Privacy policy

saas-monitor.com and the SaaS Monitor app are published by Lumy.Media SAS, Immeuble Le Grand Large, 2e éperon, Quai de la Douane, 29200 Brest, France, registered in Brest under number 889 608 790 (see the legal notice). We decide how the personal data of the people who use the service is handled: we are its controller.

For any question about your data, write to hello@lumy.bzh.

When you connect a Stripe account, the service imports data about your own customers. For that data, you (or your company) are the controller, and we are your processor: we handle it only to run the service as you set it up, as agreed in the terms of service.

Tell your customers about it in your own privacy notice, and choose carefully what your screens show: a screen’s link works for anyone who has it, in a browser or in the app, with its notifications. If one of your customers asks us about their data, we will point them to you and help you answer.

Your account

Your name, email address and password when you sign up. The password is stored only as a hash (scrypt), never as you typed it. If you sign in with GitHub or Google instead, where the site offers it, they send us your name, email address and the address of your profile picture, with the tokens they issue for the sign-in.

Your workspaces and screens

The names of your workspaces, their members and roles, and the invitations you create: the invited email address, who invited them and when. For each screen: its name, its settings, the phrases you write for its voice, and its optional password, hashed like yours.

Your Stripe accounts

The API key you paste, encrypted before it is stored: the dashboard only ever shows a masked hint of it. The account’s name, identifier and default currency, the signing secret of the webhook endpoint the service creates (encrypted too), and the progress of its imports.

What we import from Stripe

• Subscriptions: their status, plan, amounts, currency, billing interval, dates, and the terms of the coupons that apply to them.
• Payments from the 365 days before you connect, then every new one: amount, refunds, currency, description and date, and for Stripe Connect destination charges, the connected account and your fee.
• Customers created in the 7 days before you connect, then every new one.
• For each customer, subscription or payment, when Stripe has them: the customer’s Stripe identifier, name, email address and country.

We keep no payment method details. A payment’s country comes from its billing address or, failing that, from its card.

When you use the service

For each session you sign in to: its IP address, your browser’s user agent and the workspace you have open. To slow down password guessing and abuse, the server counts recent sign-in attempts, screen password attempts and registrations of the app by IP address, in memory only. Like any web server, ours receives your IP address with every request, and may keep it briefly in technical logs, for troubleshooting and security.

When you write to us

Your email address and what your message says. From our help widget, run by Gleap, also the screenshot or files you attach, and in the dashboard your name and account ID, so that we know who is writing. The widget leaves the page’s console and its requests to our server out of what it sends.

Visits to this site

We don’t measure them: the site runs no analytics. The screens load no third-party script, and neither do this site’s pages until you click their help button, which loads Gleap’s widget so that you can write to us. The dashboard loads that widget from the start.

The SaaS Monitor app, for iPhone, iPad, Apple Watch, Android and Wear OS, shows your screens and notifies you of what happens on them. It has no account, and contains no analytics, advertising or tracking: it collects nothing about how you use it.

On your device

You add a screen with its link, scanned from its QR code or pasted. The link works as a key, so the app keeps each screen in the device’s secure storage (the keychain on Apple devices, the Keystore on Android): its link, its name and the one you give it, the proof of its password if it asks for one, your notification choices for it and how it looks. The app also keeps your settings, and a random identifier of its installation, created on the device.

Its widgets, watch apps and, on iPhone, its notification extension get the screens from the app, through storage that only they can read (an App Group on Apple devices, encrypted storage on Android). Your paired watch receives them over the system’s connection with your phone. Widgets and watches keep the last figures they fetched, to show something when the network is down. Removing a screen in the app removes it, and what was kept of it, from them too.

Who the app talks to

Only the instance of each screen you add (saas-monitor.com for the screens of this service), and the push services that deliver notifications. The app, its widgets and its watch apps fetch each screen’s figures from its instance, with its link and the proof of its password, and download the sounds and voices the screen plays. Like any web server, the instance receives your IP address with each request.

To receive notifications, the app gets a push token, the address notifications are delivered to: from Apple on Apple devices, from Google’s Firebase Cloud Messaging on Android, and from Expo, for its push service, in exchange for the token Apple or Google issued.

The camera serves only to read a screen’s QR code, on the device: no image is kept or sent. The app reads the clipboard only when you tap to paste a link.

Notifications

When notifications are allowed, the app registers the device with the instance of each of its screens. For each screen, the instance stores:

• the installation identifier the app created;
• the platform (iOS or Android) and the device’s push tokens, Expo’s and Apple’s or Google’s, with the Apple environment they belong to;
• the device’s language;
• whether notifications are on for this screen, and the events you muted.

