Policies
Privacy Policy
What personal data Observer processes, why, where it lives, and what rights you have. Plain language.
This Privacy Policy explains what personal data Observer processes, why, where it lives, and what rights you have. We have tried to write it as plainly as we can. Where a defined term is used, it has the meaning given to it in the Terms of Service.
Summary in plain English
- Observer is a SaaS that does monitoring and runs status pages. We collect the personal data we need to operate the Service and bill for it.
- Our production database, its continuously replicated standby, and its backups are held in the European Economic Area and the United Kingdom. Some service providers process data elsewhere, including in the United States, under recognised transfer safeguards. Every provider, and where it processes data, is listed on the Subprocessors page.
- We do not sell your data. We do not use your data to train AI models. We do not run third-party advertising or tracking.
- When you delete your account or organisation, the data is removed from active systems and deleted from backups within 90 days, unless the law requires us to keep it.
- You have rights under UK GDPR and EU GDPR (access, rectification, erasure, portability, restriction, objection). California residents have equivalent rights under CCPA/CPRA. Write to [email protected] to exercise them.
1. Who we are
Observer is operated by a sole trader based in England, United Kingdom, trading as "Observer". For the purposes of UK GDPR and EU GDPR, we are the controller for the personal data we collect about our direct customers and their users (the people who sign up to, use, and pay for the Service), for the visitors to our website, and for support requests sent to us.
When you use the Service to process personal data about other people (for example, subscribers who receive incident emails from your status page, viewers you allow onto a private page, or your own customers' contacts), you are the controller of that data and we process it as your processor under the Data Processing Agreement.
We do not have a statutory obligation to appoint a Data Protection Officer because the scale and nature of our processing do not meet the thresholds in UK GDPR Article 37 / EU GDPR Article 37.
- Contact: [email protected]
- Security disclosure: [email protected]
- Trading address: available on request from [email protected]
2. What personal data we collect
The table below covers everything we collect that is, or could be, personal data.
| Category | Specific fields | Where it comes from |
|---|---|---|
| Account identity | User ID, email address, optional username, optional first and last name, profile picture where your sign-in provider supplies one, last sign-in timestamp | Provided by you at sign-up, or by Google or Microsoft if you choose to sign in with them; mirrored from our authentication provider when you create or update your account |
| Organisation information | Organisation name, organisation members, your role in the organisation | Provided by you when you create or join an organisation |
| Sign-up source | For the first organisation you create: the campaign tags, referring website (host name only) and landing page that brought you to sign up, carried in the sign-up link. No cookie or browser storage is used for this | Your browser, when you follow a link to sign up |
| Subscription information | Plan tier, trial and subscription status, billing period dates, opaque subscription identifiers | Generated by our billing provider when you subscribe or change plan. We never see card data. Card details are handled by Stripe through our billing provider; we receive only status and plan information |
| API keys and connected apps | Names and SHA-256 hashes of API keys, and the authorisations you grant to apps and AI agents that connect to your organisation | Created by you in the console |
| Customer records you create | Where you create customer records (for customer-scoped status pages and reliability portals), the customer's name, contact email addresses, and optional external identifier | Provided by you. You are the controller of this data; we process it on your behalf |
| Status page subscribers | Email address, or a Slack, Microsoft Teams or webhook destination (stored encrypted); opaque confirmation and unsubscribe tokens; the services and notification preferences they chose. If they add a status pass to Apple Wallet: a device identifier and a push token (the push token is stored encrypted) | Provided by the subscriber when they opt in to updates from one of your status pages. You are the controller of this data; we process it on your behalf as documented in the DPA |
| Private status page viewers | For pages protected by sign-in: the viewer's verified email address, checked against your allowlist and held only in a signed cookie in the viewer's browser for up to 12 hours (not in our database) | Returned by Google, Microsoft or your own identity provider when the viewer signs in. You are the controller |
| Audit records | Your IP address, your browser User-Agent string, the action you performed and on which resource | Captured automatically when you act on the Service through the console or API |
