Privacy Policy
Version of 21 October 2026
1. Controller
Sjøbeck Digital, a Danish sole proprietorship (CVR no. 34358702, VAT DK34358702, Høsten Teglværksvej 23, 4690 Haslev, Denmark, tel. +45 53 50 08 98), trading as MonitorBase ("MonitorBase", "we") is the controller of the personal data described in this policy. Contact for personal data matters: christian@monitorbase.eu.
When a business customer uses the service to receive and analyse reports about its domains, the customer is the controller of that report data and of data about its own clients, and we are its processor under our Data Processing Agreement (monitorbase.eu/dpa). When a consumer uses the service, we are the controller of the report data.
2. Purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email, name, company name, login data and team members | Creating and running the account and service messages | Art. 6(1)(b) (contract) |
| Sign-in with Google, GitHub or Microsoft: name, email address and the provider’s user ID | Signing in with the login the user chooses | Art. 6(1)(b) |
| Passkeys: public key, credential ID, name and the times of creation and last use | Signing in without a password | Art. 6(1)(b) |
| Acceptance of the Terms and requests for performance during the withdrawal period (time and version) | Documenting the agreement and the consumer’s request | Art. 6(1)(f) (legitimate interest in documenting the conclusion and terms of the agreement) |
| Configuration: domains, uptime monitors (name, monitored URL or host, port, keyword, DNS record and expected values), the account’s visual identity (company name, logo, support contact) and API keys | Providing the service | Art. 6(1)(b) |
| Uptime monitoring: check results (time, status code, response time, timing breakdown, error cause and the location checked from), incidents and the times of heartbeat pings (the pinging server’s IP address is not stored, apart from server logs); status pages: address, title, component names and the status updates the account writes, which are public at monitorstatus.eu once the page is published | Providing the service | Art. 6(1)(b) |
| Billing data: plan, payment status, billing country, VAT number, invoice email address (if given) and invoices | Charging, calculating VAT (including checking VAT numbers in the EU VIES system) and bookkeeping | Art. 6(1)(b) and (c) (Danish Bookkeeping Act and VAT Act) |
| Withdrawals: name, email address, withdrawal statement and the times of order and submission | Documenting withdrawals and refunds | Art. 6(1)(c) (Danish Bookkeeping Act) and (f) (legitimate interest in documenting the withdrawal) |
| Report data in consumer accounts (see section 3) | Monitoring email authentication for the domain owner | Art. 6(1)(f) (legitimate interest in preventing misuse of the domain) |
| Sending-source directory: IP address, host name and sending domain of sending servers from reports | Identifying sending services across the service | Art. 6(1)(f) (legitimate interest in identifying sending services for all customers) |
| Free tools, sign-up and password reset: the domain checked and the result; IP address for rate limiting | Providing the free tools and preventing abuse of the tools and of sign-up and password-reset emails | Art. 6(1)(f) (legitimate interest in providing the tools and preventing abuse) |
| Server logs and sign-in event log: IP address, time, requested URL and browser data | Operation, troubleshooting and security | Art. 6(1)(f) (legitimate interest in the secure operation of the service) |
| Where you came from at sign-up: the campaign tags (utm_source, utm_medium, utm_campaign) of the page you signed up from and the host name of the site that linked to it | Learning which channels bring customers | Art. 6(1)(f) (legitimate interest in measuring our marketing) |
| Visits to our websites (see section 8): page, referring page, campaign tags (utm), browser, operating system, device type, screen size, language, and country and city derived from the IP address | Counting visits in aggregate | Art. 6(1)(f) (legitimate interest in knowing which pages and channels are used) |
| Correspondence | Answering enquiries | Art. 6(1)(b) or (f) (legitimate interest in answering enquiries) |
| Waitlists (see section 6) | One email when the product opens | Art. 6(1)(a) (consent) |
Account data is required to enter into the agreement; without it we cannot create an account. Billing data is required for a paid subscription. We do not make automated decisions, including profiling, within the meaning of Art. 22.
For passkeys we store only the public key, the credential ID, the name and the times of creation and last use. The private key and any biometric data remain on your device.
Where you came from: our websites store nothing on your device to find this out. The campaign tags and the linking site are only added to the sign-up link when you follow it, and are saved with your account when you sign up. If you do not sign up, nothing is saved.
3. Data not obtained from you (Art. 14)
Mail servers that receive email from a domain automatically send reports (DMARC and TLS-RPT) to the reporting address the domain owner has published in DNS. The reports may contain IP addresses and host names of sending servers, message counts and the results of authentication checks. Failure reports (RUF) may also contain selected header data from a single email that failed. In these, recipient addresses are reduced to the domain and sender addresses are masked to the first character without display names. The subject line is stored only if the account has enabled it, and message content is never stored.
Purposes, legal bases and retention are set out in sections 2 and 5. Requests and objections can be sent to christian@monitorbase.eu; where the data is processed for a business customer, we forward the request to that customer. Notifying each person who appears in a report would involve a disproportionate effort (Art. 14(5)(b)), so the information is provided here.
