Privacy Policy
Last updated: 5 October 2026
Contents
- Information we collect
- How we use information
- Data storage and security
- Data sharing
- Data retention
- Your rights
- International data transfers
- Children's privacy
- Cookies and tracking
- Updates to this policy
- Contact
This Privacy Policy explains how Owlwake ("we", "us" or "our") collects, uses and protects personal data when you visit owlwake.com, write to us, or use our website-watching service (the "Service"). We are committed to protecting your privacy in compliance with Saudi Arabia's Personal Data Protection Law (PDPL), the EU's General Data Protection Regulation (GDPR) where it applies, and other applicable regulations. Our Terms of Service govern the Service itself.
1. Information we collect
We collect the following information to provide the Service:
| Information | Source | Purpose |
|---|---|---|
| Your email address, your website, the plan you asked about and your message | Our early-access form | Replying to you |
| The IP address a request arrives from | Our early-access form | Stopping floods of requests |
| What you write to us | Email to hello@owlwake.com | Replying to you |
| A client's business name, country and time zone | The client | Running the Service and dating its reports |
| Each site's address, and what the client tells us about it, such as its platform, its host, its registrar and its DNS provider | The client | Running the Service and saying who can fix a problem |
| The names, roles, email addresses, phone numbers and time zones of the people a client asks us to alert, and the Telegram chat each one links to us, with the chat's name | The client, and each person when they link a chat | Sending alerts and reports |
| The name and email address of the person who authorised checks on a site, and the authorisation itself, with our notes on it | The client, and us | Our record that the checks were permitted |
| The result of every check on a client's site, and the incidents, alerts and reports that come from them | Our checks | Providing the Service |
| A domain's registration, the certificates issued for it and its DNS records | Public registries, DNS and certificate logs | Our checks. This is information about a domain, not about a person |
| The results of a one-off check we run on a website from our console | Our checks | Looking at a site, including one whose owner is not yet a client |
Information we do not collect
- Passwords to your website, hosting or email. We never ask for them; if you send one anyway, we will not use it and will ask you to change it
- Payment card details. When paid subscriptions open, they are handled entirely by Lemon Squeezy, our merchant of record, and we never see or store them
- Anything behind a login on your website
- How you browse owlwake.com: this site sets no cookies and has no analytics
2. How we use information
We use the information we collect for the following purposes:
- Provide the Service: run checks on the websites a client authorises, and tell the people the client names when something needs doing
- Report: send welcome and monthly reports
- Reply: answer early-access requests and anything you write to us
- Process payments: when paid subscriptions open, manage subscriptions with Lemon Squeezy
- Protect the Service: stop floods of requests and keep a record of what was done in our console
- Enforce our terms: detect and prevent violations of our Terms of Service
We process your data based on:
- Your consent (when you send us a request or link a chat to us)
- Contractual necessity (to provide the Service a client asked for)
- Legitimate interests (to secure the Service and keep our records)
3. Data storage and security
Everything the Service holds is on our server at Hetzner in Falkenstein, Germany; email you send us is kept in our mailbox at Google. We protect the server with the following measures:
- The server accepts administrative logins only by key, behind a firewall and fail2ban
- The database and the job queue sit on internal networks that the internet cannot reach
- Our database and job queue each require a password, and the public website logs in to the database with its own, limited to what the website needs
- Our console is reachable only through an encrypted connection to the server itself
- Security updates to the server's operating system are installed automatically
Important: while we take reasonable security measures, no method of transmission or storage is 100% secure. We cannot guarantee the absolute security of your data.
4. Data sharing
We do not sell your personal data, and we do not rent or pass it on to anyone except as this section says.
Service providers
- Hetzner hosts our server, and keeps a copy of it from each of the last seven days as a backup.
- Cloudflare runs our DNS and receives email sent to our address.
- Google holds the mailbox where your email to us arrives.
- Telegram carries alerts and reports to the chats a client links to us.
- SSLMate answers our questions about the certificates issued for a client's domain. It sees domain names, not people.
- Lemon Squeezy, when paid subscriptions open, is the merchant of record for them and processes your payment data under its own privacy policy.
We use healthchecks.io to know that our own checks are running; it receives nothing about you.
