Privacy Policy

1. Who we are

AlertKick Ltd (company number 17201100), registered office 25 Watery Lane, Northolt, UB5 6QL, United Kingdom, operates the AlertKick service at alertkick.com and the AlertKick mobile app ("AlertKick", "we", "us"). We are the controller for the personal data described in this policy. Contact our privacy team at privacy [at] alertkick [dot] com .

2. Controller or processor: which applies

We handle personal data in two different roles:

• As controller for data about website visitors, people who contact us, and the users of customer accounts (names, emails, sign-in records, billing contacts), and for data about how the service is used. This policy covers that.
• As processor for the monitoring data our customers choose to send us from their servers and integrations (hostnames, IP addresses, usernames, SSH sessions, log excerpts, alert content). The customer decides what to send and why; we process it on their instructions under the Data Processing Agreement. If you are an employee or contractor of an AlertKick customer and have questions about monitoring of systems you use, please contact that customer first; we will help them respond.

3. What we collect and why

Account and profile data

Name, email address, password (stored only as a hash), phone number if you enable SMS or WhatsApp alerts, time zone, role, on-call schedule, notification preferences, mobile device push tokens, and, if you sign in with GitHub or Google, the name, email, and provider user ID they give us. Used to create and secure your account, deliver alerts to you, and run on-call rotas.

Billing data

Billing name and address, VAT number, plan, invoices, and payment status. Card details are entered directly into and held by Stripe; we see only the card brand, last four digits, and expiry. Used to charge for paid plans and keep financial records.

Usage and technical data

IP address, browser and device information, sign-in times and outcomes, pages and features used, API calls, agent versions and heartbeat status, error reports, and support requests. Used to keep the service secure (for example rate limiting and blocking abusive sources), diagnose problems, understand which features are used, and improve the service. On the marketing website, and only if you consent, Microsoft Clarity records anonymised usage (clicks, scrolling, session replays with typed text masked) so we can improve the site; Microsoft is listed on our sub-processor page.

Communications

Emails and support conversations with us, and messages you send through the contact form. Used to answer you and keep a record of what was agreed.

Monitoring data (as processor)

Described in section 2 and in Annex I of the DPA. We use it only to provide the service to the customer who sent it. We also derive aggregated statistics that do not identify anyone (for example counts of detections by rule) to operate and improve the service.

Marketing

If you sign up for our newsletter or register interest, your email address and name, and whether you opened or clicked our emails. Used to send you the content you asked for. Every email has an unsubscribe link. We do not buy marketing lists and do not send marketing SMS.

4. Legal bases

Under UK GDPR and EU GDPR we rely on:

• Contract (Article 6(1)(b)): to provide the service you or your organisation signed up for, including accounts, alert delivery, billing, and support.
• Legitimate interests (Article 6(1)(f)): to secure and protect the service and our customers, prevent abuse and fraud, understand and improve the product, keep business records, and contact existing business customers about closely related products. We balance these interests against your rights, and you may object (section 11).
• Consent (Article 6(1)(a)): for newsletter and marketing emails where required, for SMS alerts (you opt in and verify your number), and for website analytics cookies (Microsoft Clarity). You can withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): to keep tax and accounting records, respond to lawful requests, and meet data-protection duties such as breach notification.

5. AI features

Some features use large language models to analyse events, triage alerts, and write incident summaries. Inference runs on Amazon Bedrock in the EU (Ireland). Inputs and outputs are not used by Amazon or by us to train models, and are not retained by Amazon after the request completes. AI output is advisory; the customer's team decides what to do with it, and the Terms of Service explain its limitations. We do not make decisions about individuals that produce legal or similarly significant effects by automated means.