It uses them only to notify the device of the screen’s moments, as you chose. No name, email address or account is attached to them. To limit abuse, the instance counts registrations by IP address, in memory only.

A notification says what the screen’s card says, in the screen’s language: an amount in the screen’s currency (a payment, a change of MRR, a milestone reached), the plan, the customer’s country, when a canceled subscription ends, the name of the Stripe account on screens that show several and, only on screens set to show customer names, the customer’s name, or their email address as the screen shows it when they have none. Its data says which screen it comes from, by a short key that doesn’t reveal the link, and what the moment plays.

saas-monitor.com sends notifications to Apple (Apple Push Notification service) for Apple devices and to Google (Firebase Cloud Messaging) for Android, which deliver them; a paired watch shows those of its phone. A device that can’t be reached that way gets them through Expo’s push service, which forwards them to Apple or Google. These services receive each notification’s text and data with the device’s push token, to deliver it.

A device stops being notified, and its registration is deleted, when the app removes the screen, when the screen gets a new link or password, or when the screen or its workspace is deleted. When Apple, Google or Expo report that a token no longer reaches a device, once the app was deleted for instance, every screen forgets it, and a device left without a token is deleted. A screen notifies 50 devices at most: past that, the device whose app was opened the longest ago is forgotten. Turning a screen’s notifications off in the app, or pausing them all, keeps the registration and stops the notifications.

Sounds and voices

With “Play sounds and voices” on, the app plays the moments of the screen on display as its wall displays do and, on iPhone with “Also when the phone is locked”, as the sound of its notifications. Sounds and recorded phrases are files downloaded from the screen’s instance and kept in the app’s cache. On a screen set to say its own words, the app only names the moment to say: the instance writes the phrase from the screen’s own data and has Gradium synthesize it, as for a wall display (see who else handles data).

Screens of other instances

The app works with any SaaS Monitor instance, including self-hosted ones. For a screen of another instance, the figures, the registration of your device and the notifications are handled by whoever runs that instance, and this policy doesn’t cover them: ask them how they handle your data. Such instances reach devices through Expo’s push service.

Everything the app keeps or sends is needed for what you ask it to do, so it needs no consent beyond the permissions your device asks you for: the camera, notifications and, for an instance on your local network, access to that network.

Run the service

Your account, workspaces and screens, your Stripe connections and what they import.Performance of our contract with you (GDPR, article 6(1)(b)).

Keep it secure

Sessions with their IP address and user agent, password hashes, counts of recent attempts.Our legitimate interest in protecting the service and your data (article 6(1)(f)).

Notify your devices

The registrations of the devices that follow a screen with the app, and what their notifications say.Performance of the service you asked for, by allowing notifications (article 6(1)(b)).

Say a screen’s own phrases

The text of each phrase, sent to Gradium when a screen is set to say its own words.Performance of the contract: you turned the feature on.

Answer you

Your emails, and the account they are about.Our legitimate interest in replying, or the contract when you are a user.

Comply with the law

What a lawful request from an authority requires.Legal obligation (article 6(1)(c)).

We don’t use your data for advertising, we don’t sell it, and we make no automated decisions about you.

better-auth.session_token

Keeps you signed in.7 days, extended while you use the service.

better-auth.session_data

A signed copy of your session, so pages don’t have to look it up every time.5 minutes.

better-auth.state

Protects a sign-in with GitHub or Google against forgery, while it happens.5 minutes.

screen-access-…

Set on a device where someone typed a screen’s password, so the screen opens there without asking again.400 days. Changing the password makes it useless.

gleap-widget-…

Local storage of the help widget (Gleap), in the dashboard, and on this site once you open it: your conversations with us, from one visit to the next, and the widget’s settings.Until you sign out or clear it.

theme

Local storage: the light or dark dashboard you chose, if you chose one. The dashboard may keep other choices of yours there the same way, such as a tip you dismissed.Until you clear it.

Over HTTPS, the names of the first three start with __Secure-. Wall displays also note in their session storage the version of the app they reloaded for, so that an update reloads them only once.

All of these either make the service work or remember a choice you made, so they need no consent. We use no advertising, tracking or analytics cookies.

The SaaS Monitor app uses no cookies: it sends the proof of a screen’s password in a header instead, and keeps what it needs on your device, as described above.

