What we collect.
What we refuse to.

Who we are

The service is operated by Wakora OÜ, a company registered in Estonia (registry code 17618827, VAT EE103039486), Tartu mnt 67/1-13b, 10115 Tallinn, Estonia (the "we" on this page). For anything privacy-related, write to [email protected]; security-sensitive reports go to [email protected]. We are the controller for your account and billing data, and the processor for the monitoring data your infrastructure sends us.

This website and the console

wakora.io is a static site. It sets no cookies, runs no analytics, no tracking pixels and no third-party scripts. Web server logs (IP address, requested URL, user agent) are kept briefly for security and capacity purposes and rotate away automatically.

The console at app.wakora.io uses strictly necessary cookies only: your session, security protections, and delivery of the push notifications you enable. There are no advertising or cross-site tracking cookies and no third-party analytics, which is why you will not find a cookie banner there either. Sign-in attempts are logged (time, IP, browser) and shown to you in your own security journal.

Your account

When you create a workspace we store what a monitoring account needs and nothing beyond it: name, email, hashed password, timezone, language, and the notification endpoints you add yourself, such as a phone number for on-call calls or a chat handle. Phone numbers must be verified by you before they can receive anything. Sign-in history (time, IP, browser) is visible to you in the console and helps you spot an account compromise.

Sign in with Google

You can create and sign in to your Wakora account with a Google Account instead of a password. If you choose this, we request the basic sign-in information only: your name, your email address and your profile picture. We use it for exactly one purpose: creating your account, signing you in, and showing your name and avatar in the console. Wakora does not request access to Gmail, Google Calendar, Google Drive, Contacts or any other Google service, and has no ability to read them.

The only Google user data we retain is the name and email address on your account profile, under the same retention and deletion rules as the rest of your account data; we do not store Google access tokens after sign-in completes. We never share Google user data with third parties, never sell it, and never use it for advertising or profiling. You can revoke Wakora's access at any time in your Google Account security settings, and deleting your workspace removes the data on our side.

Wakora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Monitoring data: your servers, your data

The agent collects operational telemetry from machines you enroll: metrics, service inventory, events, checks, traces and, if enabled, log lines. You are the controller of this data; we process it to provide the service, under an Article 28 DPA published in standard form in the trust pack. Three design rules limit what can ever reach us:

• Secrets never leave your server. Database and device credentials are stored encrypted on the host and referenced by name. There is no code path that uploads them.
• Logs are redacted on the host before transmission: tokens, passwords in URLs and connection strings, card-like numbers and API keys are masked at the source.
• Monitoring data is about machines, not people. We minimize by design: hostnames, service names and metrics, not user content.

Real user monitoring, without following users

If you enable RUM on a site, visitor browsers report performance timings and JavaScript errors. The snippet sets no cookies and builds no visitor profile. The visitor's IP address is used once, at ingest, to resolve a country code, and is then discarded, never stored. What remains is aggregate: timings, error messages, country, browser family and device class.

Billing

Card payments are handled by Stripe; card numbers never touch our systems. We keep invoices and the billing details you provide (company name, VAT ID, billing email) for as long as tax law requires.

Subprocessors

We keep the list short, and each entry does one job. OVHcloud hosts the platform in the EU. Cloudflare fronts the web plane for CDN and DDoS protection; telemetry ingest from your agents does not pass through it. Stripe handles payments. Alert delivery uses carrier chains with failover, because reachability is the product: SIA Telenet, Telnyx, Zadarma and Twilio for voice calls, and Telnyx, Twilio and IDM for SMS; these providers see the destination phone number and the alert text, nothing more. Where a provider is US-headquartered, transfers are covered by standard contractual clauses or an adequacy framework. The current list with roles ships signed in the trust pack; execution copies of the DPA via [email protected].

Retention and deletion

Telemetry retention follows your plan and is enforced by expiry at the storage layer, not by a cleanup script someone has to remember. When a host is removed, its telemetry is purged; wakora uninstall plus deregistration erases the machine's data from our storage. Delete your workspace and account data follows, except invoices we are legally required to keep. Erasure requests: [email protected].

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and you can object to processing. Write to [email protected] and we answer within a month. You can also complain to your local supervisory authority.

Changes

If this policy changes in a way that matters, account owners are notified by email before the change takes effect. The date at the top of the page always reflects the current version.