AlertHub Privacy Policy

Last updated: 23/10/2026 11:45 UTC

Introduction

Protecting your privacy is important to us; we want to be open with you on how and why we use your personal information. We are committed to protecting Your privacy. This privacy policy (referred to as the “Policy”) explains how and for what purposes We use the Personal Information collected about You when You use the Site. Please read this Policy carefully. In the sections below We set out the types of Personal Information We collect, where it comes from, why We collect it, Our lawful basis for processing the Personal Information. Our Platforms are not intended for anyone under the age of 18 (referred to herein as “Children” or “Child”). We do not knowingly collect or process Personal Information relating to Children. If You become aware that Your Child has provided Us with Personal Information without Your consent, please contact Us, upon verification,we will delete such Personal Information.

Data Controller

The data controller responsible for your personal data is:

Contact Email: hello@alerthub.io
Contact Form: Accessible via our website contact form

Personal data we collect

We collect only the minimum personal data required to provide, secure, and operate the AlertHub platform:

A. Account & Contact Information

Identity Data: Name, email address, and mobile phone number provided during account registration or profile setup.
Authentication Credentials: Passwords (securely hashed with industry-standard cryptographic algorithms; we never store plain-text passwords) and session authentication tokens.
Support Inquiries: Information you submit through our contact form or support channels, including your name, email, topic, and message content.

B. Webhook, Event & Integration Data

Event Payloads: Data transmitted via incoming API calls or webhooks to AlertHub for processing and routing. Depending on what you send, this may include metadata, timestamps, identifiers, and event bodies.
Destination Endpoints: URLs, push tokens, phone numbers, or email addresses configured by you to receive routed alerts.

C. Mobile & Device Information

Push Notification Identifiers: Device registration tokens (such as Firebase Cloud Messaging / FCM tokens) generated when you link our mobile application.
Device Metadata: Device model (e.g., "Google Pixel 8"), operating system version, and client application build version to ensure push notification compatibility and troubleshoot delivery failures.

D. Security & Diagnostic Logs

Authentication & Access Logs: When you log into or access our services, our servers automatically log your IP address, browser type and user-agent string, operating system, and the date and time of the request.
API Usage Logs: Request volumes, response codes, and rate-limiting metrics.

E. Billing & Payment Information

All payments, subscriptions, and invoice generation are processed directly by our payment processor, Stripe. We do not collect, process, or store full credit or debit card numbers on our servers. Stripe provides us with limited billing metadata, including transaction IDs, currency, payment status, the last four digits of your card, and card expiration date.

Purpose and lawful basis(GDPR Article 6)

We rely on a mixture of legitimate interests, consent and legal obligations to process your personal data in order to:

advertise and marketing our products.
provide operational updates.

Purpose of Processing	Categories of Data	Lawful Basis under GDPR
Account Creation & Maintenance	Name, email address, password hash, phone number	Performance of a Contract (Art. 6(1)(b))
Routing Webhooks & Events	API payloads, destination URLs, notification endpoints	Performance of a Contract (Art. 6(1)(b))
Mobile Push Notifications	FCM device token, device name	Performance of a Contract (Art. 6(1)(b))
Payment & Subscription Management	Stripe customer ID, subscription tier, billing status	Performance of a Contract (Art. 6(1)(b))
Platform Security & Troubleshooting	IP addresses, login logs, user-agent data, session timestamps	Legitimate Interests (Art. 6(1)(f)) (Protecting against brute-force attacks, debugging connection failures, and preventing abuse)
Customer Support	Contact form submissions, correspondence history	Performance of a Contract (Art. 6(1)(b)) or Legitimate Interests (Art. 6(1)(f))
Legal & Tax Compliance	Invoices, VAT records, transaction logs	Legal Obligation (Art. 6(1)(c))

Cookies and Local Storage

AlertHub uses strictly necessary and functional cookies only:

Session, IDs & Authentication Cookies: Temporary identifiers and tokens required to keep you securely signed in to the web dashboard and protect against Cross-Site Request Forgery (CSRF).
Preference Cookies: Storing your dark/light theme choice.

Third-Party Subprocessors

We engage trusted third-party service providers ("subprocessors") to perform processing functions on our behalf. All subprocessors are bound by data processing agreements requiring strict security and confidentiality standards:

Stripe, Inc.: Payment processing, currency conversion, subscription billing, and invoicing.
Google Cloud Platform / Firebase (FCM): Delivery of real-time push notifications to mobile devices.
Server Hosting & Cloud Infrastructure(Hetzner): Virtual server hosting, database storage, and in-memory cache infrastructure.
Email provider (GMail): Delivery of email verification codes, password resets, and critical system alerts.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

How long we keep it for (Data Retention)

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information.

Account Data: Retained for the lifetime of your active account. If you close your account, your personal account records are purged within thirty (30) days.
Security & Diagnostic Logs: Login logs, IP addresses, and user-agent strings are retained in our database for 90 days for incident investigation and security audits, after which they are automatically pruned or anonymized.
Webhook & Event Payloads: Ephemeral event payloads routed through our platform are stored temporarily for delivery verification and inspection (up to 30 days), after which they are permanently deleted.
Financial & Tax Records: Invoices and payment metadata are retained for statutory periods mandated by tax authorities (typically 6 to 7 years).

International Data Transfers

When personal data is transferred outside the United Kingdom or European Economic Area (EEA), we ensure appropriate safeguards are maintained. This includes utilizing destinations deemed "adequate" by the UK Government or European Commission, or entering into Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement / Addendum (IDTA).

Data Security

We implement robust technical and organizational measures to safeguard your personal data, including:

Transport Layer Security (TLS 1.2+ / HTTPS) for all data in transit across web, API, and mobile connections.
Cryptographic hashing of passwords and sensitive authentication tokens at rest.
Ephemeral verification token generation with strict time-to-live (TTL) expiry.
Server-side rate limiting and brute-force protection.
Principle of least privilege for database and server access.

Your Legal Rights Under GDPR

Depending on your jurisdiction, you have the following rights regarding your personal data:

Right of Access: Request confirmation of whether we process your data and obtain a copy of it.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no compelling legal reason for continued processing.
Right to Restriction of Processing: Request that we temporarily suspend processing your personal data in certain circumstances.
Right to Data Portability: Receive your personal account data in a structured, commonly used, and machine-readable format.
Right to Object: Object at any time to our processing of your data based on legitimate interests.
Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting past lawful processing
Right to Lodge a Complaint: You have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office (ICO) at ico.org.uk).

You can exercise any of your rights by contacting us via contact form or email hello@alerthub.io. We respond to all legitimate requests within one calendar month. We will require proof of ID to confirm your identity.

Your duty to inform us of changes

It is important that the Personal Information We hold about You is accurate and current. Please keep Us informed if Your Personal Information changes during Your relationship with Us.

Children's Privacy

AlertHub is a developer and business SaaS platform. Our services are not directed at, nor do we knowingly collect data from, individuals under the age of 18.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect architectural changes, new features, or evolving legal obligations. When changes are made, we will update the "Last Updated" date at the top of this page. For material changes, we will provide advance notification via email or through an in-app notice.

Contacting us

For questions, privacy inquiries, or data requests, contact us at:

Email: hello@alerthub.io
Contact Form: alerthub.io/contact