Privacy Policy
Last updated: October 27, 2026
At Watchful, we take your privacy seriously.
We’re website professionals ourselves, and we understand how important it is to protect your personal information and the information belonging to your clients.
This Privacy Policy explains what information we collect, why we need it, how we protect it, and what choices you have.
It applies to the Watchful website, our website management platform, and the services we provide.
Our promises
1. Strong Data Security. We will protect your data like it’s our own.
2. Minimal Data Collection. We won’t collect more information than we need to provide and improve the Watchful service.
3. Sensible Data Use. We’ll only use your information for the purposes described in this policy. We’ll NEVER sell your personal information. We only share what’s necessary with trusted service providers who help us deliver our services.
4. Clear Communication. We’ll do our best to communicate clearly and honestly about how we use and protect your information.
5. No Spam. You decide whether you want to receive our marketing emails. You can unsubscribe whenever you want.
6. Customer-Controlled Backups. Your website backups are encrypted and stored in the EU. Only you control the keys needed to decrypt them. We can’t read their contents, and we’ll delete your stored backups immediately when you delete your Watchful account.
Your rights
You have important rights when it comes to your personal information. Depending on the laws that apply to you, these include:
- The right to know. You can ask how and why we’re using your personal information. That’s one reason we’ve written this policy in plain English.
- The right to access. You can ask us for a copy of the personal information we hold about you.
- The right to correct. You can ask us to fix information that’s inaccurate or incomplete. You can also update much of your information directly in your Watchful account.
- The right to be forgotten. You can ask us to delete your personal information in circumstances where the law gives you that right.
- The right to restrict or object. You can ask us to stop or limit certain uses of your personal information.
- The right to say no to marketing. You can unsubscribe from our marketing emails at any time.
- The right to move your data. In certain circumstances, you can ask for your personal information in a format that lets you transfer it to another service.
- The right to withdraw consent. If you’ve given us permission to use your information for a particular purpose, you can withdraw that permission at any time.
You also have the right to make a complaint to a relevant data protection authority if you believe your privacy rights have been violated.
Some rights have legal conditions or exceptions. For example, we may need to retain certain billing information to meet tax or accounting obligations.
If you’d like to exercise any of your rights, have a complaint, or just want to ask us a question, contact our team. We’re here to help.
Protecting your privacy
We know you trust Watchful with important information about your websites and your business. We take that responsibility seriously.
We use appropriate technical and organizational safeguards to protect information against unauthorized access, loss, misuse, and disclosure.
Our website management infrastructure is located within the European Union, and our website backup service uses encryption with customer-controlled decryption keys.
No online service can promise absolute security. However, protecting your information is an ongoing priority in how we develop and operate Watchful.
Who is responsible for your data?
Privacy laws such as the EU General Data Protection Regulation (GDPR) distinguish between two important roles.
A data controller decides why and how personal information is processed. A data processor handles personal information on behalf of a controller.
Watchful may perform either role, depending on the information involved.
When you create a Watchful account, we’re generally the data controller for the personal information you provide directly to us, such as your name, email address, and billing details.
When you use Watchful to manage client websites, you’re generally the data controller, or acting on behalf of one, while Watchful is a data processor for information handled as part of those services.
This includes personal information that may be contained in encrypted website backups.
Our Data Processing Agreement explains these responsibilities in more detail.
How we collect information
We collect different types of information depending on how you use Watchful.
Information you give us
When you create an account, purchase a subscription, or contact our support team, we may collect:
- Your name and email address
- Company name
- Mailing or billing address
- Telephone number
- Business tax identification details, where applicable
- Subscription and billing information
- Support requests and correspondence
- Account settings and preferences
You don’t have to provide every piece of information we ask for. However, some details are necessary to create an account, purchase a subscription, or use particular features.
Information collected automatically
When you visit our website or use Watchful, we may collect technical information such as:
- Your IP address
- Browser and operating system
- Device information
- Pages and features you use
- Login and security events
- Dates and times of activity
- Cookies and similar technologies
Some of this information, including IP addresses, may qualify as personal data under privacy laws.
We use this information to operate Watchful, keep it secure, troubleshoot problems, and improve our services.
Information about websites you manage
When you add a WordPress or Joomla! website to Watchful, we collect technical information needed to monitor, maintain, and secure that website.
This may include:
- Website URLs and IP addresses
- Installed software and version information
- Available and completed updates
- Website configuration and status
- Uptime and performance results
- Security scans and vulnerability findings
- Website activity logs
- Backup information
- Information included in website reports
Our routine website management tools are designed to minimize the collection of personal information from your clients’ websites.
Some technical records, particularly activity logs and diagnostic information, may nevertheless contain personal data.
We use this information to provide the website management services you’ve requested.