4. Recipients
We use the following processors, all of which process data in the EU/EEA or in a country with an adequate level of protection:
| Processor | Country | Task |
|---|---|---|
| Scaleway SAS | France | Hosting, database, backups and sending service email |
| AhaSend B.V. | Netherlands | Receiving report email |
| BunnyWay d.o.o. | Slovenia | DNS and delivery of our websites |
| Migadu-Mail GmbH | Switzerland (servers in the EU) | Our email |
If you choose to sign in with Google (Google LLC), GitHub (GitHub, Inc.) or Microsoft (Microsoft Corporation), that provider is an independent controller for its login service under its own terms. The provider learns that you use MonitorBase and when you sign in, and this involves a transfer to the United States that you choose. It is optional; you can sign in with a password or a passkey instead.
Alert channels: if you add a Slack, Microsoft Teams or webhook channel, we store its URL (and, for webhooks, a signing secret) and send your alerts, including monitor and domain names, to the address you entered. Slack (Salesforce) and Microsoft are US companies that you choose to send your alerts to; they are not our sub-processors, and their handling of those alerts is governed by your own agreement with them.
Payments are handled by Mollie B.V. (Netherlands) as an independent controller. VAT numbers are checked in the European Commission’s VIES system. Data is disclosed to our accountant and to public authorities where the law requires it.
Some checks send a domain name or IP address as a query to independent public services: DNS, public DNS-based blocklists, crt.sh, a certificate-transparency search service operated by Sectigo Ltd (United Kingdom), the validating DNS resolvers DNS4EU (operated by Whalebone s.r.o., Czech Republic) and Quad9 (Quad9 Foundation, Switzerland) for the DNSSEC check, and the domain registries' public RDAP and WHOIS services (for example Punktum dk for .dk domains) to look up when a domain expires. Only the domain name is sent to the registries and resolvers, and their answers are public registry data.
Reports and emails you paste or upload into a free tool are processed in memory to show the result and are not stored.
We notify account holders at least 14 days before we start using a new processor for customer data.
5. Retention
| Data | Retention period |
|---|---|
| Account data, acceptance of the Terms and configuration | While the account exists |
| Where you came from at sign-up | While the account exists |
| Linked logins (Google, GitHub, Microsoft) and passkeys | While the account exists, or until you remove them |
| Audits, alerts and aggregate reports (RUA and TLS-RPT) | The history period of the product’s plan: Free (including SSL Monitor’s free hosts) 30 days, Basic 180 days, Starter Bundle and SSL Monitor Pro 365 days, Pro and Growth Bundle 548 days, SSL Monitor Business 730 days; Agency, Enterprise and All-Monitors Enterprise while the account exists |
| Failure reports (RUF) | 30 days by default; the account can choose 1–365 days |
| Sending-source directory | 365 days after the source was last seen |
| Uptime check results | 30 days |
| Daily uptime summaries and incidents | 400 days |
| Uptime monitors, status pages and status updates | While the account exists, or until the account deletes them |
| Alert channels (URL and signing secret) | While the account exists, or until the account deletes them |
| Alert channel delivery log | 30 days |
| Free-tool results | 30 days |
| IP addresses for rate limiting | 24 hours |
| Server logs and sign-in event log | No more than 30 days |
| Visit statistics for our websites | 13 months |
| Report email held by AhaSend | 1 day |
| Database backups | No later than 66 days after deletion from the database |
| Correspondence | 12 months after the matter is closed |
| Invoices and bookkeeping records | 5 years from the end of the financial year (Danish Bookkeeping Act) |
| Withdrawals | 5 years from the end of the financial year (kept with the credit note) |
| Waitlists | Until the launch email has been sent, or until consent is withdrawn |
When an account is deleted, its data is deleted from our database immediately, except bookkeeping records and withdrawals.
6. Waitlists
If you join the waitlist for Uptime Monitor (monitoruptime.eu) or Exposure Monitor (monitorexposure.eu), we store your email address and the product and, if you provide them, the number of domains you manage (as a range) and whether you manage domains for clients. We also store the language of the site you signed up on and the time of sign-up.
We use the data only to send you one email when the product opens. The legal basis is your consent (Art. 6(1)(a)). You can withdraw your consent at any time by writing to christian@monitorbase.eu. Withdrawal does not affect the lawfulness of processing before it.
The data is deleted when the launch email has been sent, unless you then create an account, and otherwise at your request. It is stored in the EU with our hosting provider, Scaleway SAS (France).
7. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interest (Arts. 15–21). You can export and delete your data in Settings or write to christian@monitorbase.eu.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk.
8. Cookies
We do not use cookies for analytics or marketing. The app stores your login session and language choice in your browser’s local storage, which is necessary to provide the service.
Visits to our websites are counted with Umami, which we run ourselves on our own servers in the EU (Scaleway, France). It sets no cookies and stores nothing on your device. The IP address is used only to look up country and city and to form a visit key that changes every day; the IP address itself is not stored. Query parameters are removed from the address before anything is sent, except campaign tags (utm). We only see aggregate numbers, and if your browser has "Do Not Track" switched on, you are not counted.
9. Changes
We notify account holders by email at least 14 days before a material change to this policy takes effect.