Privacy Policy

1. Overview & Scope

This Privacy Policy describes how Evergreen ("Evergreen", "we", "us", or "our") collects, uses, processes, and protects your personal information when you use our website at evergreen.watch, our dashboard application, APIs, and edge monitoring infrastructure.

We comply with applicable global data privacy regulations, including the European General Data Protection Regulation (GDPR), the UK GDPR, and the Brazilian General Data Protection Law (LGPD, Lei Geral de Proteção de Dados - Lei nº 13.709/2018).

2. Information We Collect

We only collect data that is strictly necessary to provide and secure our infrastructure monitoring platform:

• Account Credentials: Email address, name, workspace username, and avatar URL provided through authenticated Single Sign-On (SSO) providers (e.g., GitHub, Google, or email magic links).
• Billing Information: Billing address, country, tax identifier (VAT/CPF/CNPJ if provided), and subscription tier. Credit card numbers and payment instruments are tokenized and processed directly by our PCI-DSS Level 1 certified payment processors; Evergreen never stores raw payment card numbers.
• Configuration Data: URLs, hostnames, IP addresses, port numbers, custom request headers, webhook endpoints, and alert notification destinations configured in your monitors.
• Technical & Log Data: Client IP address, browser user-agent, operating system, access timestamps, and interactions with the dashboard.

3. Monitoring Telemetry & Synthetic Checks

When Evergreen probes your registered endpoints, our globally distributed edge nodes record:

• HTTP response status codes, TTFB (time-to-first-byte), TLS handshake latency, and DNS resolution latency;
• Response headers and response body snippets (if response body assertion rules are configured);
• SSL/TLS certificate metadata (issuer, expiration date, SANs);
• Packet loss and round-trip times (for ICMP / TCP checks).

4. How We Use Information

We process personal and telemetry information for the following legitimate purposes:

• Service Delivery: Executing periodic health probes, computing uptime percentages, rendering latency sparklines, and firing incident alerts;
• Account Management: Authenticating access, handling subscription upgrades and renewals, and sending transactional notices;
• Platform Security: Detecting bot abuse, DDoS attempts, credential stuffing, and malicious probe configurations;
• Legal Compliance: Complying with statutory accounting rules, tax filings, and lawful governmental requests.

We never sell personal information, and we do not participate in cross-context behavioral ad networks.

5. Data Sharing & Subprocessors

We only share data with vetted third-party service providers who assist us in operating our platform under binding Data Processing Agreements:

• Cloudflare Inc.: Global edge network, DDoS mitigation, DNS resolution, and edge compute execution;
• Payment Gateways (Stripe): Tokenized payment processing, invoice generation, and tax calculation;
• Transactional Email Services (Resend / Postmark): Automated alert notifications, incident digests, and verification emails;
• Alert Destination Integrations: If you connect Discord, Slack, or Webhook destinations, incident payloads are forwarded directly to the endpoints you choose.

6. Data Retention

We adhere to strict data minimization principles:

• Raw Telemetry: Ping samples and raw probe logs are retained for 24 hours to 30 days depending on your subscription tier, after which they are rolled into hourly/daily statistical aggregates or permanently deleted.
• Account Information: Retained for the lifetime of your account. When you delete your account, your monitors, team memberships, and credentials are permanently purged within 30 days.
• Financial Records: Invoices and transaction logs are preserved for the statutory period required by tax and corporate regulations (typically 5 to 7 years).

7. Your Rights (GDPR, UK GDPR & LGPD)

Under applicable privacy laws, you possess enforceable rights regarding your personal data:

• Right to Access & Portability: You may request an export of your personal profile and monitoring configurations in a structured, machine-readable format.
• Right to Rectification: You may update inaccurate or obsolete personal details directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may delete your account and all associated telemetry at any time.
• Right to Object or Restrict Processing: You can restrict non-essential data processing or withdraw previously granted consent.
• LGPD Specific Rights (Brazil): Brazilian data subjects may request confirmation of the existence of data processing, anonymization, blocking, or elimination of unnecessary or excessive data pursuant to Art. 18 of LGPD.

To exercise any of these rights, email us at privacy@evergreen.watch. We will respond within thirty (30) days (or within 15 days for simplified LGPD inquiries).

8. Data Security

We maintain rigorous technical and administrative safeguards to protect your information, including encryption of all data in transit (TLS 1.3) and at rest (AES-256), continuous vulnerability assessments, multi-factor authentication for administrative access, and strict internal least-privilege principles.

For detailed specifications of our security posture, visit our Security Center.

9. International Transfers

Evergreen operates a globally distributed edge monitoring infrastructure. Your telemetry and account data may be processed in regions outside your country of residence. Where cross-border data transfers occur from the EEA, UK, or Switzerland to countries lacking an adequacy decision, we utilize Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Contact Us & Data Protection Officer (DPO)

If you have questions, comments, or complaints concerning our privacy practices, or if you wish to contact our Data Protection Officer, reach out to: