Informativa sulla privacy

1.1 Account Information

• Email address (used as your unique identifier and for notifications).
• Password (stored as a one-way bcrypt hash — we never store plaintext passwords).
• Account role (user, admin, or superadmin) and registration date.

1.2 Domain & Monitoring Data

• URLs you add for monitoring, including custom display names and check configuration (interval, timeout, check method).
• HTTP response codes, response times, and connection status for each health check.
• SSL certificate details: validity status, issuer, expiry date, and days remaining.
• Domain registration expiry information obtained via RDAP and WHOIS protocol lookups.
• Email health data: DNS record checks (MX, SPF, DKIM, DMARC), blacklist scan results, deliverability scores, and grades for domains where you enable email health monitoring.
• Website favicons fetched via Google's Favicon Service or directly from your domain.
• Screenshots captured automatically when a health check fails (stored for 30 days).
• Incident records: downtime start/end times, duration, and recovery status.
• Embeddable widget configuration: enabled/disabled status, selected components, and embed token per domain.
• Widget access logs: origin domains from which embedded widgets are loaded, for domain verification purposes.

1.3 URL & Content Monitoring Data

• URLs you add for content monitoring, including custom display names and check configuration (interval, screenshot frequency).
• Content hash data (SHA-256 hashes of page text content) used to detect changes between checks.
• Content change records: previous and current content hashes, line-level diff summaries showing added and removed content, and timestamps.
• Periodic screenshots captured from monitored URLs at your configured interval.
• URL monitoring state: active, changed, error, or unknown status for each monitored URL.

1.4 Notification Preferences & Multi-Channel Data

• Email notification preferences (status changes, SSL alerts, domain expiry warnings, email health alerts).
• CC email addresses you provide for team notifications.
• SSL and domain expiry warning thresholds you configure.
• Email health monitoring preferences: enabled/disabled status and check frequency per domain.
• Per-domain notification channel preferences: which channels (WhatsApp, webhooks) are enabled for each monitored domain.
• Per-domain WhatsApp account assignments: which connected WhatsApp accounts receive alerts for each domain.
• Outgoing webhook configurations: endpoint URLs, event subscriptions, and delivery logs per domain.

1.5 Technical Data

• IP address and user agent string from HTTP requests (for rate limiting and security).
• Authentication tokens (JWTs stored in your browser's localStorage).
• Basic usage metrics to understand feature adoption and improve the Service.

1.6 Public Tool & Contact Data

• Email addresses submitted through the public Email Health Checker tool (if you opt in to receive results).
• Cold Email Campaign Simulator: email lists and domains submitted for deliverability analysis, email address for results delivery, sending domain information. All submitted data is stored permanently for service improvement and analytics.
• Contact form submissions: name, email, subject, and message content.
• Feedback submissions: email (optional), message, and page context.

1.7 Anonymous Trial Data

• IP address and user agent string when you start an anonymous trial session (for rate limiting and session security).
• Domain URLs you add for monitoring during the trial (up to 5 domains).
• Monitoring check results collected during the trial period (up to 40 minutes).
• Trial session metadata: session ID, creation time, status, and expiry time.
• User agent is used to prevent unauthorized session sharing — only the original browser that created the trial can access the dashboard.

Retention: Unclaimed trial data is automatically deleted after the trial session expires (40 minutes). If you claim the trial by creating an account, your monitoring domains are transferred to your account and retained per standard account data retention.

1.8 User Profile Data

• Name and phone number (optional, provided by you).
• Business name and address (optional, for invoicing purposes).
• Tax identification number and type (optional, e.g., VAT/TRN for invoicing).
• Profile data may be automatically populated from Stripe billing details when you make a purchase (only fills empty fields).

1.9 Email Change Verification

• When you change your email address, we use a dual-OTP verification process: a code is sent to your current email first, then to your new email.
• OTP codes for email changes expire after 15 minutes and are single-use.
• A confirmation notification is sent to your old email address after a successful change.
• Your new email replaces the old one across all services — previous email is not retained.

1.10 Connected WhatsApp Accounts

• Phone numbers associated with WhatsApp accounts you connect to Nova Uptime, stored for delivery and display purposes.
• Optional labels you assign to each connected account (e.g., "Personal", "Work") for identification purposes.
• Connection timestamp: when each WhatsApp account was successfully connected.
• WhatsApp message delivery logs: message content, recipient WhatsApp account, delivery status, and timestamp. These are retained for troubleshooting purposes.
• We do not store or read your WhatsApp chat history, contacts, or any messages other than the alert notifications we send you.

1.11 Webhook Delivery Data

• Webhook endpoint URLs you configure for receiving monitoring event notifications.
• Webhook signing secrets (HMAC-SHA256 keys) generated for payload verification.
• Event subscriptions: which monitoring event types each webhook endpoint is configured to receive.
• Delivery logs: HTTP response status codes, delivery timestamps, success/failure status, and truncated response bodies (up to 500 characters) for troubleshooting.
• Consecutive failure counts used for automatic circuit-breaker disabling of persistently failing webhooks.