This Privacy Policy explains how Cronitorex collects, uses, and protects personal data, in compliance with Regulation (EU) 2016/679 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.
1. Data controller
The controller of your personal data is Prosoftware.pl Dominik Ćwiklik, with registered office at Wola Łużańska 208, 38-322 Wola Łużańska, Tax ID (NIP / VAT-EU) PL7381984964, registration number (REGON) 120765474.
Contact regarding data protection: hello@cronitorex.com.
2. Categories of data we process
2.1 Account data
- Email address (required for registration and login)
- Display name (optional)
- Password (stored only as a cryptographic hash)
- API key (stored to authenticate ping requests)
- Time zone preference
2.2 Usage data
- Monitor names, configurations, and tags you create
- Event payloads sent via the API (status, duration, exit code, host, optional message and metadata)
- Source IP address of incoming pings (used to identify origin and detect abuse)
- HTTP / SSL check results for monitors you configure
2.4 Technical data
- IP address from which you access the dashboard
- Browser type and version, operating system
- Pages visited within the application
- Session cookies (see Cookie Policy)
3. Purposes and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the Service (Account, monitors, pings, dashboard) | Art. 6(1)(b) - performance of a contract |
| Billing, invoicing, tax records | Art. 6(1)(b) and Art. 6(1)(c) - legal obligation (accounting law) |
| Security, abuse detection, log retention | Art. 6(1)(f) - legitimate interest |
| Service announcements, security notices | Art. 6(1)(b) - contract performance |
| Marketing communications (only if explicitly opted in) | Art. 6(1)(a) - consent |
4. Retention periods
- Event data (pings, monitor results): retained according to your plan's history window (7 days on Free, 30 days on Starter, 90 days on Pro, 365 days on Business).
- Account data: retained for as long as your Account is active.
- After Account deletion: technical logs purged within 30 days; account record kept for 30 days to allow reactivation, then permanently deleted.
- Billing records: retained for 5 years from the end of the relevant tax year as required by Polish accounting regulations.
- Security logs: retained for up to 90 days for abuse investigation, then deleted.
5. Recipients and third-party processors
We share personal data only with the following processors, bound by data processing agreements:
- Connectivity provider (Toya S.A., Poland) - network transit only, no access to content.
Cronitorex is hosted on our own infrastructure located in Poland. Internet connectivity is provided by Toya S.A.; all traffic is encrypted in transit (TLS 1.3) and the connectivity provider does not access content. Transactional emails (account confirmations, alerts, password resets) are sent from our own mail server; no third-party email processor is involved.
We do not sell, rent, or otherwise share personal data with third parties for marketing purposes.
6. International transfers
Where any processor operates outside the EEA without an adequacy decision, transfers are protected by Standard Contractual Clauses (Art. 46 GDPR) as published by the European Commission.
7. Your rights
Under GDPR you have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate or incomplete data (Art. 16)
- Erasure ("right to be forgotten", Art. 17)
- Restriction of processing (Art. 18)
- Data portability - receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the Polish supervisory authority - Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl
You can exercise most rights directly from the dashboard (data export, account deletion). For other requests contact hello@cronitorex.com; we will respond within 30 days.
8. Security measures
- All traffic encrypted in transit (HTTPS / TLS 1.3)
- Passwords stored as cryptographic hashes
- Database isolated on a private network, accessible only to application services
- Encrypted daily backups with 30-day retention
- Access logs reviewed for anomalies
- Principle of least privilege for internal access
- Vulnerability monitoring on application dependencies
9. Cookies
See our separate Cookie Policy.
10. Children
The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will delete it promptly.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the current version.
12. Contact
Privacy questions or requests: hello@cronitorex.com.