| Customer-configured monitoring data | Metric definitions, probe configurations (URLs, hostnames, queries, thresholds), the readings and status verdicts the Agent or our hosted checks report, status timestamps, the host name and version of each Agent. Credentials such as database connection strings, certificates and tokens are referenced by environment-variable name, so their values stay on your host | Provided by you and your Agents. May contain personal data if you monitor systems whose URLs or queries embed personal data; we recommend that you do not |
| Incident and status content | Incident and maintenance messages, postmortems, and anything else you publish or store, including any names or contact details you choose to write into them | Provided by you |
| Inbound alerts | Alert payloads your own tools send to Observer (for example from Alertmanager or Grafana), which can contain whatever those tools include | Sent by systems you configure |
| Notification records | For each alert and subscriber notification: the channel, the recipient reference, delivery status and errors, and the rendered message | Generated when the Service sends a notification |
| Email delivery | Whether an email to a given address was delivered, bounced or marked as spam | Reported back by our transactional email provider |
| Support requests | Your message and replies, your email address, the severity you chose, and context captured automatically (organisation, plan, role, the console page you were on, your browser). If you choose to attach them: a screenshot, recent console logs, errors and network request summaries from your browser (with keys and tokens removed before they leave your browser), and a screen recording with form inputs masked | Provided by you when you contact support from the console |
| Status page views | Daily view counts per page by country (derived from the request at our CDN) and referring website. No IP address, cookie or identifier is stored | Counted on our server when a page is viewed, and shown to the page owner |
| Operational and security data | IP addresses and request metadata, held briefly for rate limiting and abuse prevention; operational logs and traces that can include account and organisation identifiers | Generated automatically when you use the Service |
We do not intentionally collect special-category personal data (health, race, religion, sexual orientation, political opinion, trade union membership, genetics, biometrics, criminal records). If you choose to include such data in monitoring configuration, customer records, alerts, or status page content, you do so under your own responsibility and lawful basis.
A viewer who simply reads a public status page is not identified: we keep no IP address in the page's view counts, set no cookie, and load no analytics script. Their IP address is processed transiently to deliver the page and to rate-limit abusive traffic.
3. Why we process your data (lawful basis)
| Processing activity | Lawful basis under UK GDPR / EU GDPR |
|---|---|
| Creating and operating your account, including sign-in through Google or Microsoft if you choose it | Performance of the contract between you and us (Article 6(1)(b)) |
| Providing the monitoring, alerting, status page, reporting and AI assist features you have configured | Performance of the contract (Article 6(1)(b)) |
| Sending transactional email (account confirmation, receipts and plan notices, alerts and status changes you have signed up for, weekly SLO reports) | Performance of the contract (Article 6(1)(b)) |
| Setup reminder emails in your first days after sign-up, each with an unsubscribe link | Legitimate interests in helping you finish setting up the Service you signed up for (Article 6(1)(f)) |
| Product update emails (new features and releases), sent only if you turn them on in Settings | Consent (Article 6(1)(a)). Turn them off in Settings or with the link in any of them |
| Billing, invoicing, and processing payments through the billing provider | Performance of the contract (Article 6(1)(b)); legal obligation for record-keeping (Article 6(1)(c)) |
| Answering support requests, including any diagnostics you choose to attach | Performance of the contract (Article 6(1)(b)); legitimate interests in supporting our customers (Article 6(1)(f)) |
| Logging administrative actions and operating logs for security, fraud prevention, debugging, and customer support | Legitimate interests in operating the Service securely and accountably (Article 6(1)(f)) |
| Rate limiting, abuse prevention, IP-based blocking when necessary | Legitimate interests in protecting the Service and its other customers (Article 6(1)(f)) |
| Sign-up source attribution | Legitimate interests in understanding how the Service is used and found (Article 6(1)(f)). See the Cookie Policy |
| Responding to law-enforcement requests, supervisory authority requests, and court orders | Legal obligation (Article 6(1)(c)) |
We do not rely on consent as a lawful basis for the core Service. The only processing based on consent is product update email, which is off until you turn it on, and you can withdraw consent at any time.
