Privacy Policy
Last updated 4 November 2026
This policy explains what personal data WatchMyCVE ("we") collects, why, and the rights you have under the GDPR. We are the data controller. For any privacy question or request, email contact@watchmycve.com or use the contact form.
What we collect
- Your account. When you sign in with GitHub, we receive your name, email address and GitHub account ID. We don't ask for access to your repositories, and we never see your GitHub password.
- Websites you add. The address and name you give, the software we identify on the site, your alert settings, and your alert history.
- Your team. The email addresses of people you invite.
- Notification channels. The email recipients and the Microsoft Teams, Slack or webhook addresses you enter.
- Personal access tokens. The name you give each token. The token itself is stored only as a hash.
- Contact form. Your name, email address and message.
- Waitlist. Your email address and the plan you're waiting for.
- Technical data. Our hosting provider records technical logs, such as IP addresses and request times, to run and protect the service.
Why we use it
- To provide the service you signed up for (performance of a contract, GDPR Art. 6(1)(b)): your account, sites, alerts, team and notifications.
- To tell you when a plan you joined the waitlist for opens (steps you asked for before a contract, Art. 6(1)(b)).
- To answer your messages (our legitimate interest in replying, Art. 6(1)(f)).
- To keep the service secure and prevent abuse (legitimate interest, Art. 6(1)(f)).
Alert emails and team invitations are part of the service. We don't send marketing emails, and we don't sell your data or share it for advertising.
Who processes it
- Appwrite Cloud: Hosting, database, background jobs and email sending. Location: EU (Frankfurt, Germany).
- GitHub: Sign-in. GitHub is its own controller for your GitHub account. Location: USA.
- Microsoft Teams, Slack or your own webhook, only if you add one: we send alert details to the address you entered.
To identify a site's software, our servers request the public pages of the website you add. We download public CVE data from CVE.org, CISA and FIRST, and we don't send them any of your data.
Where your data is stored
Your data is stored in the EU, on Appwrite Cloud in Frankfurt. WatchMyCVE is run from Tunisia, so we access it from there to operate the service. Signing in involves GitHub, Inc. in the USA, which handles that transfer under the safeguards described in its own privacy statement.
How long we keep it
- Alerts are deleted automatically 4 days after they're created on Free, 14 days on Pro and 29 days on Agency. Deleted alerts can't be recovered.
- Account data is kept until you delete your account. Settings → Delete account removes your account, your workspace, its sites, alerts and notification channels, and your access tokens.
- Contact messages are kept until we've handled them and no longer need them, then deleted.
- Waitlist entries are kept until that plan opens and we've emailed you, or until you ask us to remove you.
- Hosting logs are kept for the period our hosting provider sets.
Your rights
You can ask to access, correct, export or delete your personal data, to restrict its use, or object to how we use it.
Email contact@watchmycve.com. We answer within one month.
You can change your name in Settings and delete your account there yourself.
You also have the right to complain to a data protection authority: in the EU, the one in the country where you live or work; in Tunisia, the INPDP (Instance Nationale de Protection des Données Personnelles).
Children
WatchMyCVE is not intended for anyone under 16.
Changes
When we change this policy, we update the date at the top. For significant changes, we'll also tell you in the app before they take effect.