff handle these requests directly.
Deletion. Closing an account ends access but does not erase all its data. To have it erased, ask us and we will confirm what was deleted. Deleted data can remain in backups for up to 35 days, and we keep billing and tax records for as long as the law requires.
California and other US state residents have the same intake address, and we will not discriminate against you for exercising your rights.
You can complain to a supervisory authority where you live, work or believe an infringement happened. The European Data Protection Board lists EU authorities; in the UK it is the ICO.
10. Email we send
- Alerts and service email (monitor alerts, account and billing notices, invitations, support) are part of the Services. To stop them, change the alert destination in the dashboard or close the account.
- Lifecycle and marketing email carries an unsubscribe header. Use it, or write to support@siteqwality.com, and we will stop.
- “Is it down?” alerts are sent only after you confirm. Each includes a one-click unsubscribe link, which deletes your sign-up.
11. Security and breaches
We encrypt connections with TLS 1.2 or later, hash passwords and API keys, enforce role-based access and log account activity. Our Security page and DPA list the measures in place. We hold no SOC 2 or ISO 27001 certification of our own.
If a breach affects data we process for a customer, we notify that customer within 72 hours of becoming aware of it. Where we are the controller, we notify the supervisory authority and, if the risk to you is high, you.
12. Children
The Services are for businesses and are not directed to anyone under 16. If you believe a child has given us personal data, contact privacy@siteqwality.com and we will delete it.
13. Changes
We will update the date above when we change this policy, and note material changes on this page.