At Watchful, we take the privacy of your personal information seriously. This commitment extends to the information associated with the client websites you manage.

Our goal is to provide a privacy-first website management suite that minimizes the collection of personal information, protects website data through encryption, and keeps website management information securely stored within the European Union.

Here are five ways we protect your privacy and support compliance with the EU General Data Protection Regulation (GDPR).

1. We minimize the collection of personal information

Watchful is designed to manage and monitor websites while minimizing the collection of personal information.

Our website management tools collect technical information needed to monitor, maintain, and secure your websites. This includes installed software, available updates, security findings, and website activity.

For routine website management, Watchful does not need to download or store your website’s database of registered users or customers.

For customers who enable our backup service, Watchful also stores encrypted backups of their websites, including website files and databases. These backups may contain personal information, such as usernames, email addresses, customer records, and form submissions.

Importantly, only customers control the decryption for their backups. Watchful cannot decrypt or inspect the contents of these backups.

This approach allows us to provide website backup and restoration services without requiring access to the personal information contained in your website databases.

2. We store website management data exclusively in the EU

Watchful collects technical information about the websites you manage, including IP addresses, installed extensions, software versions, completed updates, and security scan results.

We store and process this website management information exclusively on servers located within the European Union.

This commitment also extends to our backup service. All website backups, including website databases, are stored in encrypted form on EU-based servers.

Because customers exclusively control decryption, Watchful cannot access the unencrypted contents of these backups.

Some technical website information and backup contents may qualify as personal data under the GDPR. Encryption does not remove personal information from the scope of the regulation, but it provides an important layer of protection against unauthorized access.

By combining EU-based infrastructure, customer-controlled encryption, and data minimization, Watchful helps protect the information associated with your websites.

3. We provide a Data Processing Agreement

The GDPR establishes responsibilities for organizations that determine how personal data is used (data controllers) and organizations that process personal data on their behalf (data processors).

When Watchful processes personal data on behalf of customers managing their websites, including the storage of encrypted website backups, Watchful generally acts as a data processor.

Watchful also acts as a data controller for personal information collected directly from its own account holders.

Our Data Processing Agreement (DPA) describes our responsibilities when processing personal data on behalf of customers, including obligations relating to security, confidentiality, and subprocessors.

Watchful users can review, sign, and submit the Data Processing Agreement from the Account & Subscription area of their Watchful account.

4. We protect account holders’ personal information

To provide our services, Watchful collects certain personal information from account holders, including names, email addresses, and billing information where applicable.

Most of this information is stored on our EU-based infrastructure.

We also use trusted third-party service providers to support essential business operations, including payment processing and account-related email communications.

These providers currently include Recurly for subscription billing and Mailchimp for email communications.

Some of these services operate outside the EU. Where personal data is transferred internationally, we use applicable contractual and data protection safeguards to support compliance with the GDPR.

Information shared with these providers is limited to what is necessary to deliver their respective services.

Our use of third-party billing and email services is separate from our website backup infrastructure. Encrypted website backups remain stored on EU-based servers.

5. We provide tools to delete your personal information

The GDPR gives individuals important rights over their personal data, including the right to request erasure under certain circumstances.

Watchful provides tools that allow account holders to cancel their subscriptions and delete their Watchful accounts directly from the Account & Subscription area.

When you delete your Watchful account, the associated account records and all stored website backups are immediately deleted from Watchful’s servers.

This includes encrypted backups containing website files and databases.

Because customers exclusively control their backup decryption keys, Watchful cannot inspect or retrieve the personal information contained within those backups.

Certain information held by third-party service providers, such as billing and transaction records, may be retained where necessary to meet legal or regulatory obligations.

You can also contact Watchful to exercise your applicable data protection rights, including requesting access to, correction of, or deletion of your personal information.

Our commitment to privacy-first website management

Privacy is an important consideration in how we design and develop Watchful.

We minimize the collection of personal information, store website management data exclusively in the EU, and provide encrypted backups that only customers can decrypt.

We also give account holders control over their information, including the ability to permanently delete their accounts and stored website backups.

Together, these measures reflect our commitment to providing website management tools that respect and protect the privacy of our customers and their clients.

We encourage you to review our Privacy Policy for more information about how we collect, process, store, and protect personal information.