We do not engage in automated decision-making with legal or similarly significant effects in the meaning of UK GDPR Article 22.
4. AI features
AI assist drafts incident updates and postmortem fields and, on status pages where you turn it on, translates published messages. It runs on paid plans while it is switched on for your organisation, and any member can switch it off in Settings. Drafts are suggestions: nothing is published until a person in your organisation saves it, except translations on pages where you have turned translation on, which are shown automatically.
The text is sent to Anthropic, which processes it as our subprocessor, does not train models on it, and deletes it within 30 days unless the law or its usage policy requires longer. Before a draft request is sent we remove internal identifiers and text shaped like email addresses, IPv4 addresses, keys and tokens. That removal is pattern-based and does not catch every kind of personal data, so do not write personal data into incident text. Subscriber and end-user contact data is never sent. The details are on the Subprocessors page.
AI assistants and MCP clients. You can connect an AI assistant or other Model Context Protocol client (for example Claude, ChatGPT, Cursor or VS Code) through our MCP server. Each connection is limited to the organisation and permissions you approve, and is backed by an API key you can revoke under Developers, API keys. The MCP server forwards requests to our API and stores nothing itself. We do not receive your conversations with the assistant; the client's provider handles those under its own terms.
5. Who has access to your data
Production database access is limited to a small set of authorised administrators bound by confidentiality obligations. Support attachments are visible only to those administrators.
We share personal data with the subprocessors listed at Subprocessors, which says who they are, what they do, where they process data, and the transfer mechanism that applies. When you or your subscribers choose a sign-in provider (Google or Microsoft), a wallet (Apple Wallet), or a notification destination (for example Slack, PagerDuty or your own webhook), data goes to that provider because of that choice, under its own terms.
We do not sell personal data. We do not share personal data with advertisers, data brokers, or analytics platforms. We do not use personal data to train AI models.
We will disclose personal data to law-enforcement authorities, supervisory authorities, or courts where we are legally compelled to do so. Where the law permits, we will tell you before we comply with such a request.
6. International transfers
Our production database, standby and backups are held in the European Economic Area and the United Kingdom, and personal data may move between the two. Those transfers rely on adequacy: the European Commission's adequacy decision for the United Kingdom covers transfers from the EEA, and the United Kingdom's adequacy regulations covering the EEA cover transfers from the UK.
Some of our providers (including our authentication, billing, transactional email, content delivery network, and AI providers) are based in, or process data in, the United States. Those transfers are covered by the safeguards in each provider's data processing terms: the European Commission's 2021 Standard Contractual Clauses (Decision (EU) 2021/914) together with the UK International Data Transfer Addendum, or, where the provider is certified, the EU-US Data Privacy Framework and its UK Extension. The Subprocessors page shows the mechanism for each provider.
