Privacy Policy

This policy explains how Watchpost handles personal data. It is written so a normal person can read it. Where the GDPR uses specific terms, we mention them so you can find the relevant articles if you want to.

1. Who we are

The data controller for the personal data described in this policy is Arbos Folk (sole proprietorship), registered in Denmark under company number CVR 46278895. Our registered address is Byhøjvænget 17, 8380 Trige, Denmark.

For privacy questions, requests under the GDPR, or anything else this policy mentions, write to privacy@watchpost.systems. We are not legally required to appoint a Data Protection Officer; privacy requests are answered by the people running the service.

2. What we collect, and the legal basis for each

2.1 Account data

Your email address, an optional name, and a hashed password if you signed up with one.
Purpose: creating and maintaining your account, signing you in. Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)).

2.2 Verdict data

For every purchase your AI agent submits to us: the merchant domain, product title, amount, currency, the verdict we issued (approve, review, block), the reasoning, and the outcome if your agent reports back.
Purpose: running the verify endpoint, displaying your transaction history, refining the merchant trust score over time. Legal basis: performance of contract.

2.3 Connection tokens

A SHA-256 hash of each agent connection token, plus the first 8 characters in plain text for UI listing. The raw token never sits in our database.
Purpose: authenticating API calls from your agents. Legal basis: performance of contract.

2.4 Subscription data

Stripe customer ID, current plan, subscription status, and monthly verdict count.
Purpose: charging the correct amount for the plan you've chosen, keeping tax records. Legal basis: performance of contract (Art. 6(1)(b)) for billing, and legal obligation (Art. 6(1)(c)) for retaining tax-related records.

2.5 Server logs

Request paths, status codes, IP addresses, user agents, and timestamps. Retention is controlled in our hosting-provider settings and reviewed as part of production operations.
Purpose: finding bugs, detecting abuse, keeping the service available.
Legal basis: our legitimate interest (Art. 6(1)(f)) in operating a secure and reliable service. We have weighed this interest against your rights and believe it is proportionate; you can object at any time (see Section 7).

2.6 Communications

Magic-link sign-in emails, weekly digest emails (if you've enabled them), and any email you send us.
Purpose: sending you links you've requested, summarizing your weekly activity, replying to support. Legal basis: performance of contract for transactional email; consent (Art. 6(1)(a)) for the weekly digest, which you can switch off in settings.

2.7 Optional site analytics

If you accept analytics in the cookie panel, Google Analytics 4 processes page URL, referrer, campaign parameters, approximate location, device and browser information, and a pseudonymous analytics identifier on public marketing, signup, onboarding, and billing pages. We use this to understand which pages and campaigns lead people to Watchpost. Private account activity and staff pages are excluded. Google Signals and advertising personalization are disabled. We do not send account details, verdicts, rules, or agent tokens to Google Analytics.
Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw it from Cookie settings in the footer.

2.8 What we do not collect

• Card numbers, CVCs, expiries. Stripe handles that. We see a customer ID.
• Device fingerprints, advertising IDs, or remarketing identifiers.
• Advertising or marketing pixels.
• Special categories of data (health, biometrics, political opinions, etc.).

3. Automated decision-making

Watchpost makes automated decisions on every purchase your agent submits: approve, ask you, or block. The decision combines a merchant trust score, a listing-manipulation scan, and the rules you have configured.

Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We consider Watchpost's verdicts to fall outside this category: they advise your agent on whether to proceed with a purchase you have configured rules for, and you can override any verdict by adjusting your rules or by tapping Allow or Block on any review notification.

If you disagree with a verdict, you can: change your rules; tap Allow or Block on any outstanding review; or contact us for a manual review by writing to privacy@watchpost.systems.

4. Who else processes your data

We use a small set of service providers ("processors" under GDPR) to run Watchpost. They only receive the data needed to provide their part of the service.

