This Privacy and Cookie Policy explain how Elbah Group Limited (company number 15108393), trading as Sentinel (“Sentinel”, “we”, “us”), collects, uses, shares, and protects personal data when you use:
our marketing website (the “Website”); and
our web application (the “App”)
Together, the Website and App are the “Services”.
This Policy also explains how we use cookies and similar technologies and how you can control them.
Controller: Elbah Group Limited (company number 15108393) trading as Sentinel
Email: [email protected]
Address: 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE
This Policy covers personal data we process when you:
visit or interact with the Website,
create an account or use the App,
receive alerts or notifications (where you or an account owner has added you as a contact), and
contact us for support or sales.
It does not cover third-party websites, products, or services you access via links or integrations (those have their own policies).
Account and profile (App):
Name, email address
Login credentials (stored as hashed passwords)
Roles/permissions and team membership
Billing and subscription:
Billing name, billing email, company name (if provided)
Invoices, plan, payment status, transaction identifiers
Monitoring configuration (App):
Monitor configuration (e.g., endpoints/domains you choose to monitor, schedules, alert rules)
Notification settings and alert history/events
Notification contacts (App):
Email addresses and/or phone numbers you add for alerts
Messaging identifiers you configure (e.g., webhook metadata)
Support and communications (Website/App):
Messages you send to us (support requests, forms, emails) and related metadata
Technical and usage data (Website/App):
IP address, device/browser information
Access logs, security logs, timestamps, diagnostic and error logs
Interactions with pages/features (where analytics are enabled and you consent)
We use cookies and similar technologies on the Website and App as described in Section 11 (Cookies).
If you configure onsite monitoring, Sentinel may process agent token identifiers, device or host identifiers, operating-system and processor information, installed software, physical-drive information, CPU and memory utilisation, drive or partition utilisation, check-in timestamps, network metadata, and diagnostic data made available by the agent. Monitoring results, threshold breaches, incidents, risk assessments, reports, and exports may also be stored as part of the service history.
You are responsible for ensuring that the agent is installed lawfully, that you have authority to collect the information submitted to Sentinel, and that any required privacy information is provided to people whose personal data is included in monitoring or agent data.
We use personal data for the purposes below under the UK GDPR legal bases shown in brackets:
Provide and operate the Services (Contract): create and manage accounts; provide monitoring/alerting; administer subscriptions and settings.
Support and service communications (Contract / Legitimate interests): respond to enquiries; provide troubleshooting and important service messages.
Security, abuse prevention, and fraud detection (Legitimate interests / Legal obligation): protect accounts and infrastructure; investigate suspicious activity and prevent misuse.
Improve and develop the Services (Legitimate interests; for analytics cookies: Consent): analyse performance and reliability; improve user experience and documentation; analytics tools run only if you opt in via the cookie banner.
Legal compliance (Legal obligation): tax, accounting, legal requests, and compliance obligations.
Marketing (Consent or Legitimate interests depending on context): send marketing emails where permitted; you can opt out at any time via unsubscribe links or by contacting us.
We may share personal data with:
Service providers (processors/sub-processors) that help us operate and support the Services (e.g., hosting, email delivery, SMS/voice delivery, support tooling, analytics where enabled).
Payment processors to process subscriptions and payments.
Authorities, regulators, or other parties where required by law or necessary to protect rights, safety, and security.
A buyer or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards.
Below is a list of sub-processors used to provide the Services (as of the Last updated date). We may update this list from time to time.
If personal data is transferred outside the UK, we use appropriate safeguards (such as the UK IDTA or Addendum) and carry out transfer risk assessments where required.
We retain personal data only as long as needed for the purposes in this Policy:
Account data: while your account is active, plus 12 months after closure.
Billing records: 6 years.
Logs: at least 6 months.
Backups: rotated/overwritten every 7 days.
Deletion requests are handled subject to legal requirements and legitimate security/anti-fraud needs.
Depending on your circumstances, you may have rights to:
access your personal data
correct inaccurate data
request deletion
restrict or object to processing
data portability (where applicable), and
withdraw consent (where consent is the basis).
To exercise your rights, email [email protected]. We may need to verify your identity.
We use appropriate technical and organizational measures to protect personal data, including access controls and security monitoring. You are responsible for keeping login details confidential and using secure authentication practices.
The Services are not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn we have collected such data, we will delete it.
Cookies are small text files placed on your device. Similar technologies (e.g., local storage and tags) may also be used.
We use a cookie consent banner. Analytics/experience cookies are strictly opt-in. If you do not consent, we do not set those cookies.
We use:
Strictly necessary cookies (no consent required): required for core functionality such as authentication/session management, security, load balancing, and remembering cookie preferences.
Analytics/experience cookies (consent required): used to understand how the Services are used and to improve them (e.g., GA4 and Clarity, and any tags deployed via Tag Manager that fall into this category).
Google Analytics (GA4) commonly uses cookies such as:
_ga (typically 2 years) – distinguishes users
_ga_<container-id> (typically 2 years) – maintains session state
We do not currently use Google Signals or Ads Features. If we enable advertising-related features in the future, we will update this Policy and cookie banner settings before activating them.
Microsoft Clarity cookies may include:
_clck – stores a Clarity user ID and preferences
_clsk – links multiple page views into a single session
Additional Microsoft-associated cookies may appear depending on configuration and browser context.
You can manage cookies by using our cookie banner/preferences tool and/or changing your browser settings to block or delete cookies. If you disable cookies entirely, parts of the Website or App may not function as intended (especially login/session features).
We may update this Policy from time to time. We will post the updated version with a revised Last updated date. If changes are material, we may provide additional notice (e.g., in-app notice or email).
