Watchtower — Privacy Policy

Last updated: September 23, 2026 · Effective: September 23, 2026

1. Who this applies to

This Privacy Policy explains how adParagon, LLC ("we," "us") handles personal data in connection with the Watchtower website, marketing, and account/administration of the Service.

Important distinction — two different roles:

As a controller. For our website visitors, prospects, and the account/administrative data of our customers' personnel (names, work emails, billing contacts), we are the controller and this Policy governs.
As a processor. For the traffic data our customers send into the Service to be evaluated (which may include IP addresses, device identifiers, user-agent strings, and event metadata about our customers' own end users), our customer is the controller and we act as their processor. Our handling of that data is governed by our agreement with the customer and the Data Processing Addendum (DPA), not by this Policy. End users with questions about that data should contact the relevant business (our customer).

2. Personal data we collect (as controller)

Account and contact data: name, work email, company, role, and credentials you provide when you register, request a demo, or contact us.
Billing data: billing contact and the limited payment metadata returned by our payment processor (Stripe). We do not store full card numbers; card data is handled by the processor.
Usage and device data: log data, IP address, browser/device type, pages viewed, and similar analytics from your use of our website and dashboard.
Communications: messages you send us and support interactions.
Cookies and similar technologies: as described in Section 8.

3. How we use it

We use controller-role personal data to: provide and secure the website and dashboard; create and administer accounts; process payments and prevent fraud against our own systems; respond to inquiries and provide support; send service and, where permitted, marketing communications (you can opt out); understand and improve our product; and comply with law.

Legal bases (GDPR/UK GDPR): performance of a contract; our legitimate interests in operating and improving the Service and securing it; consent (for certain marketing and non-essential cookies); and compliance with legal obligations.

4. The reputation network (processor context)

When customers enable Watchtower's cross-tenant reputation network, we derive irreversibly hashed, non-identifying reputation signals (peppered HMAC identifiers) from customer traffic data and share only those derived signals across tenants, subject to safeguards including one-tenant-one-vote, minimum k-anonymity thresholds before any signal is readable, recency decay, and reversal of a contribution's influence on erasure. Raw identifiers (IPs, device IDs) are never shared between tenants. This processing is performed on behalf of, and under the instructions of, our customers as controllers; see the DPA.

5. How we share data

We share personal data with:

Service providers (sub-processors) who host and operate the Service on our behalf — for example cloud hosting/database (Supabase, Render), email (Resend), payment processing (Stripe), and identity/KYB verification (Sumsub) — under contracts that restrict their use of the data. A current list is available on request at privacy@watchtowerhq.ai.
Professional advisors and authorities where required by law, to protect rights and safety, or to enforce our terms.
In a corporate transaction (merger, acquisition, financing), subject to this Policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws.

6. International transfers

We may process data in the United States and other countries. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent mechanisms. Contact us for more information.

7. Retention

We keep controller-role personal data only as long as needed for the purposes above, then delete or de-identify it. Indicative periods: account data for the life of the account plus 12 months; billing records for 7 years or as tax law requires; website logs for 90 days. Processor-role (customer traffic) data retention is set by our customers and the DPA.

8. Cookies

Our website and dashboard use cookies and similar technologies that are strictly necessary (to run the site and keep you signed in) and, with your consent where required, analytics and preference cookies. You can control non-essential cookies via your browser settings.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA (to know, delete, correct, and to limit/opt out of "sale"/"sharing" — noting we do neither). EEA/UK residents have GDPR/UK GDPR rights. To exercise controller-role rights, contact us at privacy@watchtowerhq.ai; we will respond within the timeframes the law requires. For data we process on a customer's behalf, please contact that customer (the controller); we will assist them as required by the DPA. You may also complain to a supervisory authority.

10. Security

We use administrative, technical, and organizational measures designed to protect personal data, including encryption in transit, access controls, peppered HMAC hashing of network identifiers, and least-privilege practices. No method of transmission or storage is perfectly secure.

11. Children

The Service is a B2B product not directed to children, and we do not knowingly collect personal data from children under 16.

12. Changes and contact

We may update this Policy; we will post the new version and update the "Last updated" date, and provide additional notice for material changes. Questions or requests: privacy@watchtowerhq.ai · adParagon, LLC · 217 Cedar Street #254, Sandpoint, ID 83864.