This privacy policy explains which personal data Spectate processes, why, for how long, and what your rights are. It applies to our website spectate.net, the dashboard at app.spectate.net, our API, our support, and the status pages we host. Spectate is a trade name of Fjordlane Holding B.V., Guido Gezellestraat 43, 3351 CL Papendrecht, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 99322439. In this policy, "we", "us" and "our" mean Fjordlane Holding B.V.

For privacy questions or requests, email privacy@spectate.net.

1. Our two roles

We handle personal data in two different roles. Which one applies depends on whose data it is and who decides what happens with it.

Role	What it covers	What applies
Controller: we decide why and how the data is processed	Your Account, Team membership and roles, billing and subscription records, support conversations, security logs, our website, and emails we send about the Service	This privacy policy
Processor: our customer decides, we process on their behalf	Data that customers put into Spectate or collect with it: monitored URLs and their settings, check results and failure snapshots, host metrics, alerts and incidents, alert recipients and on-call people (names, email addresses, phone numbers), status pages, status page subscribers and visitor reports	Our Data processing agreement with the customer

If you are an alert recipient, an on-call person, a status page subscriber or a status page visitor, the company that uses Spectate is responsible for your data. Please contact that company first. If you contact us, we will forward your request to them and help them answer it. Section 6 explains what we do technically on status pages.

2. Personal data we process as controller

2.1 Account data

When you create an Account or accept an invitation, we process your name, email address, password (stored only as a secure hash), the time zone and preferences you set, and, if you set up two-factor authentication, an encrypted secret and recovery codes. If you sign in with GitHub, Google or Microsoft, we receive your name, email address, a provider user ID and whether the provider has verified your email address. We do not receive your password at those providers.

If you add a phone number for on-call alerts, we store it with your choice of SMS or phone call. We use it only to alert you on behalf of your Team.

2.2 Team, role and activity data

We record which Teams you belong to, your role in each Team, invitations you sent or received, and when you were last active. Actions in a Team, such as changes to monitors or incidents, appear in the Team's activity timeline.

2.3 Billing data

Vatly, our reseller and merchant of record, sells Spectate to you. It collects and processes your payment details, billing name and address, company name and VAT number, and issues invoices. Payments are processed by Mollie for Vatly. Vatly and Mollie process this data as independent controllers under their own privacy policies.

From Vatly we receive a customer reference and the details of your subscription and credit packs, such as your Plan, status and renewal date. We never see your full card or bank details.

2.4 Support and communication data

When you email help@spectate.net or use the Support page in the dashboard, we process your name, email address, your messages, attachments and our replies. We get a short notice of new questions in our internal Slack.

If you book a demo, we process your name, email address and the details you enter in the booking form. Bookings are handled by Cal.com.

2.5 Technical and security data

When you use the dashboard, the API or the website, our servers process your IP address, browser and device information, the pages and API endpoints you request, and the time. We use this to deliver the Service, to keep it secure, to limit abuse and to fix errors. Active sessions store your IP address and browser so that you can see and end them.

For error tracking we run our own Sentry installation at Hetzner in Germany, not Sentry's cloud service. Error reports contain technical details such as the error and the page or endpoint, and no cookies, request headers or request bodies.

2.6 Website visitors

Our website sets no cookies and uses no analytics or advertising trackers. Our web server processes your IP address and the pages you request to deliver the website and protect it against attacks. See our Cookie policy.

2.7 Data we do not want

We do not ask for special categories of personal data, such as health data or data about religion or political views. Please do not put such data in support messages, monitor names, incident descriptions or status pages.

3. Why we use your data and on what legal basis

Purpose	Data	Legal basis (GDPR)
Creating and running your Account and Team, and providing the Service	Account, Team, role and activity data	Performance of the contract (art. 6(1)(b)); for users invited to a customer's Team: our legitimate interest in providing the Service to that customer (art. 6(1)(f))
Signing you in with GitHub, Google or Microsoft	Name, email, provider ID, verified status	Performance of the contract (art. 6(1)(b))
Billing, plans, limits and credits	Billing data received from Vatly	Performance of the contract (art. 6(1)(b)) and legal obligations (art. 6(1)(c))
Service emails, such as email verification, security notices, trial reminders and notices about changes to our terms	Account data	Performance of the contract (art. 6(1)(b)) and legitimate interest in keeping Accounts safe (art. 6(1)(f))
Answering support questions	Support data, and the Account and Team data needed to help	Performance of the contract (art. 6(1)(b)) or legitimate interest in helping people who contact us (art. 6(1)(f))
Security, fraud and abuse prevention	Technical, security and Account data	Legitimate interest in protecting the Service, our customers and others (art. 6(1)(f))
Finding and fixing errors	Error reports, logs	Legitimate interest in a reliable Service (art. 6(1)(f))
Meeting legal obligations, such as tax and accounting rules, and orders from authorities	Billing and other relevant data	Legal obligation (art. 6(1)(c))
Defending legal claims	Data relevant to the claim	Legitimate interest (art. 6(1)(f))

Where we rely on legitimate interest, we have weighed our interest against your privacy. You can object to it (see section 9).