Legal requirements
We may disclose your data if required to:
- Comply with applicable law or legal process
- Respond to lawful requests from government authorities
- Protect our rights, privacy, safety or property
- Enforce our Terms of Service
5. Data retention
We keep each kind of information for the period below:
| What | How long |
|---|---|
| An early-access request: your email address, website, the plan you asked about and your message | 12 months, from when you sent it |
| A request our spam filter caught | 30 days, from when it arrived |
| The IP address that arrives with a request, used only to stop floods | 30 days, from when it arrived, then erased from the request |
| A free check run from our website, once we offer them | 30 days, from the check |
| A check we run on a website ourselves | 90 days, from the check |
| A link to a check we ran on your website, and the page it shows, if we sent you one | 90 days, from the check; the link stops working sooner if we withdraw it |
| Speed reports, link-check files and screenshots | 90 days, from when they were made |
| Welcome and monthly reports, and their PDFs | 24 months, from when they were made |
| Each result of a check on a client's site | 13 months, from the check |
| An incident and its history | 24 months, from when it was resolved |
| An alert or report we sent | 24 months, from when it was sent, or written if it never was |
| Our own error records | 90 days, from the error |
| Our record of what was done in our console | 24 months, from the action |
| A client who has left, with their contacts, sites, check results, incidents, alerts and reports | 90 days, from when they left |
A job runs every day and deletes what has passed its date. You can ask us to delete anything sooner. Our programs also keep technical logs and error records, which can include an IP address or the number of a chat we sent an alert to: the logs are overwritten as they fill, and error records are deleted after 90 days. Because Hetzner keeps seven days of backups, something we delete can remain in a backup for up to seven more days.
Email you send to hello@owlwake.com is kept in our mailbox until we delete it, and you can ask us to. Our mail provider deletes what it files as spam after 30 days.
Our record of what was done in our console can include a client's business name and its sites' addresses. It is kept for its own period in the table above, even after the client's other information has been deleted.
6. Your rights
Under Saudi Arabia's Personal Data Protection Law (PDPL), you have the following rights:
Right to access
Request a copy of the personal data we hold about you
Right to correction
Request correction of inaccurate or incomplete data
Right to deletion
Request deletion of your data (with some exceptions)
Right to withdraw consent
Withdraw your consent for data processing at any time
Right to object
Object to certain types of data processing
Right to information
Know how your data is being processed and shared
If you are in the EU
The GDPR gives you these rights too, and the right to receive your data in a form you can take elsewhere.
How to exercise your rights
Write to hello@owlwake.com. We will respond to your request within 30 days.
Note: some rights may be limited by legal obligations, or when the data is necessary to provide the Service, such as a site's authorisation while we still check that site.
7. International data transfers
Your data is stored on our server in Germany, outside the Kingdom of Saudi Arabia, and the providers in section 4 may process what passes through them in other countries. When we transfer data internationally, we ensure:
- Appropriate safeguards are in place as required by the PDPL
- Data recipients maintain adequate security standards
- Transfers comply with the PDPL and other applicable data protection requirements
By using the Service, you consent to the transfer of your data to servers outside Saudi Arabia for the purpose of providing the Service.
8. Children's privacy
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
- You must be at least 18 years old to use the Service
- If we discover we have collected data from someone under 18, we will delete it promptly
If you believe we have collected data from someone under 18, please write to hello@owlwake.com immediately.
9. Cookies and tracking
This site sets no cookies, runs no scripts and loads nothing from anywhere else. Our alerts and reports carry no tracking.
What we do not use
- Cookies of any kind, including advertising cookies
- Analytics
- Cross-site tracking
- Social media tracking pixels
- Behavioural advertising technologies
10. Updates to this policy
We may update this Privacy Policy from time to time. When we make changes:
- We will update the "Last updated" date at the top of this page
- For material changes, we will tell clients by email or in the chat we send their alerts to
- Your continued use of the Service after changes constitutes acceptance of the updated policy
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
11. Contact
Data controller
Owlwake is the data controller responsible for your personal data.
Contact for privacy inquiries
For questions about this Privacy Policy, data access requests, or to exercise your rights under the PDPL, write to hello@owlwake.com.
Regulatory authority
If you believe your data protection rights have been violated, you have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), the regulatory body responsible for enforcing the PDPL (sdaia.gov.sa). In the EU, you can also complain to your data protection authority.