Privacy Policy

Website

https://sitewatcher.app/

Products

SiteWatcher platform and WebFortify WordPress plugin

Operator

PhoneixRise Interactive Pvt. Ltd.

1. Who we are

SiteWatcher is operated by PhoneixRise Interactive Pvt. Ltd., a company incorporated in India (“SiteWatcher”, “we”, “us” or “our”).

Privacy contact: support@sitewatcher.app
Support contact: support@sitewatcher.app

Depending on the activity and applicable law, PhoneixRise Interactive Pvt. Ltd. may act as the data fiduciary/controller for account, billing, website and platform operations. When a customer uses SiteWatcher to process personal data collected through a website that the customer controls, the customer may be the controller/data fiduciary and SiteWatcher may act as a processor. The actual roles depend on the processing performed and can be documented in a data-processing agreement where appropriate.

2. Scope

This Policy applies to visitors to sitewatcher.app, people who create SiteWatcher accounts, customers and authorised users, people who install or activate WebFortify, and personal data processed for support, billing, website monitoring and platform operation.

This Policy does not replace the privacy policy of a WordPress website owner or third-party service. If you visit a website monitored by one of our customers, that website owner is generally the first contact for its own visitor-data practices.

3. Information we collect

We collect information reasonably necessary to provide and protect the Services.

3.1 Account and contact information

This may include your name, business name, email address, account identifier, country, account preferences and correspondence with support.

3.2 Subscription and transaction information

This may include plan name, order ID, transaction reference, payment status, billing country, invoice details and subscription start/expiry status. SiteWatcher subscriptions are manual-renewal subscriptions. We do not automatically charge a payment method for annual renewal under the current policy.

Payments are processed by Cashfree Payments. You enter your card, UPI or bank details in Cashfree’s checkout, not on SiteWatcher. We receive and store only order and transaction references and the payment status; we do not receive or store full card numbers or bank credentials.

3.3 WordPress installation and connection information

When WebFortify is installed and connected, the Services may process:

• Website URL or domain.
• WordPress, WebFortify and PHP versions, the WordPress language, time zone and multisite setting, and the type of web server.
• Installation or connection identifier.
• Activation date and promotional/paid entitlement status.
• The installed plugins and themes (their identifiers, versions, whether they are active and whether an update is available).
• Results of security configuration checks.
• For file-integrity monitoring: file paths relative to the WordPress folder, file sizes, modification times and SHA-256 fingerprints. For changed text files, the line numbers that changed. File contents are not sent.
• For the database check (part of file-integrity monitoring): where script-like code appears in posts, pages, widgets or settings (item ID, field and line number, not the content); the names of auto-loaded options, scheduled tasks and database tables; the site and home addresses, the registration and default-role settings, the active plugins and theme; and a one-way hash of the site’s administration email address.
• Technical events and error codes about the connection’s health.

The website administrator chooses in WebFortify which of these categories are shared. WebFortify does not send administrator email addresses (only the one-way hash above), WordPress user accounts, IP addresses of site visitors, the content of posts or pages, database contents or passwords.

3.4 Security monitoring and scan information

Depending on enabled features, the Services may process website health results, detected software versions, vulnerability or configuration findings, security alerts, timestamps and technical metadata.

The plugin and platform do not collect or transmit website content, database contents, customer records, credentials, secret keys or visitor personal data. Our external checks request your website’s public pages in the same way a browser does, and record the results: status codes, response times, HTTP headers, TLS certificate details, DNS records, page titles and canonical links. We store these results, not copies of your pages.

3.5 Device, usage and log information

When you visit our website or use the platform, our systems generate operational logs containing IP address, browser/device information, timestamps, request metadata, diagnostic events and security logs. Web server logs record the IP address, the page requested (without query strings), the response status and timing. Our account audit log stores a one-way hash of the IP address and browser, not the values themselves.

3.6 Support information

If you contact us, we process the information you choose to provide, which may include your email address, website URL, screenshots, diagnostic files and support correspondence.

4. How we use information

Subject to applicable law and any required consent, we use information to:

• Create and administer accounts.
• Register, authenticate and manage WebFortify installations.
• Provide website monitoring, security checks, health checks, reports and alerts.
• Administer the 12-month launch promotion for the first 100 qualifying installations.
• Manage manually purchased subscriptions, payments, invoices and refunds.
• Provide customer support and troubleshoot errors.
• Maintain, secure and improve the Services.
• Detect fraud, abuse, unauthorised access and violations of our Terms.
• Send service, security, billing and material product notices.
• Comply with legal, accounting, tax and regulatory obligations.
• Send marketing communications where permitted. You may opt out of promotional communications.

