Privacy policy

Last updated: November 5, 2026

Alertoweb monitors public web pages for you and tells you when they change. To do so, we need a few pieces of data about you. Here is which ones, why, how long we keep them and how to exercise your rights.

Data controller

Your data is processed in accordance with the Thai Personal Data Protection Act (PDPA) and, for people located in the European Union, with the General Data Protection Regulation (GDPR). Representative in the European Union (Article 27 of the GDPR): being appointed.

The data we process

Your account

your email address (sign-in identifier, sending the emails of the service);
your password, never stored in clear text (only an irreversible hash is kept);
your first and last name, if you provide them;
if you use “Continue with Google”: the identifier of your Google account, your email address and, if they are empty on our side, your first and last name. We receive neither your Google password nor access to your other Google data. You can unlink your Google account at any time (“My account” › “Sign-in”): its identifier is then erased;
your plan, the creation date of your account, the date of your last sign-in, and the confirmation of your email address;
your preferences: language, time zone (detected by your browser or chosen in “My account”), time and frequency of the email summary and display choices.

The pages you follow

the addresses of the pages you monitor, with your labels, your topics, the zones you follow or ignore, the expressions and the display order you chose;
the successive versions of these public pages, as our robot fetches them, and their differences. A page followed by several users is stored only once; the other users do not know that you follow it.
your opinion on the changes you are told of, if you give it ("Useful" / "Not useful", in the application or under a Telegram message): it helps us improve what we tell you of; only our lead administrators see it, without your name or address; it is deleted with the page you follow.
if you use the search with artificial intelligence (“Also follow”, “Discover”): the text you type is sent, with the links of the public page concerned where relevant, to our provider Anthropic. We do not keep this text (only long enough to show you the result, in your session), but the date of each search and what it cost in credits, to keep the count of your credits.
if you switch on the summaries by artificial intelligence in your notifications: for each page that changed, its name and the lines of text added and removed (extracts of public pages) are sent to our provider Anthropic, which writes the summary. We keep these summaries for 90 days, to show them to you in your account, along with the date of each request and what it cost in credits.
if you ask the artificial intelligence to sort your pages into topics: the name, address and description of each page you follow, the names of your topics and the instruction you type are sent to our provider Anthropic, which suggests a sorting. We keep neither the instruction nor the suggestion (only in your session, until you apply it), but the date of each request and what it cost in credits.

Your notifications

for push notifications, for each device where you enabled them: the technical data needed to send it the notifications, and the type of device (for example “Chrome on Windows”); for the last notification sent to that device, when it received it and when you opened it, to check that the notifications arrive;
for Telegram, if you connect it: the identifier of your chat with the Alertoweb bot on Telegram and your Telegram name (for example “Mary (@mary)”), with the date of the last message sent;
for the webhook, if you create one: the address to which we send your changes, the key that signs our requests, and the result of the last request (date, response code, error if any).

Your messages

if you write to us with the contact form: your email address, the subject and text of your message, the language of the page, your account if you are signed in and your IP address, kept 365 days, to reply to you and to limit abusive sending. The message also reaches us by email.

The security of the service

after a failed sign-in: the IP address and the email entered, kept one hour at most, to block repeated attempts;
after a registration: the IP address, kept one hour at most, to limit mass account creation;
after a “forgot password” request: the email entered and the IP address, kept 30 days;
the email address confirmation links, kept 90 days;
if you choose “Stay signed in”: one token per device (only a fingerprint of it is kept), with the dates it was created and last used, kept 30 days after your last visit or until you sign out;
the devices signed in to your account: the browser and the system (“Chrome on Windows”), the last IP address, the dates of sign-in and of last activity, which you see in “My account” › “Signed-in devices”. They are erased as soon as the device signs out, or when it is no longer signed in (a few hours without activity, 30 days with “Stay signed in”);
the log of the emails sent (recipient, subject, result of the sending, without the content), kept 90 days;
the technical logs of the server (IP address, date, page requested, browser) and the logs of the application (sign-ins, registrations, administration actions), kept 3 months at most.

