Privacy Policy

1. Who we are

ViperSonar is a monitoring service operated by IOT LTD, a company registered in Cyprus (registration number HE343300; registered office Mnasiadou 9, Demokritos Building, 1065 Nicosia, Cyprus) ("ViperSonar", "we", "us"). IOT LTD is the controller of the personal data described here, with one exception: the data about your devices, and about the people you add as alert recipients, which we process on your instructions as your processor (the Terms are our data processing agreement). We hold the address-wide records that prevent unwanted email as controller, for our own safety purpose. For privacy questions or requests, email support@vipersonar.com.

2. Data we collect

We collect what we need to run the Service:

• Account information. Your name, email address, organisation and workspace names, your role in each, a hashed password when you use one, the identifier of a Google or Microsoft sign-in when you use one, and your two-factor settings.
• Mailbox verification limits. A SHA-256 hash of the normalised email address, wrong-code attempt totals, send counts and the times used to enforce the limits. This record is keyed to the mailbox, rather than to an account.
• Device and network data. What you and your collectors tell us about the devices you monitor: names, tags, IP addresses, hostnames, MAC addresses, SNMP system names and descriptions, network interfaces and firmware versions — the settings of the checks you create, which can include the headers and body of an HTTP request and an SNMP community string — and what your checks find: each device's and check's state, measurements such as response times, and any messages they carry.
• Discovery scans. When you start a discovery scan, we keep the options you chose, which can include an SNMP community string, and your collector reports the devices it finds in the address ranges you chose: their open ports, the version banner of an SSH service, and the identifying headers, title and a short extract of any web page they serve.
• Collector details. Each collector's version, operating system, counters and the public IP address it connects from.
• Signals. The heartbeats your jobs and devices send, with any message or data they carry. A signal sent by email to a device's address is received for us by Resend, which keeps the whole message for 30 days; we fetch it from Resend, keep only its sender, subject, the time it arrived and the results of Resend's checks of the sender, and keep nothing of its body or attachments.
• Alert settings and deliveries. The email addresses, phone numbers, webhook addresses and connected services you set up for alerts, and a record of each alert we send.
• Email recipient choices. For each workspace and email address, we keep confirmation and stop times, a hash and expiry for a pending confirmation link, and delivery suppression reasons, times and failure counts. Separately, a keyed hash of the normalised email address identifies its global block choice, provider bounce or spam-complaint suppression, and confirmation-request times used to prevent repeated requests across workspaces. That safety record does not contain the email address in plain text. A recipient's answer is recorded on the recipient or address-wide safety record, without attributing it to a Service account or putting it in the account audit log.
• Incidents. Incident history, including any notes you or your colleagues add.
• Billing. Our payment processor, Stripe, collects your payment details. We keep the plan you are on, Stripe's references to your subscription, and the messages Stripe sends us about your payments and billing details, which can carry your billing name, email address, postal address and VAT number. When a VAT number you give Stripe does not match the country of the address Stripe uses to determine tax or could not be verified on a reverse-charged invoice, we also keep a record of that case: the number, the two countries and the name and address the VAT register holds for the number.
• Operational logs. IP address, user agent, request times and error reports, used for security, debugging and rate limiting.
• Security records. Your sign-in sessions, and a record of each sign-in and security action on your account, with the IP address and browser it came from and the approximate location derived from that address; and a record of the main changes to your organisation and its workspaces — deleting, closing and restoring them, billing and plan changes, API keys, publishing a status page or a custom domain — and by whom. We also record the creation, changes and deletion of devices, alert channels, collectors, monitors, maintenance windows and device groups, and manual incident acknowledgments, resolutions and note changes. We record these acts too: acknowledging a device's flapping, sending a test notification through an alert channel, requesting email recipient confirmation, changing or resetting a Monitoring Cadence setting, using Reactivate now on the Billing screen when it changes anything, and re-checking a custom domain. These records name the target and the person who acted, including the original staff operator when acting as a customer, and contain field names rather than field values. Device, collector, alert-channel, monitor, maintenance-window and device-group edits record only the fields that changed; unchanged resource saves and unchanged cadence settings create no record. Reads are not recorded. An acknowledgment through Slack is recorded on the incident timeline with its Slack actor label, without assigning it to a Service account.
• Notifications. What the bell in the app shows you — an invitation, a change to your role in an organisation, a failed payment — and your choices about what reaches you by email.
• Staff access. When our support staff sign in as you to help with a request, a record of it: who signed in, when, the IP address and browser they signed in from, and the reason they gave.
• Cookies. A session cookie (HttpOnly), a cookie that protects form submissions against forgery, short-lived cookies that carry a Google or Microsoft sign-in through to its end, a cookie that remembers whether the side menu is open (seven days), and, on a status page you protect with a password, a one-hour cookie that remembers that a visitor entered it. No advertising or analytics cookies.

