Privacy Policy

Last updated: April 13, 2026

Data controller

labwatch is operated from Switzerland. For data protection inquiries: privacy@labwatch.dev.

Self-hosted instances

If you self-host labwatch, your data never leaves your network. The labwatch server makes zero outbound connections except to notification channels you explicitly configure (Discord, Slack, ntfy, etc.). There is no telemetry, no analytics, no phone-home. We have no access to your data.

Managed service (labwatch.dev)

When you use the managed service at labwatch.dev, we collect and store:

• Account data: your email address (for login and billing) and IP address at signup (for abuse prevention).
• Infrastructure metrics: CPU, memory, disk, network, container, GPU, S.M.A.R.T., and ZFS data sent by the agent running on your nodes.
• Alert history: alerts generated by threshold rules you configure.

Legal basis for processing

We process your data on the following legal bases (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)): account data and infrastructure metrics are necessary to provide the monitoring service you signed up for.
• Legitimate interest (Art. 6(1)(f)): IP addresses are collected to prevent abuse (rate limiting, spam prevention). We do not use IP addresses for tracking or profiling.
• Consent (Art. 6(1)(a)): marketing communications (if any) would only be sent with your explicit opt-in consent.

We do not collect:

• File contents, logs, or command output from your servers
• Network traffic contents or DNS queries
• Personal files, browsing history, or keystrokes
• Any data beyond system-level metrics

Data storage, location & retention

Managed service data is stored on infrastructure in Switzerland. Retention periods by data category:

• Account data (email, password hash): retained until account deletion.
• IP addresses: retained for rate-limiting purposes only, stored alongside signup records.
• Infrastructure metrics: retained according to your plan (30 days for free, 1 year for paid plans), then automatically purged.
• Alert history: retained for 30 days after creation, then automatically purged.
• Session cookies: expire after 30 days.

When you delete a node or cancel your account, associated data is permanently deleted.

Data sharing

We do not sell, share, or provide your data to any third party. We do not use your data for model training, advertising, or analytics. The natural-language query engine runs entirely on the server — no data is sent to any external AI/LLM provider.

Cookies

labwatch uses the following first-party cookies:

• labwatch_session — authentication session (30 days, httpOnly, sameSite=lax)
• labwatch_lang — language preference (optional, 1 year)
• lw_theme, lw_accent, lw_layout — UI customization preferences (set via JavaScript)

All cookies are strictly functional. No analytics cookies. We use self-hosted Umami for anonymous, cookie-free page-view analytics — no personal data is collected and no information is shared with third parties.

Third-party services

• Stripe: payment processing for paid plans. Stripe's privacy policy applies to payment data.
• Resend: transactional email delivery (signup confirmation, billing receipts).

No other third-party services receive your data.

Your rights

You can at any time:

• Export all your data via the dashboard export feature (JSON).
• Delete individual nodes or your entire account.
• Request a full data export or deletion by emailing support@labwatch.dev.

For GDPR requests (access, rectification, erasure, portability), contact privacy@labwatch.dev. We will respond within 30 days.

Supervisory authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or with your local data protection authority if you are in the EU/EEA.

Contact

Questions about this policy? Email privacy@labwatch.dev.