Why, and on what legal basis

Providing the service (account, page monitoring, summary, notifications): performance of the contract between us when you create an account.
Protecting the service and its users (limiting attempts, logs, preventing abuse): our legitimate interest in ensuring the security of the service.
Replying to your messages: our legitimate interest in replying to the people who write to us.
Push notifications, Telegram and the webhook: your consent, given by enabling them on a device, by connecting Telegram or by creating a webhook; you can end it at any time on the Notifications page, in your browser or by sending /stop to the bot on Telegram.

We do not sell your data, we do not use it for advertising and we do not do any profiling.

Cookies

Alertoweb only uses three cookies, all strictly necessary:

alertoweb_session keeps you signed in and protects the forms. It disappears when you close your browser or sign out;
alertoweb_remember keeps you signed in on this device when you chose “Stay signed in” (always with Google), for 30 days after your last visit. It disappears when you sign out;
alertoweb_locale remembers the language you chose (English or French), for one year. It is only set if you change the language.

No audience measurement or advertising cookie is set, which is why no banner asks for your consent.

Who has access to your data

Only the publisher of Alertoweb has access to it. To help you or to check that the service works properly, an administrator may display Alertoweb as you see it (your followed pages, your changes, your settings), read only; each such viewing is recorded in our logs (who, when, for how long). To help you, a super administrator may also, by expressly switching it on, change your followed pages (add them, remove them, set them); these changes are recorded in our logs, and a search with artificial intelligence made on that occasion is deducted from your credits. They cannot change your password, email, devices or notifications this way.

We use the following service providers:

OVH SAS (France): hosting of the server and the database, in France, and sending of the emails;
Google: only if you choose “Continue with Google”, to authenticate you;
the notification services of the browsers (Google, Mozilla, Apple, Microsoft): only if you enable push notifications. They carry the notifications (the name of the pages that changed) to your device, under their own privacy policy;
Telegram: only if you connect it. It carries our messages (the name and address of the pages that changed) to your Telegram account, under its own privacy policy;
Anthropic (United States): only if you use the search with artificial intelligence, the sorting of your pages into topics or the summaries in your notifications. For the sorting, it receives the name, address and description of the pages you follow and the names of your topics. For the summaries, it receives the name of your pages that changed and the lines that changed. Our robot may also send it extracts of public pages that are followed, without any data of your account, to recognise content a website draws at random. For the search, it receives the text you type and, where relevant, the links of the public page, to choose the matching pages or suggest matching sites (for “Discover”, it also uses it to search the web), under its terms for businesses.

If you create a webhook, we send your changes (the name, the address and an excerpt of the pages that changed) to the address you chose: your server, or a service such as Zapier, Make or n8n. This recipient is not our service provider: you choose it, and it processes this data under its own responsibility.

Where your data is

Your data is hosted in France. The publisher, established in Thailand, administers the service from that country: this is an access to your data from a country outside the European Union. The notification services, Telegram, Google and Anthropic may process the data that concerns them outside the European Union, under their own safeguards.

How long

the data of your account and of the pages you follow: as long as your account exists;
a page you no longer follow: it disappears from your account immediately, with your labels, your zones and your expressions;
a device removed from push notifications: its data is deleted immediately;
Telegram disconnected (on the Notifications page or with /stop): its data is deleted immediately;
a deleted webhook: its address, its key and the result of its last request are deleted immediately;
the date of your searches with artificial intelligence: 90 days (the text you typed is not kept);
the summaries written by artificial intelligence: 90 days, or until you stop following the page;
the security data: the periods given above;
if you ask for your account to be deleted: your personal data is deleted within one month, except what the law requires us to keep.

Your rights

You can access your data, have it corrected or deleted, ask for a copy in a common format, object to a processing based on our legitimate interest or ask for its restriction, and withdraw your consent to push notifications, to Telegram and to the webhook at any time. Much of this can be done directly in the application (“My account”, “Notifications”, “Monitored pages”); for the rest, write to the contact address given above. We answer within one month.

If you believe that your rights are not respected, you can lodge a complaint with a data protection authority, for example the CNIL in France (www.cnil.fr), or the authority of your country of residence.

Changes

We may change this policy, for example for a new service. The date of the last update is shown at the top of the page; in case of a significant change, we will tell you by email.

This English version is provided for convenience; in case of discrepancy, the French version prevails.