3. How we use your data

• To run the monitoring you set up: check your devices, notice missed signals and failed checks, and open incidents.
• To send the alerts you configure, to the destinations you choose.
• To respect email recipients' choices and prevent unwanted or repeated email: we check current verified workspace access or recipient confirmation before sending, honour stop and global block choices, and retain provider suppressions and request limits.
• To show the status pages you decide to publish.
• To sign you in, protect your account, and investigate abuse and operational incidents.
• To limit guesses at verification codes and repeated verification emails, on the basis of our legitimate interest in preventing abuse of mailbox verification (Article 6(1)(f) GDPR).
• To bill for paid plans.
• To charge the right VAT and resolve a VAT number that does not match the country of the address Stripe uses to determine tax or could not be verified on a reverse-charged invoice: we keep a record of each such case, as the retention section describes. We do this because VAT law obliges us to charge the right VAT, which is a legal obligation (Article 6(1)(c) of the GDPR).
• To send transactional email — sign-in, verification, billing and security notices. We do not send marketing email without your explicit opt-in.
• To answer the messages you send us.

For the data about your devices, and about the people you add as alert recipients, we act on your instructions: you decide what is monitored and who is alerted, and we process that data to provide the Service to you. The Terms are our data processing agreement.

4. Public status pages

If you publish a status page, the device names, labels and statuses you choose to show can be seen by anyone with its address, or its password if you set one. Unpublish it, or delete its workspace, to take it down.

5. Sub-processors and the services you connect

We use these services to operate ViperSonar. Each processes data only to provide its service to us, under its data processing terms, except where its entry says otherwise. We email your organisation's owners and administrators at least 30 days before a new service starts handling the data about your devices and alert recipients (Terms).

• Cloudflare — hosting and networking, the analytics store that holds check history, abuse protection, and the custom domains of status pages.
• Neon — the database holding account, workspace, device and incident data and summaries of check history, hosted in the EU (Frankfurt).
• Resend — email delivery, including alert email, and receiving the signals your devices send by email.
• Twilio — SMS delivery: the recipient's phone number and the alert text.
• Stripe — payments and subscriptions. Stripe processes your payment details for us as our processor, and separately for its own purposes — fraud prevention, financial-crime checks, legal compliance and improving its services — as a controller in its own right, under its own privacy policy.
• Sentry — error monitoring, including a recording of any session in the ViperSonar app in which an error occurs, so that we can see what went wrong. Text, form inputs and media are masked, and page addresses are cut to their path before a recording leaves your browser; whether a checkbox or option is selected, the paths of the pages you open, when and where you click, and your account identifier can still be recorded. While a page is open your browser keeps the last minute or so of the screen in memory, and a small identifier in session storage, so a recording can include the moments before an error; no recording is uploaded from a session in which no error occurs, while error reports and performance measurements are sent from any session. Sentry keeps error reports and recordings for its own retention period, and deleting your account does not remove them at once.
• Google — Gemini, only when you ask ViperSonar to identify discovered devices with AI: it receives those devices' discovery details and processes them for us as our processor, keeping them for a limited time to detect abuse; and Google sign-in, when you use it, which Google provides as a controller of your Google account under its own privacy policy.
• Microsoft — sign-in, when you use it. Microsoft provides it as a controller of your Microsoft account under its own privacy policy, not on our behalf.

