Privacy notice
Last updated 1 November 2026
This notice is being finalised. For any question about your data, email contact@watchmystack.com.
This notice explains what personal data WatchMyStack collects, why, how long we keep it, who helps us process it, and your rights. It follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the Data Protection Act (Chapter 586 of the Laws of Malta) and, for cookies and similar technologies, the Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 586.01).
Who we are
WatchMyStack is responsible for your personal data (the “controller”). For anything about your data, or to use any of your rights, email contact@watchmystack.com.
What we collect, why, and for how long
We collect only what we need to run the service. We don’t sell your data, use it for advertising, or build profiles of you for marketing. We don’t send marketing emails; we only send the alerts and digests you choose and messages about your account.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your account: email address, password (stored scrambled by our sign-in service; we never see it), the secret behind your authenticator app, and when you signed up and last signed in. | To create your account, sign you in securely and send you the alerts you asked for. | Contract (Art. 6(1)(b) GDPR) | Until you delete your account. |
| Your stack: the products you pick and, if you choose, whether they are internet-facing, how critical they are and roughly how many you run. Which vulnerabilities you mark as handled, and your alert settings. | To show your dashboard and reports and to decide which alerts to send you. | Contract (Art. 6(1)(b)) | Until you clear your data or delete your account. |
| Profile details and photo, if you add them: name, job title, organisation, role, country, time zone and a photo. | To show them on your profile and on reports you prepare. Photos are shrunk on your device before upload, which removes location and other hidden data. | Contract (Art. 6(1)(b)), at your request | Until you remove them, clear your data or delete your account. |
| Alert history: which alerts we emailed you and when. | So we never send the same alert twice. | Contract (Art. 6(1)(b)) | Until you clear your data or delete your account. |
| Your activity log: what you did in WatchMyStack (for example marking a vulnerability as handled, changing settings, sharing, reports) and sign-ins with a description of your browser and system (such as “Chrome on Windows”). No IP addresses. | So you can see what happened in your account and spot anything you didn’t do. | Legitimate interests (Art. 6(1)(f)): keeping your account secure and accountable | Until you delete your account. Only you can see it. |
| Messages you send us through the chat: your email address, your message and a one-way scrambled version of your IP address (we cannot turn it back into the address). | To reply to you, and to stop spam and abuse of the chat. | Legitimate interests (Art. 6(1)(f)): answering you and protecting the service | 24 months, then deleted automatically. Messages sent while signed in are deleted straight away if you delete your account; for others, just ask. |
| Product requests: the names of products you ask us to add. | To review them and grow the catalogue. We email them to our team and send you a confirmation. | Legitimate interests (Art. 6(1)(f)): improving the service | 24 months, then deleted automatically. If you delete your account, the request stays only as a product name, not linked to you. |
| Bot checks on sign-up, sign-in, password reset and the chat (the chat only if you aren’t signed in): our bot-protection service looks at technical signals from your browser and your IP address to tell people from automated programs. | To stop fake accounts, password-guessing attacks and spam. We only receive a “person” or “bot” answer. | Legitimate interests (Art. 6(1)(f)): security | Not stored by us. The provider keeps it only briefly under its own terms. |
| Analytics, only if you click “Allow analytics”: pages you visit, how you got here, device and browser type and approximate location (country or city). Google Analytics does not store IP addresses. | To understand which pages are useful and improve the site. | Your consent (Art. 6(1)(a)), which you can withdraw at any time | Up to 14 months, then deleted by Google Analytics. |
| Technical logs: when a page or service is used, our hosting, database and email providers record technical details such as IP address, time and the address requested. | To run the service, find faults and detect attacks. | Legitimate interests (Art. 6(1)(f)): security and reliability | Short periods set by those providers (typically days to a few weeks). |
You need to give us an email address and password to have an account; without them we can’t provide the service. Everything in your profile is optional.
Where we rely on legitimate interests, we have weighed them against your rights and kept the data to the minimum. You can object at any time (see Your rights).
Cookies and browser storage
- Always on (strictly necessary): storage in your browser that keeps you signed in, remembers your light or dark theme, your sound setting, which vulnerabilities you’ve already seen and your cookie choice, and the bot checks on sign-in forms and the chat. These are needed for the service you ask for, so they don’t need consent. None is used for tracking or advertising.
- Only with your consent: Google Analytics cookies (names starting with
_ga). Nothing loads until you click “Allow analytics”. You can change your mind at any time with Cookie settings at the bottom of every page; we then stop analytics and remove its cookies.
Who we share data with
We use a small number of service providers who process data only on our instructions, under data processing agreements as required by Art. 28 GDPR:
- website hosting, content delivery and security services;
- our database and sign-in service (your account data is stored in the EU);
- an email delivery service, for alerts and account emails;
- a bot-protection service, for sign-up, sign-in and the chat;
- Google Analytics, only if you allow it.
You can ask us for the current list of providers at any time. We may also disclose data if the law requires it, for example to a court or the police with a valid order, or to protect our rights in a legal claim.
Transfers outside the EU
Some providers, or their support staff, are based outside the European Economic Area, for example in the United States. When data is transferred there, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for certified providers) or on the Commission’s Standard Contractual Clauses, together with the providers’ security measures. You can ask us for a copy of the relevant safeguards.
How we protect your data
All connections are encrypted. Every account must use two-step verification with an authenticator app, and signed-in pages lock after 15 minutes without activity. The database only lets you read your own data, and only after two-step verification. Deleting your data or account needs a fresh authenticator code. Photos are stripped of hidden data before upload. Access to our systems is limited and protected with two-step verification. If a breach is likely to put your rights at risk, we will notify the Information and Data Protection Commissioner within 72 hours and, where required, tell you without undue delay.
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- correct data that is wrong or incomplete;
- erase your data (“right to be forgotten”);
- restrict how we use your data in some situations;
- data portability: receive the data you gave us in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent (for analytics) at any time, without affecting what happened before.
Most of these you can do yourself, straight away, under Profile → Your data: Download my data (a file with everything we hold about you), Clear my data (removes your stack, profile, photo, statuses and alert history but keeps your account) and Delete my account (removes your account and all its data, including messages you sent us, and emails you a confirmation). You can correct your profile at any time.
For anything else, or if you can’t sign in, email contact@watchmystack.com. We reply within one month. For complex requests we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity, for example by writing from the email address on your account. Using your rights is free unless a request is clearly unfounded or excessive.
Automated decisions
Your dashboard ranks vulnerabilities by risk automatically. This is a tool to help you prioritise; it has no legal or similarly significant effect on you, so it isn’t automated decision-making under Art. 22 GDPR.
Children
WatchMyStack is a service for people who look after IT systems. It isn’t meant for children, and we don’t knowingly collect data from anyone under 16. If you think a child has given us data, contact us and we’ll delete it.
Complaints
If you’re unhappy with how we handle your data, please contact us first and we’ll try to put it right. You also have the right to complain to a data protection authority. In Malta this is the Information and Data Protection Commissioner (IDPC): idpc.org.mt. If you live or work in another EU country, you can also complain to the authority there.
Changes to this notice
We will update this notice when our practices change, and change the date at the top. If a change significantly affects how we use your data, we will tell account holders by email before it takes effect.