Privacy Policy

0. About This Policy & Data Controller

PubMonitor.com is currently operated as an independent project by an individual operator (not a registered legal entity at this time). For purposes of GDPR, UK GDPR, and similar data-protection laws, the data controller is the individual identified in our Terms of Service (see §11 / §13).

Inquiries about data processing, requests to exercise the rights described in §7 below, and other privacy-related matters should be sent to support@pubmonitor.com. We respond to verifiable data-subject requests within 30 days as required by GDPR Article 12.

If the operating arrangement changes (for example, the project is incorporated into a legal entity), this section and our Terms will be updated accordingly. Material changes will be communicated through the service per §9.

1. Information We Collect

PubMonitor collects the following types of information:

• Account Information: When you sign in with Google, we receive your name, email address, and profile picture.
• Billing launch interest: If you explicitly choose to save launch interest while checkout is closed, we store only the time of that choice on your account. This is not consent to marketing email and does not promise a launch notification.
• Usage Data: Our servers keep standard request logs (IP address, browser User-Agent, pages requested) and per-account / per-device security counters used to enforce rolling fair-use and rate limits. On public pages we also load Microsoft Clarity, which records masked session replay (clicks, scrolls, page structure) so we can see where the interface fails. We do not send your name or email to Clarity. Login, billing and admin pages do not load the script.
• Cookies: First-party cookies needed to operate the service (session sign-in, security, language preference and anonymous quota enforcement) are listed in §1a. Microsoft Clarity may also set analytics cookies, described in the same table. We do not run advertising or ad trackers.

1a. Cookies We Set

Session, security, language and abuse-prevention cookies are strictly necessary to run the service. Microsoft Clarity may set additional first-party analytics cookies so page views can be stitched into a session. Visitors in the EEA, UK and Switzerland see a prompt on public pages; Accept analytics sends Clarity a consent signal so those cookies can be set, and Decline keeps Clarity in cookieless mode. We remember that choice in your browser for about nine months. Clarity's privacy statement is at clarity.microsoft.com/privacy.

Theme and view-mode preferences are stored in your browser's localStorage, never sent to our servers, and are not cookies.

2. How We Use Your Information

• To provide and maintain the PubMonitor service
• To authenticate users and manage accounts
• To improve and optimize our platform, including reviewing masked Clarity session replay on public pages
• To communicate service updates when necessary
• To record aggregate interest in future billing when an account holder explicitly asks us to save that state

3. Data We Display

PubMonitor aggregates and displays publicly available data about websites and AdSense publishers, including:

• Domain traffic estimates from third-party sources
• Public WHOIS registration data
• Public DNS records
• AdSense publisher identifiers found in public website source code

While we collect this information from publicly accessible sources, we acknowledge that, depending on your jurisdiction (e.g., GDPR in the EU, CCPA in California, or local laws elsewhere) and the context in which it is combined, some of this data may constitute personal data. We process it under the legal basis of legitimate interest in providing competitive-intelligence services, balanced against the rights of data subjects.

If you are a domain registrant, AdSense publisher, or otherwise identifiable in the data we display and you wish to have your information amended or removed, please email support@pubmonitor.com. We process legitimate removal requests within 30 days. Where we cannot honor a removal in full (for example, when retention is required by law), we will explain the reason.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share anonymized, aggregated data for analytical purposes.

4a. Payment Processing (Creem & Stripe)

Paid subscriptions are processed by our payment processors, Creem or Stripe (the processor used for your purchase is indicated at checkout and on your receipt). Card data and payment instruments are handled by the payment processor and are never stored on PubMonitor servers.

When you start a paid checkout, we share the following with the payment processor so it can process the payment and issue receipts:

• Your account email and display name (passed in customer.email / customer.name)
• Your internal user ID and the chosen plan / billing cycle (passed in metadata)
• Billing address and tax information you supply on the processor's checkout page (collected by the processor directly, not by PubMonitor)

The processor returns to PubMonitor only what we need to provision the subscription: the subscription ID, customer ID, billing-period start/end dates, and event notifications (active, canceled, refunded, disputed). Receipts and invoices are sent to you directly by the processor (Creem sends from no-reply@creem.io); PubMonitor does not generate or send invoices.

When you start a paid checkout, we also record the time, your IP address, your browser User-Agent, and the versions of the Terms of Service and Refund Policy in force at that moment, as evidence of your agreement to them. Legal basis: performance of the contract and our legitimate interest in resolving payment disputes. These records are deleted together with your account (§7).

The processors' own privacy practices are documented at creem.io/privacy and stripe.com/privacy. By starting a paid checkout you also accept the applicable processor's privacy policy.

5. Data Security & Storage Location

We implement industry-standard security measures to protect your personal information, including encrypted connections (HTTPS), secure authentication via Google OAuth, and encryption-at-rest for all production databases.

Where your data is stored: Production data, including subscription state, account profiles, usage logs, API tokens, and aggregated analytics caches, is hosted on servers located in Hong Kong. Disaster-recovery snapshots are retained on the same provider in the same region. Card data and payment instruments are handled exclusively by the payment processors (Creem, incorporated in Estonia; Stripe, incorporated in the United States) and are never stored on PubMonitor servers; see §4a.

Cross-border transfer: If you access PubMonitor from the EU, UK, or another jurisdiction with cross-border-transfer requirements, your personal data may be transferred to and processed on servers in Hong Kong. We rely on the legitimate-interest legal basis described in §3 and apply equivalent contractual and technical safeguards (encryption, access controls, audit logging) regardless of where the data is stored.

6. Data Retention

Account data is retained for as long as your account is active. You can delete your account yourself at any time from Dashboard → Account → Danger Zone: deletion takes effect after a 30-day grace period (during which you can cancel by emailing support@pubmonitor.com), after which all account data is permanently erased. You may also request deletion by contacting us.

Billing launch interest: The timestamp is retained with your account, appears in your personal-data export, and is erased when the account is erased.

7. Your Rights

Under GDPR, UK GDPR, CCPA, and similar laws, you have the right to:

• Access — request a copy of the personal data we hold about you, or download it yourself at any time via Dashboard → Account → "Download my data"
• Rectification — request correction of inaccurate data
• Erasure (right to be forgotten) — delete your account yourself via Dashboard → Account → Danger Zone (30-day grace period), or request deletion by email
• Portability — receive your personal data in a structured, commonly used, machine-readable format: the self-service export at /dashboard/export-data delivers it as JSON
• Restriction of processing — request that we limit how we process your data in specific circumstances
• Objection — object to processing based on our legitimate interests (e.g., aggregation of public data for competitive intelligence; see §3)
• Withdraw consent — for any processing that relies on consent
• Removal of publicly displayed data about your domain or publisher ID (see also /legal/takedown)
• Lodge a complaint with your local data protection supervisory authority (e.g., your national DPA in the EU, the ICO in the UK) if you believe our processing violates applicable law

To exercise any right, email support@pubmonitor.com from the address associated with your account. We respond within 30 days; complex or multi-part requests may take up to 60 days, in which case we will inform you of the extension and the reason.

8. Contact

For privacy-related inquiries, please contact us at support@pubmonitor.com.

9. Changes

We may update this privacy policy from time to time. Significant changes will be communicated through the service.

10. Sub-processors

We engage the following third-party sub-processors to operate PubMonitor. We update this list when sub-processors are added or removed; material changes are reflected in §9.

If you would like the current contact details or contractual basis (DPA / SCCs) for any sub-processor, email support@pubmonitor.com.