Skip to content
Centoculus

Privacy Policy

English

Last updated: November 7, 2026

This policy explains which personal data we process when you visit this website, join the early access list or contact us, and when you later use the Centoculus service. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).

1. Controller

Nona Consult LLC
30 North Gould Street, Sheridan, WY 82801, United States
Phone: +1 (307) 429-5702
E-mail: support [at] centoculus [dot] com

For all questions about data protection, write to support [at] centoculus [dot] com.

2. Hosting and server location

This website, the Centoculus service and all data we store are hosted in the Europa Data Center. Our hosting provider processes data only on our behalf and under a data processing agreement (Art. 28 GDPR).

We do not use content delivery networks, externally hosted fonts, analytics or advertising services. All scripts, styles and fonts are delivered from our own servers.

3. Visiting this website

When you open a page, our web server processes technical data that your browser sends automatically: IP address, date and time, requested page, referring page, browser and operating system.

  • Purpose: delivering the website, keeping it secure and finding errors.
  • Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
  • Storage: server log files are deleted after at most 14 days, unless a security incident has to be investigated.

If you arrive through a partner link, we also look up the country of your IP address in a database on our own server, to know whether we have to ask for your consent before setting the partner cookie (section 6). Nothing is sent to anyone for this, and the country is not stored. IP geolocation by DB-IP (licensed under CC BY 4.0).

Free tools (SSL checker, website down checker, mail check): the address you enter is used only for that one check. Our server looks up the address in DNS and connects to it; the website you check sees our server, not you. The mail check (SPF, DKIM, DMARC) only reads DNS records and never connects to the domain's servers. We do not store or log the address or the result; the result is kept in your session only until it is shown to you. To prevent abuse we count the checks per IP address; these counters are deleted after at most 24 hours. Legal basis: our legitimate interest in offering the tools and protecting them from abuse (Art. 6(1)(f) GDPR).

4. Cookies and local storage

Apart from the partner cookie (section 6), we only use what is technically necessary:

Name Purpose Duration
centoculus-session Keeps forms working across requests 2 hours
XSRF-TOKEN Protects forms against cross-site request forgery 2 hours
theme (local storage) Remembers light or dark mode, never sent to us Until you clear it
currency (local storage) Remembers the currency you chose for prices, never sent to us Until you clear it
centoculus_consent Stores your choice in the cookie dialog (shared with app.centoculus.com) 12 months
centoculus_lang Remembers your answer to the offer to show a page in your browser's language 12 months

These are strictly necessary (Section 25(2) TDDDG, Art. 6(1)(f) GDPR); no consent is required. We do not use analytics or advertising cookies and load no third-party services. You can see and change all settings under "Cookie settings" at the bottom of every page.

5. Early access list

If you join the early access list, we process your e-mail address, the time of sign-up and confirmation, your IP address at sign-up and the version of the consent text you accepted.

  • Double opt-in: you only join the list after confirming the link we send you. Unconfirmed addresses are deleted after 30 days.
  • Purpose: informing you about the launch of Centoculus and early access.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). We keep the record of your consent to be able to prove it (Art. 6(1)(c) and Art. 7(1) GDPR).
  • Withdrawal: you can unsubscribe at any time with the link in every e-mail or by writing to us. Your address is then marked as unsubscribed so we do not contact you again; on request we delete it completely.

6. Partner links and partner cookie

Some visitors reach us through a link of one of our partners, for example from a blog or a newsletter. The link carries the partner's code (ref=…) in the address of the pages you open here.

  • Partner cookie centoculus_ref: contains only the partner code and keeps it for 90 days on centoculus.com and app.centoculus.com, so the partner is credited if you sign up later. Visitors from the EU, the EEA and the United Kingdom (and when we cannot determine the country) are asked first; we only set the cookie if you click "Accept", "Accept all" or switch on "Partner attribution" in the settings. For visitors from other countries it is set when they arrive through a partner link. You can switch it off at any time under "Cookie settings"; the cookie is then deleted.
  • Without the cookie: the code still travels in the address of the pages you open, so it counts if you sign up during the same visit.
  • Early access: if you join the early access list with a partner code in the address, we store the code with your sign-up. After you confirm, we send the Centoculus service a keyed hash (HMAC) of your e-mail address together with the code, never the address itself. If you create an account with this address within 12 months, it is assigned to the partner and the hash is deleted; otherwise it is deleted after 12 months.
  • Sign-up: if you create an account with a partner code in the address, the partner cookie or a partner's voucher code, your account is assigned to that partner for good.
  • What the partner sees: the number of clicks and sign-ups and, for paying customers, the account name and the commission. Never your e-mail address or how you used our pages.
  • Purpose: paying our partners their commission.
  • Legal basis: for the partner cookie in the EU, EEA and UK your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future; otherwise, and for the code in the address and the early access hash, our legitimate interest in paying our partners correctly (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR) by writing to support [at] centoculus [dot] com.

