Privacy Policy
1. Who we are
Pharosite is a website monitoring service operated by Georgios Chreiazomenos (ΧΡΕΙΑΖΟΜΕΝΟΣ ΓΕΩΡΓΙΟΣ), a sole proprietorship registered in Greece, VAT number EL066364326, with its registered office at 17 Nikou Xylouri, 71307 Heraklion, Crete, Greece ("Pharosite", "we", "us").
We are the controller of the personal data described in this policy. For anything about your data, write to [email protected]. We have not appointed a Data Protection Officer, because the law does not require one for our processing.
2. What this policy covers
This policy covers the personal data we handle about visitors to pharosite.com, people who join our waiting list, and the people who use Pharosite: account owners, their team members and anyone who receives our alerts.
It does not cover data we process on behalf of our customers while monitoring their websites, such as screenshots of their pages, emails their sites send to our test addresses, or the test-account logins they give us. For that data our customer is the controller and we act as their processor, under our Data Processing Agreement and their instructions. If your data reaches us that way, please contact the website owner first; we will help them answer you.
3. The data we collect and why
| Data | What it is and why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Waiting list | Your email address, to tell you when Pharosite opens and invite you. | Consent (6(1)(a)); you can withdraw it at any time. |
| Account and team | Name, email address, company name, role in the account, your password (stored only as a one-way hash) and, if you turn on two-factor sign-in, its secret (encrypted) and recovery codes (hashed). Used to create your account, sign you in and let owners manage their team. | Contract (6(1)(b)). |
| Sign-in and security | IP address, browser user agent, session times and failed sign-in attempts. Used to keep you signed in, show you your active sessions, limit password guessing and investigate abuse. | Legitimate interests in securing the service (6(1)(f)). |
| Activity record | Which member changed what in the account, and when (for example who acknowledged an incident or approved a WordPress update). Shown to the account's owners. | Contract (6(1)(b)) and legitimate interests in accountability (6(1)(f)). |
| Alert recipients | Email addresses, phone numbers, Slack or Microsoft Teams links and webhook addresses you enter so we can send alerts and reports, and, if you link Slack, your Slack user ID. | Contract (6(1)(b)). |
| Monitored sites | The addresses of the sites you monitor, the results of each check, and information about a site's software reported by the optional Pharosite agent. This is mostly about websites, not people. | Contract (6(1)(b)). |
| Support and communication | What you write to us and our replies; essential service emails (password links, invitations, alerts, monthly reports). | Contract (6(1)(b)); legitimate interests in answering you (6(1)(f)). |
| Billing (once paid plans start) | Billing name, address, VAT number and invoice history. Card details are handled by our payment provider and never reach us. | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)). |
We do not sell your data, use it for advertising, or make decisions about you based solely on automated processing.
4. Cookies
The Pharosite dashboard uses a single cookie that keeps you signed in. It is strictly necessary, so it needs no consent. We use no analytics, advertising or tracking cookies, on the dashboard or on pharosite.com.
pharosite.com is delivered through Cloudflare, which may set a strictly necessary security cookie (such as __cf_bm) to tell people from automated traffic. It is not used for tracking.
5. Who receives your data
Only the service providers we need to run Pharosite. Each acts on our instructions under a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| OVH SAS (France) | Hosting the servers and database, the pharosite.com website and its waiting-list form, and the database backups (kept in separate storage) | EU (servers in Germany) |
| Hetzner Online GmbH (Germany) | Hosting our own mail server, which sends service emails, alerts and reports | Germany (EU) |
| Cloudflare, Inc. (USA) | Delivering and protecting pharosite.com (content delivery network) | Global network; see section 6 |
When you connect Slack, Microsoft Teams, your own mail server, an SMS account such as Twilio, or a webhook, alerts are delivered there on your instruction, and those services handle them under their own terms. Before paid plans start we will add our payment provider to this list. We may also disclose data where the law requires it, or to protect our rights or the security of the service.
6. Transfers outside the European Economic Area
Pharosite's servers, database, backups and mail server are in the EEA. Cloudflare may handle requests to pharosite.com outside the EEA; Cloudflare, Inc. is certified under the EU–US Data Privacy Framework, and its data processing addendum includes the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
7. How long we keep it
- Waiting list: until you join, unsubscribe, or 12 months after public launch, whichever comes first.
- Account, team and alert recipients: while the account is active, then deleted within 30 days of its closure.
- Sessions: 14 days after your last sign-in, or until you sign out or revoke them. Password links expire after 2 hours, and two-factor sign-in attempts after 5 minutes.
- Screenshots and emails received by our test addresses: 7 days.
- Check results and the activity record: while the account is active, unless the account owner sets a shorter period.
- Backups: overwritten on a rolling basis within 30 days.
- Billing records: as long as Greek tax law requires, currently five years from the end of the tax year, and longer in the cases the law sets.
8. How we protect it
Connections are encrypted (HTTPS/TLS). Passwords, API keys and recovery codes are stored only as one-way hashes. Test-account logins and two-factor secrets are encrypted at rest with keys kept separately from the database. Access to production systems is limited to the people who run the service, and accounts are separated from each other in every database query. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the supervisory authority as the GDPR requires.
9. Your rights
Under the GDPR you have the right to:
- access your data and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- receive the data you gave us in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing.
Write to [email protected]. We will answer within one month and may ask you to confirm your identity. Many details can also be changed directly in your account settings.
You may complain to the Hellenic Data Protection Authority (Kifisias 1–3, 115 23 Athens, www.dpa.gr) or to the authority where you live or work. We would appreciate the chance to resolve your concern first.
10. Children
Pharosite is a service for businesses and is not directed at anyone under 16. We do not knowingly collect children's data.
11. Changes to this policy
We will publish any update here with a new effective date, and email account owners before a significant change takes effect.