Dimitri Allegoet Consulting ("we") operates the synthetic monitoring service available at https://synthetic-monitoring.com. This policy explains which personal data we process, why, for how long, and what rights you have over it. It is written for the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Controller
Dimitri Allegoet Consulting, 62 rue Smith, 69002 Lyon, France, SIREN 999 269 723. For any question about this policy, write to contact@synthetic-monitoring.com.
We have not appointed a Data Protection Officer: our size and the nature of our processing do not require one.
What we process, and why
| Processing | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account and workspaces | Create and operate your account, your workspaces and your team | Performance of the contract | Until the account is deleted |
| Monitors and scripts | Run the monitoring you configured | Performance of the contract | Until you delete the monitor, the workspace or your account |
| Runs and their results | Show what your monitoring did, and how it behaved over time | Performance of the contract | Finished runs: 7 days on the Free plan, 60 days on a paid plan. Trial runs from the script editor: 24 hours. Hourly statistics and closed incidents: 60 days |
| Run artifacts (screenshots, videos, traces) | Let you diagnose a failed run | Performance of the contract | 7 days on the Free plan, 60 days on a paid plan, enforced by storage lifecycle rules |
| Billing | Issue, collect and keep invoices | Legal obligation | 10 years from the end of the financial year |
| Transactional emails and alerts | Verify your address, reset your password, invite members, notify failures | Performance of the contract | Lifetime of the account |
| Server logs and telemetry | Keep the service secure and available | Legitimate interest | Kept for as long as we need them to operate and secure the service, and used for nothing else |
The data we hold about you is the data you give us: your name, your email address, the content of your monitoring scripts, and the alert destinations you configure. We never buy data about you and we never sell yours.
Run artifacts may contain personal data if the pages your scripts visit display any. You choose what your scripts do; we recommend that they do not enter real personal data into the sites they monitor.
Who receives it
Your data is shared only with the service providers we need to operate the service. Each of them acts on our instructions, under a data processing agreement. They are listed, with their role and their location, on our Subprocessors page.
One of them processes data outside the European Union: Stripe, our payment provider, processes data in the United States, and that transfer is covered by Stripe's certification under the EU-US Data Privacy Framework and by standard contractual clauses. Resend, which sends our emails, stores them on the European region of our account; it is a United States company, so any support access from there is covered by standard contractual clauses. Everything else stays inside the European Union. The Subprocessors page gives, for each provider, where it processes data and under which transfer mechanism.
We may also disclose data where the law requires it, for instance on a valid request from a judicial authority.
Security
Passwords are hashed and never stored in clear text. The secrets you store for your scripts are encrypted at rest and never shown again after you save them. Monitoring scripts run in an isolated sandbox that cannot reach our databases or our internal services. Access to production is limited to the publication director.
Cookies
The site sets a single cookie, the session cookie that keeps you signed in. It is strictly necessary to provide the service you asked for, which is why it is exempt from consent under article 82 of the French Data Protection Act.
We use no analytics, no advertising, no tracking pixel and no third-party cookie. That is why you will not see a cookie banner here: there is nothing to accept or refuse. Should that ever change, we will ask for your consent before setting any such cookie, and refusing will be as easy as accepting.
Your rights
You may access your data, correct it, erase it, restrict or object to its processing, and receive it in a portable format.
Two of those rights are built into the product, on your account page: download your data as a JSON file, and delete your account. That file holds your profile, your workspaces, your monitors with their published scripts, your alert channels, the names of your secrets — never their values — and, for each workspace, its plan and the state of its subscription. The invoices themselves are issued and kept by Stripe, our payment provider, and you download them from the billing portal. Deleting your account erases your profile, the workspaces you own alone and their monitors, scripts, runs and artifacts. Invoices are kept for the ten years the law requires.
For anything else, write to contact@synthetic-monitoring.com; we answer within one month. If our answer does not satisfy you, you may lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France, www.cnil.fr.
Changes
We update this policy whenever our processing changes, in particular when a subprocessor is added or replaced. The date at the top of this page is the date of the last change; material changes are announced by email.