Information contained in website backups
Watchful also provides a service for backing up your websites, including their files and databases.
Unlike routine website management, backups may contain substantial amounts of personal information, such as names, email addresses, customer records, form submissions, and user accounts.
Here’s how we protect that information:
- Your website backups are encrypted.
- Backups are stored on servers located within the European Union.
- Only customers can decrypt/restore their backups.
- Watchful cannot decrypt or inspect the contents of stored backups.
- Backup contents are used only to provide the backup and restoration services you’ve requested.
Even though encrypted backups may contain personal information protected by the GDPR, customer-controlled encryption helps keep that information confidential.
How we use your information
We use your information to provide Watchful and make the service better.
Here’s what that means in everyday terms.
Your name and contact details
| What we do | Why we do it |
|---|---|
| Create and manage your account | So you can access and use Watchful |
| Send invoices and billing notices | So you know what you’ve been charged and can manage your subscription |
| Send important service messages | To let you know about security issues, account changes, and other important events |
| Respond to your questions | So we can provide customer support |
| Send product news, with your permission where required | To keep you informed about useful features and improvements |
| Prevent fraud and abuse | To protect you and Watchful |
Your payment information and billing history
| What we do | Why we do it |
|---|---|
| Process subscription payments | So you can use paid Watchful services |
| Manage subscription changes and refunds | To support upgrades, downgrades, cancellations, and billing adjustments |
| Maintain transaction records | To meet accounting, tax, and legal obligations |
| Detect suspicious transactions | To help prevent fraud |
Payment information is processed through trusted payment service providers, including Recurly.
Your conversations with us
This includes support tickets, emails, and other messages you send to Watchful.
| What we do | Why we do it |
|---|---|
| Respond to your messages | To answer questions and resolve problems |
| Review previous conversations | So you don’t have to explain the same issue repeatedly |
| Learn from customer feedback | To improve our products and support |
Information about your devices and how you use Watchful
| What we do | Why we do it |
|---|---|
| Monitor service usage | To understand how Watchful is being used and improve the experience |
| Troubleshoot technical problems | To identify and resolve errors |
| Monitor security events | To protect accounts and prevent unauthorized access |
| Understand feature usage | To help us prioritize improvements |
Information about your managed websites
| What we do | Why we do it |
|---|---|
| Check website status and uptime | To help you identify problems |
| Monitor available updates | To help keep your websites maintained |
| Run security and vulnerability checks | To identify potential security risks |
| Record website activity | To help you review changes |
| Generate website reports | To help you communicate results to clients |
| Store encrypted website backups | To help you protect and restore website files and databases |
We don’t sell website management information or use encrypted backup contents for advertising or marketing.
Our legal reasons for using your information
Privacy laws require us to have a valid reason for processing personal information.
Depending on the circumstances, we rely on one or more of these reasons:
- To deliver the service you’ve requested. For example, we need your account information to provide Watchful and administer your subscription.
- To meet legal obligations. For example, we may need to maintain transaction records for tax or accounting purposes.
- To pursue legitimate business interests. For example, protecting our services against fraud, improving reliability, and providing customer support, provided those interests don’t override your rights.
- Because you’ve given permission. For example, where consent is required for marketing communications or nonessential cookies.
When Watchful processes personal data on behalf of a customer, that customer is generally responsible for determining the lawful basis for the processing it requests.
Where we store your information
We know that where your information is stored matters.
Watchful stores and processes website management information exclusively on servers within the European Union.
This includes website monitoring information, security scan results, activity records, and encrypted website backups.
Your website backups, including database backups, remain stored on EU-based servers.
Most personal information associated with your Watchful account is also stored within the EU.
However, we use certain third-party services for activities such as payment processing and email communications. These providers may process some account-related personal information outside the EU.
Where international transfers occur, we use appropriate data protection safeguards as required by applicable law.
How we protect your website backups
Website backups deserve special attention because they may contain sensitive information about your business and your clients.
That’s why Watchful uses encrypted backups with customer-controlled decryption .
You control decryption. We don’t.
Only customers can decrypt their backups. Watchful cannot decrypt or read their contents.
We store encrypted backups exclusively on EU servers and use them to provide the backup and restoration services you’ve requested.
If you delete your Watchful account, we immediately delete all associated stored website backups from our servers.
This includes backups containing website files and databases.
Once deleted, those backups cannot be restored through Watchful.
How long we keep your information
We don’t want to keep your information longer than necessary.
Generally, we retain information for as long as you have an active Watchful account or as long as we need it to provide our services.
Some information may be kept longer where necessary to meet legal obligations, prevent fraud, resolve disputes, or maintain required business records.
What happens when you delete your account?
You can delete your Watchful account from the Account & Subscription area.