Our providers, each only for what it does for us:

OVH SAS

Hosts our server and database, in France.2 rue Kellermann, 59100 Roubaix, France

Gradium SAS

Synthesizes the phrases of screens set to say their own words, on their displays, in the app and in its notifications, and those you preview in the screen editor. It receives the text of each phrase, which can include a customer’s name (on screens that show names), an amount, a plan, a country and a product name.151 bis rue Saint-Honoré, 75001 Paris, France

Gleap GmbH

Runs the help widget of this site and the dashboard. It receives what you write to us there, your email address, the screenshots or files you attach, and from the dashboard your name and account ID.Am Dorfplatz 3, 6858 Schwarzach, Austria

Google

Hosts the mailbox of hello@lumy.bzh, which receives the emails you send us, and delivers notifications to Android devices. For these, it receives each notification and the device’s push token.Google Workspace, Firebase Cloud Messaging

Apple

Delivers notifications to Apple devices. It receives each notification and the device’s push token.Apple Push Notification service

Expo (650 Industries, Inc.)

Issues the app’s Expo push token, and forwards to Apple or Google the notifications of devices this service can’t reach directly. It receives the device’s push tokens and each notification it forwards.Expo push service, United States

Stripe, and GitHub or Google when you sign in with them, are your providers, not ours: we read your Stripe account with the key you gave us, and a sign-in provider shares what you allow it to. Their own privacy policies apply. If you sign in with one of them, your profile picture loads from their servers.

Apple and Google also distribute the app, through the App Store and Google Play, under their own privacy policies. They give us statistics about installs and, from people who agreed to share them, crash reports, which don’t tell us who you are.

To convert currencies, the server fetches the European Central Bank’s reference rates from Frankfurter. The request carries a currency code, nothing about you.

We share personal data with no one else, unless the law requires it, and never sell or rent it.

Our server and database are in France. Gleap keeps the conversations of its help widget in Frankfurt, Germany, and serves attachments through Cloudflare’s network. Gradium sends each request to its nearest servers, which may be outside the European Union, and Google may process emails outside it, under the European Commission’s standard contractual clauses. Notifications go through the servers of Apple, Google and, for some devices, Expo, which may be in the United States, under the EU–U.S. Data Privacy Framework.

Your account

Until you ask us to delete it, at hello@lumy.bzh. We then delete it within one month, with its sessions, its sign-in methods and the workspaces no one else belongs to.

Workspaces, screens and invitations

Until an owner deletes the workspace, in its settings. Invitation links stop working after 7 days.

Stripe keys and imported data

Until you disconnect the Stripe account or delete its workspace. Either deletes the key and everything imported from the account right away, and removes the webhook endpoint the service created in Stripe while the key still allows it. Re-importing an account deletes its data before importing it again.

Sessions

A session expires 7 days after its last use, and signing out ends it at once. Its record, with its IP address and user agent, is deleted when you sign out, when the browser comes back after it expired, or with your account.

Devices following a screen

Until the app removes the screen, the screen gets a new link or password, or is deleted with its workspace. Push tokens that no longer reach a device are forgotten as soon as Apple, Google or Expo report it, and a screen keeps its 50 most recently opened devices at most.

Screens in the app

On your device, until you remove them in the app. The figures their widgets and watches kept go with them.

Attempt counts

In the server’s memory only, never on disk, for windows of an hour at most.

Synthesized phrases

The server keeps its last 200 phrases in memory to replay them, and forgets them when it restarts.

Your emails

As long as needed to follow up, and at most three years after our last exchange.

• Stripe keys and webhook secrets are encrypted with AES-256-GCM, with a key only the server holds, and never sent to a browser.
• Passwords, yours and those of screens, are stored as scrypt hashes.
• A workspace’s data is only reachable by its members, and by its screens as they are set up.
• A screen’s link carries a long random token. Customer names and email addresses stay hidden unless you turn them on, a screen can ask for a password, and regenerating its link cuts off the old one.
• The app keeps screens in the device’s keychain or Keystore. Notifications name their screen by a short key that doesn’t reveal its link, and carry no Stripe identifier.
• All traffic is encrypted with HTTPS.
• The code is open source: anyone can check how data is handled, and report a vulnerability privately.

You may ask to access your data, correct it, delete it, receive it in a portable format, restrict its processing or object to it. You may also set guidelines for what happens to it after your death.

Some of this you can do yourself: rename yourself in the settings, disconnect a Stripe account, delete a workspace. For the rest, write to hello@lumy.bzh. We answer within one month, and may ask you to prove who you are if we can’t tell.

The app has no account, so we can’t tell which device is yours. To delete what a screen’s instance knows about your device, remove the screen in the app; to stop its notifications, turn them off there. Everything else the app keeps stays on your device.

If you think we don’t respect your rights, you may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

We update this page when the service changes what it collects or who handles it, and change its date at the top. We tell you about significant changes by email or in the dashboard before they apply.