7. Partner program

If you apply as a partner, we process your name, e-mail address, password (stored only as a hash), company, website, how you plan to promote us, postal address, country, tax ID and language. For commissions and payouts we additionally process your clicks and referred customers (without data about the visitors), the commissions booked, your tax form (W-9 or W-8BEN/W-8BEN-E including the tax identification number, signature name, time and IP address) and your payout account (bank details or PayPal address, stored encrypted; for payouts through Stripe, the identifier and status of the account you set up with Stripe).

  • Purpose: running the partner program, paying commissions, meeting tax reporting duties (for example Form 1099-NEC in the United States) and checking sanctions lists.
  • Legal basis: the partner agreement (Art. 6(1)(b) GDPR) and statutory duties (Art. 6(1)(c) GDPR).
  • Recipients: the payment service providers that carry out payouts (bank transfer, PayPal or Stripe) and, where required, tax authorities. For payouts through Stripe you enter your identity and bank details directly with Stripe, which processes them as an independent controller under its own privacy policy.
  • Storage: partner accounts without any click, sign-up or commission for 12 months are deleted automatically, after a reminder by e-mail three months before. Accounts with commissions or payouts are kept as long as statutory retention periods for accounting and tax records require; you can close your account at any time by writing to us.

8. Contact form and e-mail

When you contact us, we process your name, e-mail address, the topic and your message, as well as your IP address and browser identifier to prevent abuse.

  • Purpose: answering your request.
  • Legal basis: pre-contractual or contractual measures (Art. 6(1)(b) GDPR) or our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).
  • Storage: messages are deleted 12 months after receipt, unless statutory retention periods apply.

Our forms are protected against spam with a hidden field, a time check and Cloudflare Turnstile. Turnstile is provided by Cloudflare, Inc. (USA); when you open a form, Cloudflare checks signals from your browser and your IP address to tell people from bots and may show a short challenge. It does not use cookies for advertising. Legal basis is our legitimate interest in protecting our forms against abuse (Art. 6(1)(f) GDPR).

9. Using the Centoculus service

Once the service has launched, we additionally process:

  • Account data: name, e-mail address, password (stored only as a hash), language, time zone, two-factor settings.
  • Monitoring data: the websites, servers and services you configure, check results, response times, incidents, and metrics sent by the server agent.
  • Notification data: e-mail addresses, phone or device identifiers you add as alert recipients.
  • Billing data: company name, address, tax ID and invoices.

Legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) and, for invoices, statutory retention duties (Art. 6(1)(c) GDPR). Monitoring data is kept for the retention period of your plan and deleted when your account is closed. You are not obliged to provide this data, but without it we cannot provide the service.

Newsletter: if you subscribe (at sign-up or in your account), we send you news about our products, features and offers to your account e-mail address. Your subscription only starts once your e-mail address is confirmed (double opt-in). We store when and how you subscribed or unsubscribed, your IP address at that time and the version of the consent text, to be able to prove your consent. We do not track whether you open the e-mails or click links. Legal basis is your consent (Art. 6(1)(a) GDPR) and, for the proof, Art. 6(1)(c) and Art. 7(1) GDPR. You can unsubscribe at any time with the link in every newsletter or in your account.

Support requests: if you contact our support (in the web, in the app or by e-mail), we process your message, your contact details and the data of your account that the request concerns (e.g. monitors, servers, incidents) to answer it. Requests may first be answered with the help of automated analysis services; our team can take over at any time. Requests are kept as long as your account exists.

Interventions: if you order an intervention, we process the server address and port you enter, our access key, the log of each session on your server, if you choose this, the password you give us for setting up access once (stored encrypted, never logged, deleted as soon as our key works and at the latest after 24 hours) and, before changes, a backup of configuration files and databases. Data on your server is processed on your behalf (see our Terms of Service). Session logs are kept with the intervention. We also keep an internal record of each intervention (its steps, the commands run with their output, and the result) so that we can answer questions about it later; it is kept as long as the intervention; backups stored with our storage provider are deleted after 30 days unless you extend them.