When you delete your account:
- Your associated account records are immediately deleted from Watchful’s servers.
- Your stored website backups, including encrypted database backups, are immediately deleted from Watchful’s servers.
- Your deleted backups are no longer available for restoration through Watchful.
Some billing and transaction information held by external payment providers may need to be retained to satisfy legal or regulatory requirements.
Deleting your Watchful account does not automatically erase records that third-party providers are legally required or otherwise permitted to retain.
If you have questions about deleting your information, please contact us.
Sharing your personal information
We want to earn and maintain your trust.
We will never sell your personal information.
We do work with a few trusted service providers to operate Watchful. We share only the information they need to perform their services.
For example:
- Recurly helps us manage subscriptions and billing.
- Mailchimp currently helps us send email communications.
- Hosting and infrastructure provider (AWS) helps us operate, secure, and maintain Watchful.
We use appropriate contractual and security safeguards when these providers process personal information on our behalf.
We may also disclose information if required by law or a valid legal process, or where legally permitted and necessary to protect against fraud or serious security threats.
We may use or share genuinely anonymized, aggregated information to understand how our services are used, provided it cannot reasonably identify individuals.
We do not share customers’ backup decryption keys with service providers because Watchful does not control those keys.
Changing or deleting your personal information
You can update much of your personal information by signing in to Watchful and visiting the Account & Subscription area.
You can also use this area to delete your Watchful account.
If you’d like us to correct, provide, or erase personal information that you can’t manage yourself, please contact us.
We’ll review your request and respond according to applicable privacy laws.
What about information on your clients’ websites?
When Watchful processes personal information on behalf of a website owner, that owner is generally responsible for responding to requests from its website users.
For example, if someone wants their personal information deleted from a website database, they should normally contact the website owner.
Watchful assists customers with their data protection obligations as required by law and our Data Processing Agreement.
Because only customers control the decryption keys for their website backups, Watchful cannot independently search for, inspect, or modify individual records within encrypted backups.
Data Processing Agreement
We make a Data Processing Agreement (DPA) available to Watchful customers.
The agreement explains how Watchful processes personal data on behalf of customers, including responsibilities relating to security, confidentiality, subprocessors, and data protection rights.
It also applies to personal data processed through our encrypted website backup service.
You can review and submit the agreement using the tools in the Account & Subscription area.
See Watchful’s Data Processing Agreement instructions for details.
Cookies
Like most websites, Watchful uses cookies and similar technologies.
Cookies are small files that help websites remember information about your visit.
We may use cookies to:
- Keep you signed in
- Remember preferences
- Protect your account
- Understand how visitors use our website
- Improve our website and services
Some cookies are essential for Watchful to function. Others, such as certain analytics cookies, are not essential.
Where required by law, we’ll ask for your permission before using nonessential cookies.
You can manage cookies through your browser and any cookie preference controls available on our website.
Blocking certain cookies may affect how Watchful works.
How to stop service notifications
Watchful can send notifications about website events such as software updates, security issues, downtime, and other monitoring results.
Many of these notifications can be configured or disabled through your account settings.
Some notification features, including certain security notifications, require you to enable email notifications before they are sent.
Other messages, such as important billing, account security, and service administration notices, may be necessary to provide your account and cannot always be disabled.
You can manage available notification preferences in Watchful.
How to stop marketing messages
We may send occasional emails about new features, resources, and improvements to Watchful where you have given permission or where otherwise allowed by law.
We don’t want to send you information you don’t want.
You can stop receiving marketing emails at any time by:
- Clicking the unsubscribe link at the bottom of a marketing email
- Contacting our support team
We’ll update your marketing preferences accordingly.
Unsubscribing from marketing messages won’t prevent essential service communications, such as invoices, account security notices, and important service updates.
Third-party websites and services
Sometimes we’ll link to websites or services operated by other companies.
We don’t control how those companies collect or use personal information.
Their own privacy policies and terms apply when you use their services.
We encourage you to review those policies before sharing personal information.
Children’s privacy
Watchful is a professional website management service and is not intended for children under 13.
We do not knowingly solicit personal information directly from children under 13 through our account registration process.
However, websites managed by Watchful customers may contain information about children. That information may also be included in encrypted website backups.
The website owner is responsible for ensuring that personal information collected through its website is handled lawfully.
Changes to this Privacy Policy
We may update this policy as our services evolve or privacy laws change.
When we make changes, we’ll publish the revised policy on our website and update the date at the top.
Where required by law, we’ll provide additional notice or seek your consent before making material changes.
We encourage you to review this policy from time to time.
Terms and Conditions
Please also review our Terms of Service for the terms that govern your use of Watchful.
How to contact us
If you have any questions about this Privacy Policy, your personal information, or how we protect your privacy, we’d be happy to hear from you here.