You need to give us your name, email address and a password (or use a sign-in provider) to create an Account. Without them we cannot provide the Service.

We do not sell personal data and do not share it for advertising.

We share personal data only where needed:

Service providers (subprocessors) that host the Service and send emails, SMS messages and phone calls for us. They are listed on our Subprocessors page, together with where they process data.
Business tools: Slack (internal support notifications), Cal.com (demo bookings) and our accountant.
Vatly and Mollie, for selling and paying for subscriptions and credits (see section 2.3).
Sign-in providers you choose: GitHub, Google or Microsoft.
Integrations your Team connects, such as Slack, Microsoft Teams, Discord, Telegram, Pushover, Intercom or a webhook. Your Team decides to send data there. Those services process it under their own terms.
Authorities, if the law or a court order requires it. We check each request and share no more than required.
A buyer or successor, if our business or part of it is sold or merged, under the same protection as in this policy.

5. Where we process data

We process personal data in the European Union. Our servers, databases, file storage and backups are hosted by Hetzner in Germany.

Some data leaves the European Economic Area (EEA) in these cases:

Checker regions. Customers can choose to check a monitor from our checkers in New York, Singapore or Sydney (servers of UpCloud, a Finnish company). The checker in that region then receives the monitor's settings and sends the results back to our servers in Germany.
Integrations and sign-in providers. Some, such as Slack, GitHub, Google and Microsoft, are based in the United States.
SMS and phone calls to numbers outside the EEA travel through carriers in that country.

For transfers outside the EEA we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. You can ask us for more information at privacy@spectate.net.

6. Status pages, subscribers and visitors

Status pages are run by our customers. The customer is the controller of the personal data on and around their status page, and we process it for them. This is what happens technically:

Visiting a status page. We count page views to show traffic, without storing IP addresses, browsers or referrers. To avoid counting the same visitor twice, your IP address is used briefly in hashed form and not stored.
Cookies. A status page only sets cookies it needs to work or to remember your choices. See our Cookie policy.
Subscribing. If you subscribe to updates by email, you confirm your address first (double opt-in). We store your email address and language. Every update has an unsubscribe link.
Reporting a problem. If you use "Report a problem", we store your message, the components you selected and, only if you give it, your email address. We do not store your IP address.

7. How long we keep data

We keep personal data only as long as needed. These are our retention periods:

Data	How long
Account data	Until you delete your Account or ask us to. We then delete it within 30 days, unless the law requires us to keep part of it
Team data	Until the Team is deleted. A deleted Team is removed permanently after 7 days. A Team without a paid Plan is deleted after 90 days, with 14 days' notice
Check results and metrics	Individual results 90 days, hourly totals 13 months, daily totals 3 years. Host metrics 30 days, hourly totals 13 months
Failure snapshots and alert charts	90 and 30 days
Status page subscribers and visitor reports	Until they unsubscribe, or the customer removes them or deletes the page
Support conversations	As long as the Account or Team exists. Attachments 90 days
Logs and error reports	14 and 90 days
Subscription records	As long as the Team exists. Vatly keeps invoices for as long as tax law requires
Backups	14 days

8. How we protect data

We take appropriate technical and organisational measures to protect personal data. For example, all connections use TLS, passwords are hashed, sensitive settings are encrypted in the database, two-factor authentication is available, and staff access to customer data is limited and logged. Read more on our Security page.

9. Your rights

Under the GDPR you have the right to:

access the personal data we have about you;
correct data that is wrong or incomplete (you can change most data yourself in the dashboard);
delete your data;
restrict the processing of your data;
receive your data in a structured, machine-readable format, and have it sent to another company (data portability);
object to processing based on our legitimate interest, and to direct marketing at any time;
withdraw consent at any time, where we rely on consent. This does not affect processing before you withdrew it.

To use your rights, email privacy@spectate.net. We may ask you to confirm your identity. We answer within one month. If a request is complex, we may extend this by two more months, and will tell you why.

If your request is about data that a customer processes with Spectate, for example as a status page subscriber, we forward it to that customer (see section 1).

10. Automated decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Some automated rules are part of the Service, such as rate limits and pausing monitoring when a trial ends. You can always contact us if you think such a rule affected you wrongly.

11. Children

The Service is for businesses. We do not knowingly process data of children under 16. If you think a child has given us personal data, please contact us and we will delete it.

12. Complaints

If you have a complaint about how we handle personal data, please contact us first at privacy@spectate.net. You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You can also complain in the EU country where you live or work.

13. Changes to this policy

We may change this policy, for example when we add a feature or change a provider. The date at the top shows the latest version. If a change matters for you, we tell you by email or in the dashboard before it takes effect.

14. Contact

Fjordlane Holding B.V. (Spectate)
Guido Gezellestraat 43
3351 CL Papendrecht
The Netherlands

Email: privacy@spectate.net