Privacy Policy

Account information. Your name, email address, and profile details provided when you sign up. Authentication is handled by Clerk, our identity provider; we store the account identifier Clerk assigns to you alongside your organization membership.

Monitor configuration. The URLs you choose to monitor, check intervals, request headers, expected status codes, and any credentials you attach to a monitor. Credentials and other sensitive configuration fields are encrypted at rest.

Check telemetry. Response times, status codes, and — for failed checks — error details, response headers, and response body snippets returned by the endpoints you monitor, collected from our probe locations. This data describes your endpoints, not you, but may incidentally contain personal data if your endpoints return it. You are responsible for what your monitored endpoints expose.

Usage data. Basic product analytics such as pages visited within the dashboard and device/browser information, used to operate and improve the service. We do not use third-party advertising trackers.

We use the information above to provide the monitoring service, run checks and open incidents, deliver alerts and notifications you configure, process billing, respond to support requests, secure the platform against abuse, and improve the product. We do not sell personal data and we do not share it with third parties for advertising.

We use cookies strictly for authentication and session management. Clerk sets session cookies to keep you signed in to the dashboard; these are essential and cannot be disabled while using the product. We may set a small number of preference cookies (for example, UI settings). We do not set advertising or cross-site tracking cookies.

We rely on a small set of vendors to run Heranode. Each processes data only as needed to provide their function:

• Clerk — authentication and user management (account identity, sessions).
• Hosting and infrastructure providers — run our API, database, and probe nodes across regions.
• Email delivery provider — transactional email such as alerts and account notices.

We will update this list when subprocessors change and, where required, notify account owners in advance.

Check telemetry is retained according to your plan tier: 7 days on Free, 30 days on Team, 90 days on Business, and 12 months or more on Enterprise (per agreement). Older telemetry is deleted automatically on a rolling basis.

Account and configuration data is retained while your account is active. If you delete your account, we delete associated personal data within 30 days; residual copies in encrypted backups are purged within 90 days.

All traffic to and from Heranode is encrypted in transit with TLS. Sensitive fields such as monitor credentials and integration secrets are encrypted at rest with AES-256. Access to production systems is restricted, logged, and reviewed. No system is perfectly secure — if we become aware of a breach affecting your data, we will notify you without undue delay.

If you are in the EU/EEA or UK, you have rights under the GDPR: access to your personal data, rectification, erasure, portability, restriction of processing, and objection. You also have the right to lodge a complaint with your supervisory authority.

To exercise any of these rights, email hello@heranode.com. We respond within 30 days.

We may update this policy as the service evolves. Material changes will be announced by email to account owners before they take effect. The date at the top of this page reflects the latest revision.

Questions about this policy or our data practices: hello@heranode.com.