Services you connect. Slack, Microsoft Teams, Discord, PagerDuty and the webhook addresses you add are not our sub-processors. You choose them, you hold the account or the address, and you ask us to send alert content to them. We send only the alert itself: which device or job is affected, its status and why, and when it happened. After that the service handles the content for you, under your own agreement with it, and its terms and privacy policy apply. Slack, Microsoft, Discord and PagerDuty are US companies, so alert content sent to them may be processed in the United States; the international transfers section explains what protects it. Disconnect a service, or delete its channel, and we stop sending. The exception is a PagerDuty page that is still open at that moment: so that it does not stay open for good, we send PagerDuty a request to close it, which carries only the page's identifier and the integration key the page was raised with, and we keep trying for up to seven days if PagerDuty does not accept it.

6. Retention and deletion

Each plan keeps history for a set number of days — its history window, listed with the plan and shown on the Billing screen — plus a year for each extra year of retention you add. What falls outside the window is hidden at once and deleted by a daily job:

• Signals and measurements — the signals your devices and jobs send, and the measurements your collectors report — are held in Cloudflare's analytics store, which deletes them automatically after about three months, whatever your plan. We show them only within your window. The latest signal from each device, with its message and data, is also kept on the device's record until the next one replaces it.
• Signals sent by email. Resend keeps each message sent to a device's address for 30 days, whether or not we accepted it as a signal. Deleting the device or its workspace does not shorten that.
• Summaries of those signals and measurements — hourly and daily counts of successful, warning and failed results and response times, per device and check — are kept in our database: hourly summaries for your window or a year, whichever is shorter, and daily summaries for your whole window.
• Incidents, with their notes and timelines, are deleted once they have been resolved for longer than your window. An incident that is still open is kept.
• Device status changes and proposed device changes are deleted once they are older than your window. A proposed change still waiting for a decision is kept.
• Alert records, including the phone numbers an SMS was sent to, are deleted 30 days after the alert, or sooner when your window is shorter. A delivery that failed and is still being retried is kept for the full 30 days.
• Account, workspace, device and collector records are kept for as long as the workspace or account exists.
• Email recipient records. Workspace email recipient records remain with the workspace and are deleted when that workspace is permanently purged. Removing or re-adding an address, or deleting a channel, does not erase its confirmation, stop or suppression record. The address-wide keyed safety record is retained independently of workspaces and accounts, including after they are permanently deleted, so deleting or recreating a workspace cannot erase a global block, a provider suppression or the limits on confirmation requests.
• Operational logs and error reports are kept by Cloudflare, for at most a week, and by Sentry, for 90 days, and are then deleted automatically. Resend and Twilio keep their own logs of the messages they send for us for the period their terms set.

If your window gets shorter — because you move to a plan that keeps less history, remove an extra year of retention, or your subscription or trial ends — history outside the new window is hidden at once and kept for fourteen days, even if the organisation is closed in the meantime. While the organisation is open, we email its owner and billing contacts the date deletion starts. Move to a plan that keeps it within those fourteen days and it is all there again; after that, the daily job deletes it and it cannot be recovered.

While a device is suspended — by you, or because your organisation has more devices than its plan includes — the signals and measurements it sends are not stored, though Resend still keeps an email sent to its address for 30 days.

Deleting a device or a collector deletes its records from our database straight away, summaries included, apart from a request to close an open PagerDuty page, described below; check history already in the analytics store expires on its own schedule, and Resend keeps the messages sent to the device's address for their 30 days.

A workspace you delete stops monitoring and alerting at once, and its status pages go offline. An owner or administrator of its organisation can restore it for 30 days; after that its records are permanently deleted from our database, summaries included, apart from a request to close an open PagerDuty page, described below. Deleting an organisation — or our closing it under the Terms — closes every workspace in it at once and deletes them the same way 30 days later; until then our staff can restore the organisation if its owner asks us.

