Privacy PolicyEffective Date: 6 November 2026
1. Who We Are
WebSignal is a website monitoring service provided by WebSignal Ltd., Dublin, Ireland (“we”, “us”). We are the data controller for the personal data described in this policy. For the data you put into a workspace about other people, such as a colleague’s email address on an alert, we act on your instructions. This policy covers www.websignal.io, app.websignal.io, docs.websignal.io and the WebSignal API.
2. Information We Collect
- Account data: your name, email address and sign-in details. Sign-in is handled by our identity provider.
- Workspace data: what you set up in the Service, including monitored addresses, check results, incidents, teams and on-call schedules, and alert destinations such as email addresses, mobile numbers and webhook or channel addresses.
- Billing data: your plan and subscription status. Payments are taken by Stripe on its own pages, and we do not receive or store your full card number.
- Usage and diagnostic data: your IP address, browser type and version, the pages you visit, and technical logs that help us keep the Service working.
- Communications: messages you send us, and your email preferences.
- Advertising click data: the click identifier Google adds to the link when you arrive from one of our ads, and the time of the click, if you accept cookies. See section 5.
- Your cookie choice: whether you accepted or rejected non-essential cookies.
3. How We Use It
| Purpose | Legal basis |
|---|---|
| Provide the Service: run your checks, send your alerts, manage your account and workspaces | Performance of our contract with you |
| Take payment and keep financial records | Contract and legal obligation |
| Keep the Service secure and reliable, detect and fix technical problems, and provide support | Our legitimate interest in running a secure, working service |
| Tell you about important changes to the Service or your account | Contract and our legitimate interest |
| Send product update emails, if you subscribe | Your consent, which you can withdraw using the unsubscribe link or your account settings |
| Understand how our website and app are used (Google Analytics and our own usage measurement) | Your consent, given through our cookie banner |
| Measure whether our advertising works (Google Ads) | Your consent, given through our cookie banner |
4. Cookies and Your Choices
The first time you visit our website or app, a banner lets you accept or reject non-essential cookies. On the browser you use, your choice applies across www.websignal.io and app.websignal.io, so you will not be asked again on the other site. Until you choose, nothing is sent to Google or Senja from our website or app, and they set no cookies. If you arrived from an ad, the click identifier waits in your browser’s session storage for that browser session and is not sent to us unless you accept. The exception is a click cookie from before this banner, which may be sent once and is then removed. You can change your mind at any time with the Cookie settings link in the footer, and rejecting removes the analytics and advertising cookies listed below, and other cookies and stored data these tools have set that we can reach, at the latest on your next visit to the app.
| Cookie | Type | What it does | Lasts |
|---|---|---|---|
.AspNetCore.*, ARRAffinity* | Essential | Keep you signed in to the app and keep it working | Your session, or until you sign out |
ws_consent, ws_consent_recorded, ws_consent_attempt | Essential | Remember your cookie choice and when you made it, and record it against your account if you are signed in | Up to 12 months |
ws_vid | Analytics | WebSignal’s own usage measurement in the app: tells visitors apart | 400 days |
ws_sid | Analytics | WebSignal’s own usage measurement in the app: groups a visit together | 30 minutes after your last activity |
_ga, _ga_* | Analytics | Google Analytics: tell visits apart so we can see how the site is used | Up to 2 years |
ws_gclid, ws_wbraid, ws_gbraid, ws_gclid_at | Advertising | Remember which Google ad click brought you here, and when | 90 days |
_gcl_* | Advertising | Google Ads: conversion measurement | Up to 90 days |
ws-status-page-theme (local storage, not a cookie) | Essential | Remembers your light or dark choice on public status pages | Until you clear it |
ws_consent_reject_unsaved (session storage, not a cookie) | Essential | Holds a Reject your browser would not save, in that tab | Until the tab closes |
ws_ad_click_hold, ws_ad_click_seen (session storage, not cookies) | Advertising | Hold an ad’s click identifier in that tab until you choose, and recognise a click already handled | Until the tab closes; a Reject clears the held identifier |
If you accept, our website also loads customer testimonials through a widget from Senja, which stores a visitor identifier in your browser and measures how the widget is used. If you do not, you see the same page without that widget. Stripe sets its own cookies on its payment pages. Their own policies apply to those.
5. Google Analytics and Google Ads
We use Google Analytics and Google Tag Manager to understand how our website and app are used, and Google Ads to advertise WebSignal. We load Google’s tools only after you accept.
If you click one of our ads and accept cookies, we store the ad’s click identifier and link it to your account when you sign in. If you then sign up, start a trial, make a purchase or create a monitor, we tell Google that this click led to that action, with its time and any purchase value. This lets us see which ads work. We do not use your data for remarketing or personalised advertising. We send Google the click identifier and those details only. We do not send Google your name, email address or the contents of your workspace. We do not record a conversion against a click more than 90 days old, and we do not send a conversion more than 90 days old.