Sign-in with Google, Apple, Microsoft or GitHub: if you choose to sign up or sign in with one of these providers, the provider tells us your name, e-mail address and an account ID; we use them only to create your account and sign you in. The provider learns that you sign in to Centoculus. Legal basis is the performance of our contract (Art. 6(1)(b) GDPR).

Protection against bots and unusable addresses: on sign-up, password reset and partner applications, and on sign-in after repeated failed attempts, we use Cloudflare Turnstile. Cloudflare checks signals from your browser and your IP address to tell people from bots and may show a short challenge; it does not use cookies for advertising. We also check whether the domain of your e-mail address can receive e-mails (DNS lookup) and is not a throwaway address. If e-mails to your address cannot be delivered, we note this and ask you for a new address. Free accounts without monitors that are clearly unused are closed after notice. Legal basis is our legitimate interest in protecting the service against abuse (Art. 6(1)(f) GDPR).

Alerts are sent through the channels you set up: by e-mail, to your own webhook addresses or, if you choose it, via Telegram (which then receives the alert text). Push notifications to browsers go through the push service of the browser vendor (Google, Mozilla, Apple or Microsoft), push notifications to our app through Google Firebase Cloud Messaging (for iPhones on to Apple). These services only receive the device identifier and the short notification text (name of the monitor, type and time of the incident). You switch push on per device yourself and can switch it off at any time; we delete the device identifier as soon as you switch push off or the service reports it as invalid.

In the Centoculus web app we likewise only use what is technically necessary: a session cookie (centoculus-uptime-session, 2 hours) and XSRF-TOKEN (2 hours) for signing in and protecting forms, a sign-in cookie (remember_web_…) that keeps you signed in according to your sign-out setting (at most 400 days, deleted when you sign out), when signing in with Apple a security cookie (socialite_apple_nonce, 10 minutes) that protects the sign-in against forgery, and in local storage your language (centoculus.locale, centoculus.partner.locale) and, for resellers, the customer last selected (centoculus.customer). With your consent (or outside the EU, EEA and UK), the partner cookie centoculus_ref and your choice centoculus_consent are shared with this website (see sections 4 and 6).

Checks against your websites and servers are sent from monitoring locations in several regions so that outages can be confirmed. These locations only send requests to the targets you configure and report the results back to the Europa Data Center.

10. Payments

Payments are processed by Stripe; businesses with a tax ID can alternatively pay by PayPal. Private customers and customers without a confirmed VAT ID buy through Stripe's reseller service (Link), which is the seller and charges the tax; businesses with a valid tax ID are invoiced by us without VAT (reverse charge). To decide this we check the VAT ID you enter with the official register (VIES of the European Commission, HMRC in the United Kingdom, the Swiss UID register); the register receives only the number. You enter your payment details directly with Stripe or PayPal; we do not see or store them. We receive the payment status, the amount, your billing details and, with PayPal, the e-mail address of your PayPal account and the transaction number for our invoices. Stripe and PayPal process data as independent controllers under their own privacy policies.

11. Recipients

We only share personal data where this is necessary: with our hosting provider (as processor), with payment service providers for payments and partner payouts, with messaging services you choose for alerts, with our backup storage provider and providers of automated analysis services for interventions and support requests (a main provider and, if it is unavailable, a replacement provider), with the partner who referred you (only your account name and the commission, section 6), and with authorities where we are legally obliged to. We do not sell personal data.

12. International transfers

Nona Consult LLC is a company based in the United States. Your data is stored in the Europa Data Center. Where personal data is accessed from or transferred to the United States or other countries outside the EU/EEA, we use the EU Standard Contractual Clauses or another safeguard recognised under Art. 44 et seq. GDPR.

13. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, write to support [at] centoculus [dot] com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or workplace.

14. Security

All connections are encrypted with TLS. Passwords are stored as salted hashes, administrative access requires two-factor authentication, and access to personal data is limited to people who need it.

15. Children

Our services are aimed at businesses and professionals and not at children under 16. We do not knowingly collect data from children.

16. Changes

We update this policy when our services or the law change. The current version is always available at https://centoculus.com/privacy.

This text is written in English. Translations are for convenience only; in case of differences, the English version prevails.