What we collect, and what we refuse to

pinguHQ watches websites, APIs and cron jobs and tells you when they break. This policy covers the marketing site at pinguhq.com, the dashboard at app.pinguhq.com, and the status pages we serve for customers.

The data controller is TO CONFIRM — registered entity name, at TO CONFIRM — registered address. For anything in this document, write to hello@pinguhq.com and a person will answer.

There are two different relationships in here and they are worth separating early. When you sign up, we decide what to collect about you and we are the controller. When you point a monitor at your systems or collect subscribers on your status page, you decide what goes in and we are a processor acting on your instructions. Section on that below.

Your account

Your email address, and your name and profile picture if your sign-in method gives us them. That is the whole of it: there is no phone number field, no job title, no company size dropdown.

If you sign in with Google, Google tells us your name, email address and profile picture. We never see your Google password, and we ask for nothing else from your account.

We never store a password. Sign-in is either Google or a one-time link sent to your email, so there is no password of ours for anyone to steal.

What you put in the product

Workspaces, projects, clients, services, monitors, incidents, status pages and alert channels. Most of this is not personal data at all — it is hostnames, URLs, ports and response codes. Some of it can be: a client name is often a company but sometimes a person, and a monitor URL is whatever you typed, including any credentials or tokens you put in a query string. Do not put secrets in a monitor URL. Use a header instead.

Check results

Every check writes a row: which monitor, when, whether it passed, the status code, the response time, and the error if there was one. This is the raw material for your graphs and your uptime percentage.

Status page subscribers

If you turn on subscriptions, we hold the email address of each person who subscribes and whether they confirmed it. Those addresses belong to you, not to us. We do not market to them, we do not add them to anything, and we never use them for anything other than sending the updates for the page they subscribed to.

Billing

Payments run through Dodo Payments, who act as merchant of record. Card details are entered on their checkout and never touch our systems. What we keep is the identifier of the payment, the amount, the currency and the date, so that we can show you your own billing history.

Logs and support

Our hosting and database providers keep short-lived request logs that include IP address and user agent. We use them to debug and to stop abuse, not to build a profile of you. If you email us, we keep the email.

Audit trail

Actions inside a workspace — inviting a member, deleting a monitor, changing a plan — are recorded with who did them and when, and are visible to that workspace’s admins. This exists so that a team can answer “who changed this”, which is a question that comes up during exactly the sort of afternoon this product is for.

This section is short and it is the reason the rest of the policy is short.

• No advertising trackers. No pixels, no remarketing tags, no data brokers, no “partners”.
• No analytics on this website. pinguhq.com loads no analytics script and sets no cookies whatsoever. You can read the entire marketing site without anything being written to your browser.
• We do not sell or share personal information in the sense the CCPA gives those words, and we never have.
• We do not train models on your data, and we do not hand it to anyone who does.
• We do not read your workspace to have a look. Staff access happens when you ask us for help or when we are chasing a fault, and it is rare.

There is no cookie banner on this site because there is nothing to consent to.

pinguhq.com — the marketing site

No cookies. None at all.

app.pinguhq.com — the dashboard

Session cookies only, set by our authentication provider so that you stay signed in. They are strictly necessary: remove them and the product cannot know who you are. No advertising or analytics cookies are set.

Status pages

No cookies for visitors. A status page is a public document and reading one is anonymous.

If the UK GDPR or the EU GDPR applies to you, these are our lawful bases:

• Performance of a contract — your account, your workspace content, your check history and your billing records. Without these there is no product to deliver.
• Legitimate interests — security logging, abuse prevention, and the audit trail. The interest is keeping the service working and keeping other people’s workspaces safe, and we have kept the data collected for it to the minimum that achieves that.
• Legal obligation — tax and accounting records tied to payments.
• Consent — status page subscriptions, which are confirmed by email before anything is sent, and which every message offers a way out of.

A short list of companies we pay to run parts of the service, each bound to use the data only to provide it to us. They are named individually, with what each one can actually see, on the subprocessors page.

Separately, and importantly: where your alerts go is your choice, not ours. If you connect Slack, Telegram or a webhook, we send the alert to the destination you gave us, and from that moment the data is in a system we neither chose nor control. Those services are recipients you picked. They are not our subprocessors and they are not on that list.

We will disclose data if the law compels us to. If we are allowed to tell you first, we will.

If the company is ever sold or merged, customer data moves with the service. You would be told before anything changed, and this policy would go on applying until a new one replaced it.

The providers on the subprocessors page operate internationally, so data may be processed outside the country you are in. Where a transfer leaves the UK or the EEA, it relies on the standard contractual clauses or an equivalent mechanism in that provider’s own terms.

Our database and worker regions: TO CONFIRM — hosting regions. Checks currently run from a single region rather than several — a product limitation we also state on the roadmap, and one worth knowing if where the probe sits matters to you.

Raw check results

100 days, then deleted automatically by the storage layer itself rather than by a job someone has to remember to run. Your plan may show you less than that; nothing shows you more.

Hourly rollups behind the long-range graphs

Kept longer than the raw results, because they are counts and averages per monitor per hour with no request detail left in them.

Account, workspace and monitor configuration

For as long as the account exists. Delete a monitor, project or workspace and its records are removed, along with everything that hung off it.

Status page subscribers

Until they unsubscribe or until you delete the page. Unsubscribing deletes the address rather than flagging it.

Audit logs

For the life of the workspace. Deleting the workspace removes them.

Billing records

As long as tax law requires, which outlives the account. This is the one category that survives a deletion request, and it is amounts and dates rather than anything about how you used the product.

Ask us to close your account and we delete it. Backups are the honest exception: a copy can persist in a provider’s backup for a short window before it rolls off, and it is not restored to serve anyone.

Wherever you are, you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or object to processing based on legitimate interests. Under the GDPR you can also ask for it in a portable form and complain to your supervisory authority — in the UK, the ICO.

Under the CCPA and its successors you can ask what we collected, which categories we disclosed and to whom, ask for deletion, and correct what is wrong. We do not sell or share personal information and there is no financial incentive programme, so there is nothing to opt out of and nothing you lose by exercising any of this.

Write to hello@pinguhq.com. We answer within 30 days and usually much sooner. We will ask you to reply from the address on the account, which is our whole identity check — we are not going to demand a photograph of your passport to confirm the email you already control.

Status page subscribers, client contacts and anyone whose details end up in a monitor or an alert channel are your data, not ours. You are the controller and we are the processor. In practice that means:

• We act on your instructions and use the data only to run the service.
• You can export or delete it yourself at any time, and deleting the parent object deletes it.
• We tell you without undue delay if we discover a breach affecting it.
• Our subprocessors are listed publicly, so you always know who is downstream of you.

If you need a signed data processing agreement, ask at hello@pinguhq.com and we will send one. We do not publish a click-through DPA yet, because a contract nobody has reviewed is not worth the page it sits on.

Every table in the database enforces tenant isolation at the database itself rather than in application code, API keys are stored hashed, and outbound checks are fenced so they cannot be pointed at private networks. The detail, including the certifications we do not have, is on the security page.

No system is perfect. If we discover a breach affecting your personal data we will tell you and, where required, the relevant regulator, without undue delay, and we will say what actually happened rather than issue a statement about how seriously we take security.

pinguHQ is a tool for people who run production systems and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and we will remove it.

When this changes, the date at the top changes with it, and we email account holders before anything material takes effect. We will not quietly widen what we collect and rely on you re-reading the page.