When you delete your account, we anonymise your account record, remove your memberships and delete the notifications addressed to you and your notification choices, and an organisation you alone own is closed and, 30 days later, permanently deleted with its workspaces. Until then the email address your account used is kept beside that organisation, so that our staff can tell whose it was, and it is deleted with the organisation.

An open PagerDuty page. If a device, a collector, a workspace, an organisation or a PagerDuty channel is deleted while a page we raised in PagerDuty is still open, we keep a request to close that page: its identifier, the integration key the page was raised with and the workspace and channel it came from, but nothing of what the alert said. The request is not deleted with what it came from. It is deleted when PagerDuty accepts or refuses it, and we stop trying after seven days.

To keep that close behind an alert already on its way, we temporarily retain the same page and routing identifiers with the workspace and delivery identifiers and send time. This record contains no alert content and is deleted when the send finishes, or by cleanup after an interrupted send.

We keep the page identifier, original integration key and workspace and channel identifiers while a PagerDuty page is open, until it is closed or its closing request is removed as described above. This lets acknowledgement and closing actions reach the original integration after delivery history expires, without retaining alert content.

Security records — your sessions, the sign-in and security actions with the IP address, browser and approximate location each one recorded, the record of the main changes to your organisation and its workspaces, and the record of each time our staff signed in as you — are kept for two years from when they were made and then deleted, whether or not your account still exists. After an account is deleted they stay for that time because they are how we investigate misuse of an account.

When we suspend your account or lift its suspension, we record when, which staff member acted and the reason given for the suspension. These audit records are kept with the other security records for two years from the event, including after account deletion. The current suspension's time, reason and staff member are also kept on your account until the suspension is lifted or the account is anonymised.

Each message Stripe sends us about your payments and billing details is kept for 30 days from when it arrived and then deleted.

A notification in your inbox is deleted 90 days after you read it; one you have not read stays until you read it or delete your account.

For each mailbox, we retain a SHA-256 hash of the normalised email address, wrong-code attempt totals, send counts and the times used to enforce the limits. This record is deleted by the daily cleanup once 30 days have passed since the last verification-email request or verification-code attempt, including requests or attempts we refuse. Deleting your account does not remove this record. Creating another account or proving the same mailbox resets neither budget, even if the address has a new owner.

Our separate accounting ledger of payments, refunds and disputes outlives your account and workspace. We keep it for 6 years from the later of the latest original or revised tax-return deadline and actual filing. OSS records also stay through 10 years after the end of the transaction year. A tax audit begun in the final domestic year extends that period until completion or one year after its start, whichever is earlier, without shortening the base period; another legal preservation duty can require longer. Nightly cleanup deletes expired ledger records once filing and OSS facts are confirmed and legal holds are released. Linked payment and adjustment history stays while any part is still required; a new financial adjustment can require its supporting history again. Stripe retains its own records under its legal obligations: generally five or more years after the later of the end of its business relationship or the last transaction, depending on jurisdiction. Our cleanup cannot erase Stripe's finalized invoices. Erasure requests and Stripe's retention criteria are described in Stripe's Privacy Center.

For each invoice Stripe issues your organisation, we keep its number, amount, currency and status, the time of its latest failed payment, the Stripe customer and subscription it belongs to, and the link to the page Stripe hosts for it, so that our staff can see which payments are open, past due or failed. These records are deleted when your organisation is permanently deleted.

To limit unwanted invitations and honour "never invite me again" for this service, we keep a hashed form of the recipient's email address, the next allowed invitation time, any refusal time, and hashes of the invitation stop links. These records contain no invitation message. They remain after an invitation, account or workspace is deleted, with no automatic expiry, so later invitations and old stop links continue to respect the recipient's choice.

A record that a VAT number you gave Stripe does not match the country of the address Stripe uses to determine tax or could not be verified on a reverse-charged invoice — the number, the two countries and the name and address the VAT register holds for it — is kept while the case remains open and deleted 365 days after it is resolved (the country mismatch or verification failure is cleared, or the number is removed). Permanently deleting your organisation deletes it sooner.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing. You can download a copy of the data we hold about you — your account, how you sign in, your sessions, the organisations and workspaces you belong to, your security records, the times our staff signed in as you and the notifications addressed to you, with your notification choices — from the Security page of your account settings, and delete your account from the same page. To exercise any other right, email support@vipersonar.com; we reply within one month.