• Neon — Postgres database hosting in the region selected for the production project. Data processed: everything we store about your account.
• Railway — API hosting in the deployment region selected for the service. Data processed: request bodies and request metadata in transit.
• Vercel — web hosting. Edge nodes near you; control plane in the US. Data processed: session cookies, page requests.
• Stripe Payments Europe — billing. Ireland for EU users. Data processed: email, billing details you provide directly to Stripe, subscription state.
• Google Analytics (Google Ireland) — optional marketing-site analytics, loaded only after consent. Data processed: page and referral data, pseudonymous analytics identifier, broad device information, and approximate location.
• SMTP2GO — transactional email (magic links, digests). Operates globally (New Zealand–headquartered) under Standard Contractual Clauses. Data processed: your email address and the message body.
• Anthropic — the model that scans listings for manipulation. United States, under Standard Contractual Clauses. Data processed: the listing text your agent submits. Anthropic does not retain or train on API content under their default API terms.

We do not sell, rent, or trade your data. The only time it leaves the providers above is if a court order or other legally binding request compels us; we will tell you about it unless the law prevents us.

5. International transfers

Some providers may process data outside the European Economic Area. For those transfers, we use the transfer mechanism made available in the provider's applicable data-processing terms, including the European Commission's Standard Contractual Clauses where required. We also minimize the data sent and require encrypted transport. Write to privacy@watchpost.systems for the current provider and transfer details that apply to your account.

6. How long we keep things

• Account data — for as long as you have an account.
• Verdict and transaction data — retained while your account is active so you can use your history and Watchpost can apply your budgets and rules. Deleted with the account.
• Server logs — retained according to the currently configured hosting plan and operational settings. Contact us for the current period.
• Backups — retained and rotated according to the currently configured database-hosting plan. Deleted production data disappears as those backups rotate.
• Billing records — 7 years, to satisfy tax-law retention requirements. Personal data is minimized after the active relationship ends.
• Support correspondence — 24 months from the last reply.
• Staff-access audit entries — retained after account deletion so we can account for access to user data. They contain the staff identity, action, target account identifier and timestamp, not verdict payloads or connection tokens.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15). Email us and we will send a JSON export within 30 days.
• Rectify data that is wrong or incomplete (Art. 16). Most fields are editable from your settings; for anything else, email us.
• Erase your data (Art. 17). Delete your account yourself from Settings → Danger zone (deletion is confirmed by email), or email us. Removed within 30 days, except where we must keep something for a legal obligation (for example billing records).
• Restrict processing (Art. 18) while a dispute is being resolved.
• Object (Art. 21) to processing based on legitimate interest. We will stop unless we can show a compelling reason that overrides your interest.
• Data portability (Art. 20). We will send you your data in a machine-readable JSON file.
• Withdraw consent (Art. 7(3)) where processing is based on consent. In practice this affects the weekly digest opt-in; switching it off in settings counts as withdrawal.
• Lodge a complaint with your national supervisory authority. The list is at edpb.europa.eu/about-edpb/board/members. We would prefer you reach us first so we can fix things, but the right exists whether you do or not.

8. Security

The full picture lives on our security page. Briefly: TLS in encrypted transport, provider-managed storage encryption, password hashing through Better Auth, SHA-256 hashed connection tokens, role-gated staff tools, and audited support-console lookups.

Staff access. A small number of Watchpost staff can look up an individual account — plan, usage, connected agents, and recent verdicts — when needed to answer a support request, investigate abuse, or keep the service running. Staff sign in with named, verified company accounts, and every such lookup is recorded in an audit log (who viewed which account, and when) that has no delete function. Legal basis: our legitimate interest (Art. 6(1)(f)) in supporting users and operating a secure service; where you contact support yourself, performance of contract (Art. 6(1)(b)).

If we ever experience a personal-data breach with risk to your rights, we will notify the relevant supervisory authority within 72 hours under Art. 33, and notify you without undue delay under Art. 34. Reach security@watchpost.systems if you suspect a security issue.

9. Cookies

We use strictly necessary storage and, after consent, optional Google Analytics cookies. The full list, durations, and settings instructions are on the cookie policy.

10. Children

Watchpost is not intended for anyone under 16. We do not knowingly process the personal data of children. If you believe a child has created an account, email us and we will delete it.

11. Changes to this policy

If we change this policy in a way that materially affects you, we will email you and post a banner on the site at least 14 days before the change takes effect. Less material changes (typos, clarifications) are reflected by bumping the "Last updated" date at the top.

12. Contact

Privacy: privacy@watchpost.systems
Security: security@watchpost.systems
General: hello@watchpost.systems
Postal: Arbos Folk, Byhøjvænget 17, 8380 Trige, Denmark