Privacy
What personal data Observary handles, why, and for how long. This covers this website, emails you send us, and the Observary service. If you visited a website that uses Observary’s consent banner, see “Visitors to our customers’ websites” below.
Who we are
Observary is a service of [company name and legal form], [address]. For anything about your data, email hello@observary.app. Our company details are in the imprint.
This website
This website sets no cookies and loads no analytics, advertising or tracking scripts. Fonts and images are served from our own domain, not from other companies’ servers.
Like every web server, the server that delivers these pages receives technical data with each request, such as your IP address, the page you asked for, the time and your browser type.[Hosting provider] processes this on our behalf to deliver the site and keep it secure, and keeps it for [retention period]. The legal basis is our legitimate interest in running a working, secure website (Article 6(1)(f) GDPR).
When you email us
If you email hello@observary.app, we use your email address, your name if you give it, and what you write to answer you. The legal basis is our legitimate interest in replying, or taking steps towards a contract if you ask about a plan (Article 6(1)(b) and (f) GDPR). We keep the conversation for as long as it’s needed to deal with your question.
Customers of the Observary service
To provide the service we process:
- Account data: your email address, your organisation’s name and your password, which is stored only in hashed form. Also the roles and email settings of the people in your team.
- Billing data: payments run through Stripe. Stripe handles your card or bank details; we don’t store them. We keep the invoices and the plan you’re on.
- Scan data: the public pages of the websites you add, and the cookies, scripts, iframes, fonts and media they load. This describes websites, not people.
- Service emails: sign-in links, drift alerts if you’ve switched them on, and notices about your subscription.
The legal basis is the contract with you (Article 6(1)(b) GDPR), and for invoices our legal obligation to keep accounting records (Article 6(1)(c) GDPR).
Customer data is stored and processed in the EU: Ireland and Frankfurt.
Visitors to our customers’ websites
When a website uses Observary’s consent banner, that website’s owner decides what happens with your consent choice. They are the controller and Observary processes the data on their behalf. Questions or requests about your choice are best sent to the website itself.
For each choice, the consent log records the categories you accepted, how you chose (accept all, reject all or custom), the banner and cookie declaration versions you saw, your language, the page path and your country. It doesn’t store your IP address or your browser’s user agent, and the visitor ID is stored only as a keyed hash.
To deliver the banner, the servers involved receive your IP address with each request, as any web server does. It isn’t written to the consent log.
You can find your consent ID in the banner’s preferences. The website owner can use it to find your records.
Service providers
We use these providers to run Observary. Each processes data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Ireland |
| Vercel | The dashboard | Dublin, Ireland |
| Render | Running scans | Frankfurt, Germany |
| Cloudflare | Delivering the banner script | Global network |
| Stripe | Payments and invoices | [region] |
| [Email provider] | Sending service emails | [region] |
Where a provider may process data outside the EU, [describe the safeguard per provider, for example the EU Standard Contractual Clauses].
How long we keep data
- Consent log entries: 12 months on Starter, 36 months on Pro and up, then deleted automatically.
- Scan findings: 24 months, then deleted.
- After a subscription is cancelled or not paid, the organisation’s data is kept for 90 days, with warning emails 30 and 7 days before it is deleted. Nothing is deleted the moment a subscription stops.
- Invoices: as long as tax law requires.
Your rights
You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict its use or hand it over in a portable format. Where we rely on our legitimate interest, you can object. Email hello@observary.app. We may ask you to confirm who you are before we act on a request.
You can also complain to a data protection authority, for example in the country where you live or work. Ours is [name of the supervisory authority].
Changes to this page
When what we do with personal data changes, we update this page and the date at the top.