Privacy Policy

Introduction

Flare Warden LLC ("FlareWarden," "we," "us," or "our") operates the website monitoring service at flarewarden.com and app.flarewarden.com. This Privacy Policy describes how we collect, use, and protect your personal information when you use our services.

By using FlareWarden, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our services.

Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (stored as a secure hash, never in plain text)
• Region preference (for data residency)
• How you found us: your optional answer to “Where did you hear about us?”, and the campaign label, referring site’s domain and landing page of the visit that led to your sign-up, where we have them, including the reference code in a link from an email we sent you (see Cookies and sign-up attribution)

Session and Security Data

For security and service delivery, we collect:

• IP address (when you log in)
• User agent (browser and device information)
• Session tokens (for authentication)

Team and Organization Data

If you use team features, we collect:

• Team member email addresses
• Roles and permissions
• Invitation records

Monitoring Data

When you create monitors, we collect and store:

• URLs you choose to monitor
• Check results (response times, status codes, error messages)
• SSL certificate information (expiry dates, fingerprints, chain details)
• DNS records (A, AAAA, MX, CNAME, TXT, CAA records)
• Content verification results

Status Page Subscriber Data

If you create public status pages, your visitors may subscribe for updates. We collect:

• Subscriber email addresses (with their consent)
• Notification preferences
• Timezone (for localized notifications)

Note: Status page subscribers provide their email addresses voluntarily and must verify their email through double opt-in. They can unsubscribe at any time.

"Email me when it is back up" on our public status pages

Our public pages at flarewarden.com/status report whether well-known third-party services are reachable. You do not need an account to use them. While a service is down, those pages offer to email you once when it recovers. If you use that form we collect:

• The email address you enter
• Which service you asked about, and when you asked

That is everything. No name, no account, no marketing preferences, and no profile.

We send one email and then delete your address. This is a single request, not a subscription: once we have told you the service is back, the record is deleted, so we cannot email you again and there is nothing to unsubscribe from. If the service has not recovered within seven days we delete the request unsent, because an address we are no longer going to email is one we should not still be holding. To be told again during a future outage, simply ask again on the page.

These addresses are stored in the region that collected them — a request made in Europe stays in our European database and is not copied to the United States or Asia-Pacific. Our global infrastructure records only that a service recovered, which identifies nobody.

Audit Logs

We maintain audit logs of account activity including user actions, IP addresses, and timestamps. These logs help us maintain security and troubleshoot issues.

How We Use Your Information

We use the information we collect to:

• Provide our services: Execute monitoring checks, detect incidents, and send notifications
• Cross-region validation: Validate failures from multiple geographic regions to prevent false positives
• Account administration: Manage your account, process payments, and provide customer support
• Security: Detect and prevent fraud, abuse, and security threats
• Service improvement: Analyze usage patterns to improve our services
• Communication: Send transactional emails about your account and service updates
• Sales emails: Check the email domains and monitored sites of existing accounts, to avoid sending sales emails to existing customers or to sites they monitor, and measure whether our sales emails led to sign-ups and paid plans. For this we compare keyed hashes of a new account’s email address, email domain and first monitored site with the people we emailed, never the addresses themselves, and note the account’s plan, trial and first payment or refund, in a record deleted with the account (see People we contact about FlareWarden)

Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process personal data under the following legal bases:

• Contract Performance (Article 6(1)(b)): Processing necessary to provide our monitoring services, manage your account, process payments, and deliver notifications you have configured
• Legitimate Interests (Article 6(1)(f)): Security monitoring, fraud prevention, service improvement, and analytics. We balance our interests against your rights and only process data where our interests do not override your fundamental rights
• Consent (Article 6(1)(a)): Status page subscribers provide consent when subscribing to notifications. You may withdraw consent at any time
• Legal Obligation (Article 6(1)(c)): Processing required for tax, accounting, and regulatory compliance

You may contact us at support@flarewarden.com to learn more about the specific legal basis for any particular processing activity.

Data Protection Representative (EU/EEA, UK, and Switzerland)

Flare Warden LLC is based in the United States. As required by Article 27 of the EU GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection (FADP), we have appointed the following representative for data subjects and supervisory authorities in the EU/EEA, UK, and Switzerland:

Data Protection Representative Limited (trading as DataRep)

If you want to raise a question about how we handle your personal data, or exercise your rights under data protection law, you may contact our representative by:

• Email: datarequest@datarep.com (quoting "Flare Warden LLC" in the subject line)
• Online: www.datarep.com/data-request
• Mail: By writing to DataRep at the most convenient of their 31 locations across the EU/EEA, UK, and Switzerland

When mailing your inquiry, please ensure your letter is addressed to "DataRep" and not to Flare Warden LLC, otherwise it may not reach our representative. For general questions about FlareWarden's products or services (not related to data protection), please contact us directly at support@flarewarden.com.

Cookies and Sign-up Attribution

We use the following cookies:

The first four cookies above are strictly necessary — they sign you in, keep you on the right region, protect forms, and remember your privacy choice — so they are set without asking. fw_attrib is the only optional one: it is set solely if you press “Allow” in the privacy banner, is never used for advertising or cross-site tracking, and is deleted the moment it is used. It lets us remember, for up to 30 days, the campaign that first brought you to us.