We do not sell personal data.

5. Legal grounds, notices and consent

Depending on the jurisdiction and activity, we process information where necessary to provide a service you request or perform a contract, comply with legal obligations, pursue legitimate interests that are not overridden by your rights, or where you have given consent.

For individuals in India, we intend to process digital personal data in accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, according to their applicable commencement dates. Where consent is required, we will provide a clear notice describing the personal data and purposes and explain how consent may be withdrawn and rights exercised.

You may withdraw consent where processing relies on consent. Withdrawal does not affect processing that took place before withdrawal. It may mean that we cannot continue to provide a feature that depends on the data.

6. Cookies and similar technologies

Our website and account portal use one essential cookie: the sign-in session cookie. It is set only when you sign in, cannot be read by scripts (HttpOnly), is sent only over HTTPS, and expires when you sign out, after 30 minutes of inactivity or after 12 hours at most. We do not use analytics, advertising or other non-essential cookies, and we do not load third-party tracking scripts.

When you pay, Cashfree’s checkout runs on our payment page and may use its own cookies or similar technologies for payment security and fraud prevention, under Cashfree’s privacy policy.

Where required, we will request consent before using non-essential cookies or similar technologies. You can manage cookies through your browser and any consent controls we provide.

7. Who we share information with

We share relevant information with service providers that help us operate the Services:

Service providers may process data on our behalf under contractual obligations and only for authorised purposes. We may also disclose information where required by law, to protect users or the Services, or in connection with a business reorganisation or transfer, subject to applicable law.

We do not share personal data with third parties for their independent marketing unless we clearly disclose this and obtain any permission required by law.

8. International transfers

Your information may be processed in India or other countries where we or our service providers operate. Our servers, database and backups are hosted by DigitalOcean in New York, USA; email is sent through Resend in the USA; payments are processed by Cashfree in India. We will use safeguards and comply with cross-border transfer restrictions required by applicable law.

9. Data retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes in this Policy, including service delivery, security, dispute resolution and legal obligations.

When information is no longer needed, we will delete or irreversibly anonymise it, subject to lawful retention requirements and backup cycles. If a customer disconnects a website or a promotional/paid entitlement expires, the applicable deletion schedule will be explained in the product interface or customer documentation.

10. Security

We use reasonable technical and organisational measures designed to protect information, including:

• encryption in transit (HTTPS only, with HSTS);
• passwords stored only as Argon2id hashes, and session and sign-in tokens stored only as hashes;
• optional two-factor sign-in;
• database-level isolation between customer workspaces;
• role-based access controls and an audit log of account changes;
• encrypted backups and restricted staff access.

No internet transmission or storage system can be guaranteed completely secure. If a personal-data breach occurs, we will investigate, contain, remediate and provide notices required by applicable law.

11. Your rights and choices

Depending on your location and applicable law, you may have rights to request access to personal data, correction or updating, deletion/erasure, withdrawal of consent, objection to or restriction of certain processing, portability where provided by law, and the right to complain to a relevant regulator or supervisory authority.

To submit a request, email support@sitewatcher.app with the subject “Privacy Request”. We may need to verify your identity and authority before responding. We will respond within the time required by applicable law.

If you are a visitor, patient, employee or customer of a website monitored by a SiteWatcher customer, contact that website owner first for requests relating to data the owner controls. We will assist our customer as required by contract and law.

12. Children’s personal data

The Services are intended for business users and are not directed to children. Do not knowingly provide children’s personal data unless the relevant website owner has a lawful basis and has met applicable notice, consent and parental-consent requirements. If you believe a child has provided personal data to us inappropriately, contact support@sitewatcher.app.

13. Third-party websites and services

Our website or Services may link to or integrate with third-party services. Their privacy practices are governed by their own policies. We are not responsible for their independent processing.

14. Changes to this Policy

We may update this Policy as our Services, data practices or legal obligations change. We will update the “Last updated” date and provide additional notice where required. Material changes may be communicated through the website, account portal or email.

15. Contact and grievance redressal

Legal entity

PhoneixRise Interactive Pvt. Ltd.

Website

https://sitewatcher.app/

Support email

support@sitewatcher.app