If you reject cookies from the start, we do not keep the click identifier against your account, and nothing about your account is reported to Google Ads. We only ever report a conversion to Google where you have accepted.
If you accept and later reject: we immediately tell Google’s tags to stop, delete the cookies and stored data we can reach, and reload the page, which removes those tags. Our code cannot fully control a third-party tag in the moment the page closes, so a tag could still send something in that fraction of a second. Nothing is sent after the reload. Other open tabs on our sites check your choice every few seconds and stop in the same way, normally within about three seconds. A browser can slow this down in a background tab, and a frozen tab stops when you return to it. If your browser will not let us save a Reject, we cannot remember it, so we may ask you again.
Your account: your choice applies on the browser you use, but a Reject delivered from any of your browsers generally stops reporting for your account, and can override an Accept you made elsewhere. If you are signed in with a valid session, a Reject reaches your account within moments. Otherwise it reaches your account after you next sign in; a page load can also deliver it if your access is still accepted, though after a failed attempt we wait about 5 minutes before trying again. Until then, conversions already recorded for you can still be sent to Google and new ones can still be recorded. Any conversion the current upload has already picked up is sent, and conversions already sent cannot be recalled. A later Accept does not make earlier records sendable, provided your Reject reached your account first. If you reject while signed out and then accept before signing in, we only learn of the Accept, so the Reject has no effect on your account.
What we keep after a Reject: the fact of your choice and when it took effect. We delete the click identifier stored on your account, and we do not use one from before your Reject. Conversion records already made, including their click identifier, are kept but never sent to Google, and stop being eligible for sending after 90 days. They are removed when your account is deleted.
Because the click identifier is part of the web address of an ad link, it can also appear in our hosting and diagnostic logs when you arrive and while you are on that page, before you have made a choice. We do not send those logs to Google.
Google handles this data under its own terms; see Google’s privacy policy.
6. Service Providers
We use these companies to run the Service. They process personal data on our behalf, or as independent controllers where their own terms say so:
| Provider | What for |
|---|---|
| Microsoft Azure | Hosting, databases, and application diagnostics (Application Insights) |
| Auth0 (Okta) | Sign-in and identity |
| Stripe | Payments and subscriptions |
| Twilio SendGrid | |
| Twilio | SMS alerts and phone verification |
| Analytics and advertising, if you accept cookies | |
| jsDelivr | Delivers parts of the app’s page styling and icons, so your browser contacts it when you load the app or a public status page, before any cookie choice. It receives your IP address |
| Senja | Customer testimonials on our website, if you accept cookies |
If you connect Slack, Microsoft Teams, a webhook or an AI assistant to a workspace, we send that service what you have asked us to send it, and its own terms apply.
7. Other Disclosures
We do not sell your personal data. We may disclose it where needed to comply with a legal obligation, to protect and defend our rights or property, to prevent wrongdoing in connection with the Service, to protect the personal safety of users or the public, or as part of a sale or reorganisation of our business.
8. International Transfers
Some of our providers process data outside the European Economic Area and the United Kingdom, including in the United States. Where they do, we rely on an adequacy decision or on safeguards such as the European Commission’s Standard Contractual Clauses.
9. How Long We Keep It
- Monitor history: 90 days on Starter, 180 on Growth, 365 on Pro and 730 on Enterprise.
- Deleted accounts and workspaces: hidden straight away so you can ask for them back, then removed after 90 days.
- Advertising click data: no conversion is recorded against a click more than 90 days old, or sent when more than 90 days old. Click identifiers stay on conversion records already made until your account is deleted.
- Hosting and diagnostic logs: up to 90 days.
- Billing records: for as long as tax and accounting law requires.
- Everything else: for as long as your account is open, or as long as we need it for the purposes above.
10. Your Rights
You can ask us for access to your personal data, and to correct, delete, restrict or transfer it. You can object to our use of it based on legitimate interests. Where we rely on consent, you can withdraw it at any time, without affecting what happened before. To use these rights, email info@websignal.io. You can also complain to the Irish Data Protection Commission or your local data protection authority.
11. Data Security
We prioritize the protection of your data and use commercially acceptable means to protect it. However, no method of transmission over the internet or electronic storage is 100% secure, so we cannot guarantee its absolute security.
12. Children
The Service is for businesses and professionals and is not directed at children under 16. We do not knowingly collect their personal data.
13. Links to Other Sites
Our Service may contain links to other sites not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.
14. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Effective Date” at the top of this Privacy Policy.
15. Contact Us
If you have any questions about this Privacy Policy, please contact us at info@websignal.io.