Sign-up attribution without cookies. When you arrive from another site or a tagged link, our server reads three things from the page request your browser already sends — the campaign label in the link (such as ?ref= or utm_source), the referring site’s domain (never the full address), and the page you landed on — and carries them in our own links, as ?fwa=, through to the sign-up form. Nothing is stored on your device for this, and the only thing read from it is your privacy-banner choice, so that a “Decline” is honoured. If you sign up, these labels (or, if you pressed “Allow”, the ones in fw_attrib) are kept with your account so we know which campaign or site brought you, and are deleted with your account. Apart from an email reference code (below), they hold no identifiers. We do this under our legitimate interest in knowing which channels bring us customers, and you can object at any time by contacting us. If you press “Decline” in the privacy banner, we record neither the cookie nor these labels, and any fw_attrib cookie from an earlier “Allow” is deleted. We remember a Decline for 12 months; if your browser clears that record, we can no longer tell, and the banner asks you again. Your answer to the optional “Where did you hear about us?” question on the sign-up form is kept with your account for the same purpose, and is deleted with it. Because you choose whether to give it, it is kept even if you pressed “Decline”.

Links in emails we send. A link in an email from us may carry a short reference code, for example in utm_content, that tells us which of our emails it came from. It is a random code, not your name or email address. If you sign up after clicking it, we keep it with your account to see which email led to your sign-up and to stop sending you those emails, and it is deleted with your account. Pressing “Decline” in the privacy banner stops us recording it, as it does for the other labels.

On our marketing site and our sign-up page, we also use Ahrefs Analytics for aggregated traffic analysis; it is cookieless — it stores nothing on your device and cannot follow you across sites — and runs under our legitimate interest in understanding how the site is used. To count a visit it reads standard information your browser provides, such as the referring page, screen size and language, and it may process your IP address. When you sign up, the sign-up page also tells it which plan you picked and the source labels described above (the campaign label or referring site, and your answer to “Where did you hear about us?”), never your email address. Before it loads there, we remove any email address or website address from the page address. You can object to all of this at any time by contacting us. Our application uses Sentry for error monitoring; it sets no cookies on our pages. On our contact page, hCaptcha may set cookies to prevent spam.

People we contact about FlareWarden

We send a small number of sales emails to people at businesses we think could use FlareWarden. If you received one, this section explains where your details came from, what we checked, what we keep, and how to stop us.

Where your details came from

Your name, work email address, job title and company come from Apollo.io, a business-contact data provider. What we say about your company comes from its public website.

The public checks we run

Before we write, we look at a company’s public website the way a visitor’s browser would: we look up the DNS record for its status page address (status.yourdomain), load that page, and load the home page, its /status page and up to two of its service, pricing or support pages. We do this at most four times within 14 days, no faster than one request a second. If we decide not to email you, we do not check again for at least a year. These requests identify themselves with the User-Agent FlareWarden-ProspectCheck/1.0 (+https://flarewarden.com/privacy#outreach). They are one-time reads, not monitoring: we do not add your site to FlareWarden.

What we keep, and for how long

• If we decide not to email you: our record of you is deleted after 120 days, and what our checks found about your company after 180 days.
• If we email you: our record of each email we sent, of each reply (when it arrived and what kind of reply it was), and of what our checks found is kept for 365 days. The text of any answer we send you is kept for 90 days. Apart from the copy in our mailbox, we do not store the text of your replies.
• If you ask us to stop: we keep your email address on a do-not-contact list, with no end date, so that we never email you again. If you ask us not to contact your company, we keep its domain on that list too.
• Our mailbox and Apollo.io: the emails themselves stay in our outreach mailbox, like any business correspondence, and Apollo.io keeps the contact we added with the emails it scheduled. Ask us and we will delete both.

Replies

When you reply, we may send the text of your reply to Anthropic to work out what kind of reply it is and, where we answer, to draft the answer. An answer written this way says so.

How to stop us, or have your details deleted

Reply “stop” to any of our emails and you won’t hear from us again. To have your details deleted, or to ask what we hold about you, email support@flarewarden.com.

Third-Party Services

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share data only with the service providers below, and only as needed to operate FlareWarden:

Data Retention

We retain different types of data for different periods:

• Check results: retained for the life of your account; how far back you can view them in-app depends on your plan (90 days to unlimited)
• Webhook delivery logs: 7-30 days based on your plan
• Session data: 30 days (automatically cleaned up)
• Audit logs: Duration of your account (IP addresses and user agents are anonymized after 90 days)
• Account data: Until you delete your account
• "Email me when it is back up" requests: deleted as soon as the notification is sent, and after 7 days if the service never recovers

Your Rights

You have the following rights regarding your personal data:

• Access: Export your data anytime via Account > Privacy & Data
• Correction: Update your profile information in your account settings
• Deletion: Delete your account via Account settings. This permanently removes all your data including monitors, team members, status pages, and historical data
• Portability: Export your data in CSV format

For EU residents (GDPR) and California residents (CCPA), you have additional rights including the right to object to processing and the right to restrict processing. Contact us at support@flarewarden.com to exercise these rights.

Data Security

We implement industry-standard security measures to protect your data:

• Passwords are hashed using bcrypt with a high cost factor
• All connections are encrypted using HTTPS/TLS
• Data is isolated between accounts
• CSRF protection on all forms
• Regular security reviews

For more details, see our Security page.

Children's Privacy

FlareWarden is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

International Data Transfers

FlareWarden operates in multiple regions (US-East, EU-West, Asia-Pacific). When you select a region, your account data is primarily stored in that region. However, some data may be processed in other regions for cross-region validation and service delivery.

Some of our sub-processors are based in the United States, including Sentry (error monitoring), Resend (email delivery), and Stripe (payments). For transfers of personal data from the EEA to the US, we rely on:

• EU-US Data Privacy Framework: Where our US-based sub-processors are certified participants
• Standard Contractual Clauses (SCCs): As provided in our sub-processor data processing agreements where the Data Privacy Framework does not apply

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Your continued use of FlareWarden after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Flare Warden LLC
PMB 128, 9801 Fall Creek Rd
Indianapolis, IN 46256, USA
Email: support@flarewarden.com