Privacy Policy

Effective date: 01/02/2026 

Last updated: 01/02/2026 

This Privacy and Cookie Policy explain how Elbah Group Limited (company number 15108393), trading as Sentinel (“Sentinel”, “we”, “us”), collects, uses, shares, and protects personal data when you use: 

• our marketing website (the “Website”); and 

• our web application (the “App”) 

Together, the Website and App are the “Services”. 

This Policy also explains how we use cookies and similar technologies and how you can control them. 

1. Who we are 

Controller: Elbah Group Limited (company number 15108393) trading as Sentinel 

Email: [email protected] 

Address: 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE 

2. What this Policy covers 

This Policy covers personal data we process when you: 

• visit or interact with the Website, 

• create an account or use the App, 

• receive alerts or notifications (where you or an account owner has added you as a contact), and 

• contact us for support or sales. 

It does not cover third-party websites, products, or services you access via links or integrations (those have their own policies). 

3. Personal data we collect 

A. Data you provide 

Account and profile (App): 

• Name, email address 

• Login credentials (stored as hashed passwords) 

• Roles/permissions and team membership 

Billing and subscription: 

• Billing name, billing email, company name (if provided) 

• Invoices, plan, payment status, transaction identifiers 

Monitoring configuration (App): 

• Monitor configuration (e.g., endpoints/domains you choose to monitor, schedules, alert rules) 

• Notification settings and alert history/events 

Notification contacts (App): 

• Email addresses and/or phone numbers you add for alerts 

• Messaging identifiers you configure (e.g., webhook metadata) 

Support and communications (Website/App): 

• Messages you send to us (support requests, forms, emails) and related metadata 

B. Data we collect automatically 

Technical and usage data (Website/App): 

• IP address, device/browser information 

• Access logs, security logs, timestamps, diagnostic and error logs 

• Interactions with pages/features (where analytics are enabled and you consent) 

C. Cookies and similar technologies 

We use cookies and similar technologies on the Website and App as described in Section 11 (Cookies). 

4. How we use personal data and our legal bases 

We use personal data for the purposes below under the UK GDPR legal bases shown in brackets: 

• Provide and operate the Services (Contract): create and manage accounts; provide monitoring/alerting; administer subscriptions and settings. 

• Support and service communications (Contract / Legitimate interests): respond to enquiries; provide troubleshooting and important service messages. 

• Security, abuse prevention, and fraud detection (Legitimate interests / Legal obligation): protect accounts and infrastructure; investigate suspicious activity and prevent misuse. 

• Improve and develop the Services (Legitimate interests; for analytics cookies: Consent): analyse performance and reliability; improve user experience and documentation; analytics tools run only if you opt in via the cookie banner. 

• Legal compliance (Legal obligation): tax, accounting, legal requests, and compliance obligations. 

• Marketing (Consent or Legitimate interests depending on context): send marketing emails where permitted; you can opt out at any time via unsubscribe links or by contacting us. 

5. How we share personal data 

We may share personal data with: 

• Service providers (processors/sub-processors) that help us operate and support the Services (e.g., hosting, email delivery, SMS/voice delivery, support tooling, analytics where enabled). 

• Payment processors to process subscriptions and payments. 

• Authorities, regulators, or other parties where required by law or necessary to protect rights, safety, and security. 

• A buyer or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards. 

6. Sub-processors we use 

Below is a list of sub-processors used to provide the Services (as of the Last updated date). We may update this list from time to time. 

Sub-processor	Purpose	Data involved	Notes
Amazon Web Services (AWS)	Hosting/infrastructure for the Services	Account data; service data; logs	May involve processing outside the UK depending on configuration
SendGrid	Email delivery (notifications, account emails, and occasional deal offers where permitted)	Email addresses; email content; delivery metadata	Marketing emails only where permitted/opt-in where required
ClickSend	SMS/voice notifications (where enabled)	Phone numbers; message content; delivery metadata
Stripe	Payment processing	Billing details; transaction identifiers; payment status	We do not store full card details
PayPal	Payment processing (where offered)	Billing details; transaction identifiers; payment status	We do not store full card details
Google Tag Manager	Tag management	Cookie preferences and tag firing logic; limited device/browser data	Tags only fire according to your cookie choices
Google Analytics (GA4)	Analytics (strictly opt-in)	Cookie identifiers; usage data; device/browser data; IP-derived location	Not using Google Signals/Ads features currently; may add later with updated consent
Microsoft Clarity	Analytics/session insights (strictly opt-in)	Cookie identifiers; usage data; device/browser data	Session insights only when you opt in

7. International transfers 

If personal data is transferred outside the UK, we use appropriate safeguards (such as the UK IDTA or Addendum) and carry out transfer risk assessments where required. 

8. Data retention 

We retain personal data only as long as needed for the purposes in this Policy: 

• Account data: while your account is active, plus 12 months after closure. 

• Billing records: 6 years. 

• Logs: at least 6 months. 

• Backups: rotated/overwritten every 7 days. 

Deletion requests are handled subject to legal requirements and legitimate security/anti-fraud needs. 

9. Your rights 

Depending on your circumstances, you may have rights to: 

• access your personal data 

• correct inaccurate data 

• request deletion 

• restrict or object to processing 

• data portability (where applicable), and 

• withdraw consent (where consent is the basis). 

To exercise your rights, email [email protected]. We may need to verify your identity. 

10. Security 

We use appropriate technical and organizational measures to protect personal data, including access controls and security monitoring. You are responsible for keeping login details confidential and using secure authentication practices. 

11. Children 

The Services are not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn we have collected such data, we will delete it. 

12. Cookies and similar technologies 

12.1 What are cookies? 

Cookies are small text files placed on your device. Similar technologies (e.g., local storage and tags) may also be used. 

12.2 Cookie consent and categories 

We use a cookie consent banner. Analytics/experience cookies are strictly opt-in. If you do not consent, we do not set those cookies. 

We use: 

• Strictly necessary cookies (no consent required): required for core functionality such as authentication/session management, security, load balancing, and remembering cookie preferences. 

• Analytics/experience cookies (consent required): used to understand how the Services are used and to improve them (e.g., GA4 and Clarity, and any tags deployed via Tag Manager that fall into this category). 

12.3 Analytics tools we use (when you opt in) 

Google Analytics (GA4) commonly uses cookies such as: 

• _ga (typically 2 years) – distinguishes users 

• _ga_<container-id> (typically 2 years) – maintains session state 

We do not currently use Google Signals or Ads Features. If we enable advertising-related features in the future, we will update this Policy and cookie banner settings before activating them. 

Microsoft Clarity cookies may include: 

• _clck – stores a Clarity user ID and preferences 

• _clsk – links multiple page views into a single session 

Additional Microsoft-associated cookies may appear depending on configuration and browser context. 

12.4 Managing cookies 

You can manage cookies by using our cookie banner/preferences tool and/or changing your browser settings to block or delete cookies. If you disable cookies entirely, parts of the Website or App may not function as intended (especially login/session features). 

13. Changes to this Policy 

We may update this Policy from time to time. We will post the updated version with a revised Last updated date. If changes are material, we may provide additional notice (e.g., in-app notice or email).