Data Retention & Deletion Policy
How we store, retain, and permanently delete your data.
Last updated: August 25, 2026
This page describes the customer data ServiceAlert stores, the normal retention period for each category, and the available deletion and privacy-request processes.
What we store about you
When you sign up for ServiceAlert.ai, we store the minimum necessary to operate your account and deliver the features you configure:
| Data category | Purpose | Retention |
|---|---|---|
| Account identity (email, name, company) | Authentication and support | Until account deletion |
| Uptime monitor configurations | Running the checks you configure | Until you delete the monitor or your account |
| Monitor check results (response times, status codes, SSL cert data) | Dashboard graphs, SLA reports, incident history | Personal: 90 days · Pro/Business: 90 days · Enterprise: 1 year |
| Alert history (emails sent, Slack/Teams posts, webhooks fired) | Debugging alert delivery, cooldown tracking | 90 days |
| Web Analytics and real-user measurements (page paths, daily anonymous session hashes, events, Web Vitals, coarse heatmaps, country/region/city/ASN) | Traffic, conversion, and user-experience reporting | 90 days |
| Opt-in JavaScript error diagnostics (redacted message, pathname-only source URL, sanitized stack, coarse browser/device/country) | Application error reporting when explicitly enabled for a site | 90 days |
| Coarse geolocation lookup cache (/24 IPv4 or /64 IPv6 prefix, country, region, city, ASN and organization) | Avoiding repeated external geolocation lookups; full IP addresses are not stored | 30 days |
| SSL monitor & legacy certificate records | Basic expiry and TLS health monitoring | Until you delete the cert or your account |
| Incident history (declared incidents, post-mortems, timelines) | Metrics dashboard, public status page history | Until you delete the incident or your account |
| API keys & push subscriptions | Programmatic access, browser push notifications | Until revoked or account deleted |
| Billing records (Stripe customer ID, plan history) | Processing subscription payments | 7 years (legal/tax retention) |
| Customer feedback and publication consent | Product improvement and approved customer stories | Until account deletion or a deletion request |
What we do NOT store
- Passwords (authentication is handled by Auth0; we never see your password)
- Full credit card details (Stripe tokenizes payment methods; we only see the last 4 digits)
- Content of your monitored websites (we only store status codes, response times, and SSL metadata — never the page body)
- Personal data of anyone you don't explicitly add (no automated contact scraping)
How to delete your data
Option 1: Delete individual items
You can delete individual monitors, certificates, API keys, and incidents at any time from the respective section of your dashboard. These deletions take effect immediately and remove all associated check history, findings, and alert logs.
Option 2: Delete your entire account
From Settings → Account → Danger Zone, click "Delete my account" and confirm by typing DELETE MY ACCOUNT. This is immediate and cannot be reversed.
When you delete your account, we purge all of the following in a single transaction:
- All uptime monitors and certificate endpoints
- All check results, scan history, and SLA data
- All incidents, post-mortems, responders, and templates you've created
- All API keys, push subscriptions, status pages, and alert configurations
- All alert log history (email, Slack, Teams, Discord, webhooks, PagerDuty, Opsgenie)
- All Web Analytics sites and their events, Web Vitals, heatmaps, goals, funnels, alerts, and opt-in JavaScript error diagnostics
- All audit logs of actions you performed
- Customer feedback, review-outreach history, and publication consent
- Your Auth0 login — you will no longer be able to sign in
Account deletion is processed as one operation. If it cannot be completed, the account remains available and an error is shown. After a successful deletion, you are signed out.
Backups
We run automated PostgreSQL backups daily for disaster recovery. Backups are:
- Encrypted at rest
- Stored for a maximum of 3 days under normal operation before automatic rotation (the two most recent backups are always retained)
- Access-controlled — only used for disaster recovery, never read for operational or analytical purposes
When you delete data (an account or individual items), the deletion takes effect immediately in the live database. However, the deleted data may persist in backups until those backups are rotated out of storage. This is a standard pattern for all SaaS products; a short retention window balances disaster recovery needs with your right to erasure. No data that you have deleted is ever restored from backup into the live system unless you explicitly request it during a disaster-recovery scenario.
Your rights under GDPR, CCPA, and other regulations
Right to access
You can view all data we hold about you at any time by logging in and browsing your dashboard, settings, and monitor detail pages. If you want a machine-readable export of everything we have, email privacy@servicealert.ai with "Data export request" in the subject line. We will respond within 7 days.
Right to erasure (right to be forgotten)
Use the self-service deletion from Settings — it immediately purges your data from the live database. Backup retention is capped at 3 days as described above. If you need faster backup purging for a specific legal reason, email privacy@servicealert.ai.
Right to rectification
Edit your profile from Settings → Profile Information. For corrections that aren't self-serviceable, email privacy@servicealert.ai.
Right to portability
Uptime, SSL monitor, and legacy certificate data can be exported from their respective dashboards. For a full account export in JSON format, email privacy@servicealert.ai.
Right to object to processing
If you object to specific processing (for example, you no longer want us to run a particular monitor or cert check), you can delete the relevant item from your dashboard. If you need to object to a class of processing we don't offer granular controls for, email privacy@servicealert.ai.
Data processing locations
All ServiceAlert.ai data is stored on Azure infrastructure. Database and application servers are located in the US East (Virginia) region. We use third-party processors for specific features:
- Auth0 — authentication and identity management
- Postmark — transactional email delivery
- Stripe — payment processing
- Twilio — SMS alert delivery (only if you enable SMS alerts)
- Anthropic Claude — AI incident post-mortem generation (only if you use the feature; timeline data is sent, not your password or API keys)
ServiceAlert browser extension
The ServiceAlert Chrome extension (and any future browser port) is a single-purpose tool that shows the current status of the SaaS service associated with your active browser tab. Its privacy posture is deliberately minimal:
- What the extension stores locally: a cached copy of the public monitored-domains list (refreshed daily from
/api/public/monitored-domains) and a short-lived per-service status cache used to colour the toolbar icon. Both live in the browser'schrome.storage.localand never leave your machine. - What the extension sends to our servers: when you click the toolbar icon, the hostname of your active tab (e.g.
openai.com) is sent to/api/public/domain-statusso we can return the current status. Nothing else: no URL paths, no query strings, no cookies, no account identifier. - Permissions requested:
activeTab(read the current tab's URL only when you interact with the extension) andstorage(local cache). The extension never requests access to all sites, cookies, browsing history, or tabs in the background. - Tracking: the extension contains no analytics, no telemetry, and no third-party scripts. We cannot tell how many times you've opened it or what sites you've visited.
- Account required: no. The extension works anonymously.
- Uninstall: removing the extension in Chrome clears the local cache. There is no server-side record tied to the extension install.
Questions or requests
Email privacy@servicealert.ai for any question about data handling, retention, deletion, or your privacy rights. We respond within 5 business days and fulfill formal requests (access, erasure, portability) within 7 days.
This policy supersedes any prior data-retention guidance. Material changes will be announced on the changelog and reflected in the "Last updated" date at the top of this page.