6. Who we share data with

We do not sell personal data and do not share it with third parties for their own marketing. We share it only with:

• Sub-processors that help us run the service, each under a written contract limiting use to our instructions. The full list, with purposes and locations, is on our sub-processor page: infrastructure hosting (Hetzner), edge and DNS (Cloudflare), AI inference and package distribution (Amazon Web Services), transactional email (Mailgun, EU), payments (Stripe), SMS and WhatsApp (Twilio), mobile push (Expo, Apple, Google), and, if you connect them, Slack and Telegram.
• Your organisation. Administrators of the account you belong to can see your profile, activity within the account, and notification settings.
• Sign-in providers (GitHub, Google) if you choose to sign in with them; they act as independent controllers.
• Professional advisers and authorities where needed to comply with law, enforce our terms, protect rights and safety, or respond to a lawful request. We will tell you about such requests where the law allows.
• A successor if we sell, merge, or reorganise the business, under the same protections.

7. Messaging integrations (Slack, Telegram, WhatsApp)

When a customer connects a messaging integration, we store the credentials and identifiers needed to deliver alerts to that service. For Slack this means the workspace ID, bot token, and channel identifiers. When a workspace member acknowledges or resolves an alert from Slack, or talks to the bot, we look up that member's email address to attribute the action to the matching AlertKick user in the audit trail; the email is used only for that matching. When the bot is mentioned in a thread it reads that thread's replies to answer with context; it does not read or store other messages. Integration data is used only to deliver and respond to alerts, is deactivated as soon as the integration is disconnected or the app is uninstalled, and is removed when the account is deleted. We never use integration data for advertising.

8. Where data is stored and international transfers

Customers choose a home region when they create an account: EU (Finland) or US (Virginia). Account and monitoring data is stored on dedicated servers in that region. We are a UK company and access data from the UK to operate and support the service; the UK is covered by an EU adequacy decision, and the EEA by UK adequacy regulations.

Some of our sub-processors are in the United States or operate globally. Where personal data is transferred outside the UK or EEA, we rely on an adequacy decision (including the EU-US Data Privacy Framework and its UK Extension for certified providers) or on the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum, plus additional safeguards where needed. You can ask us for details of the mechanism used for a particular provider.

9. How long we keep data

• Account data: for as long as the account exists. When you delete your account, or delete a user, the personal data is removed from live systems within 30 days and from any residual copies within 90 days.
• Monitoring and event data: for the retention period of the customer's plan (7, 30, or 90 days as published on the pricing page), then removed automatically; and for 30 days after a paid plan ends, for export.
• Billing records: 7 years after the transaction, to meet tax and accounting law.
• Security and access logs: up to 12 months.
• Support and contact emails: up to 3 years after the last contact.
• Marketing lists: until you unsubscribe, then a suppression record so we do not email you again.

10. Security

We encrypt all traffic in transit, store passwords only as salted bcrypt hashes, encrypt integration credentials at rest, isolate every tenant by subdomain, restrict production access to named operators over a private VPN, and monitor our own infrastructure with AlertKick. The full list of technical and organisational measures is in Annex II of the DPA and summarised on the security page. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and any relevant regulator as the law requires.

11. Your rights

Depending on where you are, you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where there is no overriding reason to keep it (you can delete your account and its data yourself from account settings, or via the account deletion page);
• restrict or object to processing, including objecting at any time to direct marketing and to processing based on legitimate interests;
• receive the data you provided in a portable, machine-readable format;
• withdraw consent at any time where we rely on it, without affecting processing before withdrawal;
• complain to a supervisory authority (section 15).

To exercise a right, email privacy [at] alertkick [dot] com from the address on your account or with enough information for us to verify you. We respond within one month, extendable by two further months for complex requests, and do not charge unless a request is manifestly unfounded or excessive. If your request concerns monitoring data sent to us by a customer, we will pass it to that customer and help them respond.

12. Cookies

The marketing website sets no cookies of its own and stores your theme and cookie choice in your browser's local storage. With your consent, and only then, it loads Microsoft Clarity for usage analytics; you can accept or reject this in the cookie banner and change your mind at any time. The application sets strictly necessary cookies for sign-in sessions, CSRF protection, and remembering your account subdomain. Details are in the Cookie Policy.

13. Children

The service is for businesses and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We will post changes on this page and update the date at the top. For material changes we will also notify account administrators by email or with a notice in the service before they take effect.

15. Contact and complaints