7. How long we keep your data
| Data | Retention |
|---|---|
| Customer Data (metric definitions, probes, customers, status pages, incidents, integrations, configuration) | Held while your organisation exists. When the organisation is deleted, it is removed from active systems straight away and from backups as they expire, in all cases within 90 days, unless the law requires us to keep it |
| Raw metric readings and per-location check results | 90 days, then deleted automatically. One-minute aggregates are also kept for 90 days |
| Hourly and 15-minute status rollups (the history behind uptime bars and SLA reports) | Up to 400 days, so a full 12-month record is available, then deleted automatically |
| Inbound alerts | 90 days after they are received (or, for alerts still open, 90 days after they resolve) |
| Heartbeat pings | 30 days |
| Notification records (delivery status and rendered message) | Held while your organisation exists; deleted with it |
| Account identity (email, name, profile) | Held while your user account exists. When you delete your account, it is removed from active systems straight away and from backups within 90 days. Organisations you belonged to are not affected |
| Subscription and billing records | Kept by us and our billing provider for as long as UK tax and accounting law requires (currently up to 7 years after the last invoice) |
| Audit log (administrative actions, IP, User-Agent) | 90 days, after which records are deleted automatically. Records are also deleted when their organisation is deleted. When you delete your user account, your entries stay until they expire but no longer point to you |
| Support requests | The request, replies and context are held while your organisation exists, and the ones you filed are deleted when you delete your user account. Screenshots and screen recordings are deleted automatically after 60 days |
| Wallet passes | The device identifier and push token are removed when the pass is deleted from the device. Other pass records are held while the subscription and page exist |
| Status page view counts | Daily aggregates, held while the page exists |
| Private page sign-in | Held only in the viewer's browser, for up to 12 hours |
| Transactional email logs held by our email provider | Subject to that provider's retention |
| Backups | Currently retained for up to 30 days to allow point-in-time recovery. Data inside a backup is deleted when the backup expires |
We do not extend retention to "improve the Service" or for unspecified product development. Where we genuinely need to keep something longer (for example, an audit log entry tied to an unresolved security incident), the extension is documented and scoped to the specific record.
8. Your rights
If you are in the United Kingdom or the European Economic Area, you have the following rights under UK GDPR or EU GDPR:
- Right of access: to a copy of the personal data we hold about you.
- Right to rectification: to have inaccurate personal data corrected.
- Right to erasure: to ask us to delete personal data we hold about you, where one of the GDPR grounds applies.
- Right to restriction: to ask us to limit how we use your personal data, while a question about it is being resolved.
- Right to portability: to receive your personal data in a structured, machine-readable format, where the processing is based on contract or consent.
- Right to object: to processing based on legitimate interests, on grounds relating to your particular situation.
- Right to withdraw consent at any time, where we rely on consent.
- Right to lodge a complaint with a supervisory authority. For UK residents, the supervisory authority is the Information Commissioner's Office (ICO), ico.org.uk. For EEA residents, the supervisory authority is the data protection authority in your member state.
If you are a California resident, you have equivalent rights under the CCPA / CPRA, including the right to know what personal information we have collected about you, the right to delete that information, the right to correct inaccurate information, the right to limit the use of any sensitive personal information, and the right to opt out of sale or sharing of personal information. We do not sell or share personal information in the CCPA sense, so the opt-out is effectively pre-applied.
To exercise any of these rights, write to [email protected] from the email address associated with your account, or use any equivalent verification method we ask for. We will respond within one month for UK GDPR and EU GDPR requests, and within 45 days for CCPA / CPRA requests. Where the law allows us to extend that period for complex or numerous requests, we may do so; we will tell you within the original period if we need the extension.
If you are a subscriber, viewer, or customer contact of one of our customers' status pages, that customer is the controller of your data. Please contact them first; if you contact us, we will pass your request to them.
We will not discriminate against you for exercising any of these rights.
9. Cookies
We set only strictly-necessary cookies (to keep you signed in, unlock private status pages, and protect sign-in flows) and preference cookies that remember a choice you made, such as a status page language. Public status pages set no cookies for a viewer who simply reads them. We run no analytics or advertising tracking of any kind. The full inventory, with lifetimes, is in the Cookie Policy.
10. Security
A description of the technical and organisational measures we apply to protect personal data is in the Security page. We are honest there about what we do today and about the limits of those measures.
If you discover a security issue, please write to [email protected]. Our disclosure policy and contact details are also available at /.well-known/security.txt.
11. Children
The Service is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at [email protected] and we will delete the data.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to the account owner before they take effect. The current version is always available at https://use.observer/policies/privacy.
13. Contact
- General privacy questions: [email protected]
- Security: [email protected]
- Postal address: available on request
If you are not satisfied with our response to a privacy question, you can lodge a complaint with the Information Commissioner's Office at ico.org.uk (UK) or with the supervisory authority in your member state (EEA).