Privacy policy

Apostrof SRL, a company registered in Romania under number 15735302 with its registered office at Bucharest, is the controller of the personal data described here. Write to office@apostrof.ro about anything on this page.

This policy covers data we hold about you — your account, your billing, your use of the service. Data you put into Pinger about other people is yours; we process it on your instructions as described in the Data processing agreement.

What we collect, and why

Your account

Data	Why	Lawful basis
Name, email address	To identify you, sign you in, and send you alerts and account email	Performance of the contract
Password (hashed), passkeys, two-factor secrets	To keep the account yours	Performance of the contract
Timezone, language, interface preferences	To render times and text the way you expect	Performance of the contract
IP address, browser and device details of a sign-in	To detect and investigate unauthorised access	Legitimate interest in securing accounts

Billing

Data	Why	Lawful basis
Company name, address, country, county, VAT number, trade register number	To issue a valid invoice	Legal obligation
Stripe customer and subscription identifiers	To bill you and keep your plan in step with what you pay for	Performance of the contract
Invoice records and payment history	To account for the money and to file it	Legal obligation

We never see or store your card details. Stripe collects them directly and we receive only the card type and last four digits.

What you monitor

The URLs, request settings and assertions you configure, and the results of every check — status codes, timings, response headers, certificate details, DNS records and resolved addresses.

Any credentials you configure for a monitor are encrypted at rest, are never written to a log, never returned to your browser after you save them, and never appear in an error message.

This material is usually not personal data at all. Where it is — a response body containing someone's name, for instance — you are the controller and we are the processor.

The public site

We do not use analytics cookies, advertising cookies or third-party trackers on the marketing pages. We count visits ourselves, per day, page and referring site or campaign; the count keeps neither your IP address nor anything else that identifies you; if you sign up, the campaign or site that sent you is kept with your account. The Cookie policy explains how, and lists the few cookies that do exist.

Who else touches it

We use a small number of subprocessors, each for a specific job:

Subprocessor	What they do	Where they process
Stripe Payments Europe, Ltd.	Payment processing, subscription billing and tax determination	Ireland (EU), with onward transfers to the United States under Stripe's standard contractual clauses
[TO BE COMPLETED]	Application hosting, database storage and backups	[TO BE COMPLETED]
[TO BE COMPLETED]	Delivery of alert, billing and account email	[TO BE COMPLETED]
Oblio Software SRL	Issuing fiscal invoices and filing them with the Romanian e-Factura system	Romania (EU)

We will tell you before adding a subprocessor that processes your data, so that you can object.

Beyond these, we disclose personal data only where we are legally required to, and we will tell you unless we are prohibited from doing so.

Where it is processed

Inside the European Economic Area, except where a subprocessor's own transfers are covered by standard contractual clauses — which the table above states explicitly for each one.

How long we keep it

• Raw check results — shown for 90 days and deleted at most 122 days after they were recorded. Results are stored a month at a time, and a month is dropped once its newest result is past 90 days. The deletion is physical: past that point the rows are gone and the only copy is a backup.
• Daily rollups — the aggregated uptime and response-time figures behind the long-range charts are kept indefinitely, because they are one small row per monitor per day and they are what makes a year-on-year comparison possible.
• Account and monitor configuration — for as long as the account exists.
• After you delete your account — removed within 30 days, backups included.
• Invoices and accounting records — 10 years. This is a legal obligation under Romanian accounting law and it survives a deletion request: we must keep the invoice, so we keep the name, address and registration numbers printed on it. Nothing else about the account is retained.

Your rights

Under the GDPR you can ask us to:

• give you a copy of your personal data, in a portable format;
• correct anything that is wrong — most of it you can edit yourself in settings;
• delete your data, subject to the fiscal retention above;
• restrict or object to processing based on our legitimate interests;
• withdraw consent, where we relied on it.

Write to office@apostrof.ro. We will answer within one month, free of charge. We may ask you to confirm who you are first, which is a protection for you rather than an obstacle.

Deleting is self-service. Profile settings → Delete account removes your login and the account at once: monitoring stops, any subscription is cancelled, and the data is erased within the period above. The other requests, including a copy of your data, are handled by hand — an email is the way, not a lesser option: the same rights, the same deadline.

If you think we have got something wrong, you can complain to the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or to the authority where you live.

Security

• Everything travels over TLS.
• Passwords are hashed; monitor credentials and notification channel configuration are encrypted at rest.
• Access to production data is limited to the people who need it and is logged.
• Every account's data carries its account, and the application limits every query to the signed-in account automatically; automated tests check that one account cannot reach another's.
• Backups are encrypted.

No system is perfectly secure. If you find a vulnerability, please write to office@apostrof.ro before disclosing it publicly, and we will work with you.

If a breach affects your personal data and is likely to result in a risk to you, we will notify the supervisory authority within 72 hours and tell you without undue delay.

Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. Plan limits are enforced automatically, but they are the terms you signed up to rather than a judgement about you.

Children

Pinger is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

Changes

We will update this page when what we do changes, and the date at the top says when. If a change materially affects you, we will email you before it takes effect.