While your account is suspended, you cannot sign in to download or delete your data. Email support@vipersonar.com and support will handle your request without requiring you to sign in, after verifying your identity. Suspension does not remove your data rights or change the retention and deletion limits described in this policy.

If you receive alert email without being a current verified workspace member, its stop link lets you stop that workspace's alerts or block all alert and confirmation email from the Service, without signing in. The confirmation page also lets you decline and block further requests.

If your details are in a customer's monitoring, for example as an alert recipient, we pass your request about that customer's data to that customer. We handle requests about our own address-wide safety records ourselves.

If you are in the European Union, you may also complain to a data protection authority — in Cyprus, the Commissioner for Personal Data Protection.

8. California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the rights below. They add to the rights in the rights section and apply even though our controller is a Cyprus company.

• Right to know. You can ask for the categories and specific pieces of personal information we hold about you, where we got it, why we collected it, and the categories of third parties we disclose it to.
• Right to delete. You can ask us to delete the personal information we hold about you, subject to the exceptions the law allows.
• Right to correct. You can ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share your personal information for money or for cross-context behavioural advertising, and have not done so in the preceding 12 months. There is nothing to opt out of, but we honour opt-out preference signals, such as Global Privacy Control, that your browser sends.
• Right to non-discrimination. We will not deny you service, charge a different price or provide a different level of quality because you exercised any of these rights.

To exercise a California right, email support@vipersonar.com. We verify a request against the information associated with your account before acting on it, and you may have an authorised agent submit one for you.

9. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Passwords, API keys and collector tokens are stored as hashes, never in readable form, and access to production data is limited to the people who operate the Service.

HTTP check headers and request bodies, SNMP community strings, and discovery credentials are encrypted at rest and withheld from workspace read responses. The assigned collector receives the values it needs to run those checks. Other check settings, including target addresses and URLs, remain visible to workspace members; do not put credentials in those fields.

10. Children

ViperSonar is a service for businesses and is not for anyone under 18, or under the age of majority where they live if that is higher. We do not knowingly collect personal data from anyone below that age. If you think someone below it has given us their data, email support@vipersonar.com and we will delete it unless the law requires us to keep it.

11. International transfers

Our database is in the EU, in Frankfurt. Several of the services above — Cloudflare, Neon (our database provider), Twilio, Resend, Stripe, Sentry and Google (for Gemini) among them — are US companies, so your data may be processed or accessed in the United States, and Google may also process it in other countries where it has facilities. Each transfer is covered by at least one of two safeguards: the European Commission's decision that US companies certified under the EU–US Data Privacy Framework protect personal data adequately, and the Standard Contractual Clauses in the provider's data processing terms, which are public on the provider's website. Which of the two a provider's own terms rely on first differs between providers and changes with its certification. Email support@vipersonar.com and we will tell you which applies to a transfer and how to get a copy of it.

Signing in with Google or Microsoft is different: neither acts on our behalf, and each is a controller in its own right of your Google or Microsoft account and handles your sign-in under its own privacy policy.

Slack, Microsoft Teams, Discord and PagerDuty are also US companies. We send them alert content only because you asked us to, and we are not a party to your agreement with them. What protects that content is whichever of these the service holds for its own customers: certification under the EU–US Data Privacy Framework, or Standard Contractual Clauses in its data processing terms. A webhook goes to whatever address you give. Check that each service meets your own legal requirements before you connect it.

12. Changes to this policy

We update the date at the top whenever this policy changes. Before a change that matters to you takes effect — a new purpose for your data, a new kind of recipient, or a change in how you use your rights — we tell you by email or in ViperSonar.

13. Contact

Questions or complaints? Email support@vipersonar.com. The controller is IOT LTD, registered in Cyprus (registration number HE343300), at Mnasiadou 9, Demokritos Building, 1065 Nicosia, Cyprus.