Privacy Policy

KubeWatch, Inc. (“KubeWatch,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect information about you when you access or use the KubeWatch container observability platform (the “Service”). It also describes the rights you have over your data and how to exercise them.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, KubeWatch acts as a data controller for account and billing information and as a data processor for infrastructure telemetry submitted to the Service on your behalf. This policy reflects our obligations under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. What We Collect

Account and billing information

When you register for an account, we collect your name, work email address, company name, and password (stored as a salted hash). If you subscribe to a paid plan, our payment processor (Paystack) collects your payment card details directly. We receive only a tokenized card reference, the last four digits, card brand, and billing address.

Usage data

We automatically collect information about how you interact with the Service, including pages visited, features used, dashboard configurations saved, alert rules created, API requests made (endpoint, status code, response time), and error events. This data is linked to your account and used to improve the product and provide support.

Infrastructure metrics and telemetry

KubeWatch Agents installed inside your infrastructure collect and transmit container metrics (CPU, memory, network I/O, disk usage), Kubernetes events (pod scheduling, restarts, node conditions), container logs, and service topology maps. This data is processed entirely on your behalf and is not used for any purpose beyond operating and improving the Service for your account.

Credentials for services you connect

If you connect a cloud provider account (for cost tracking), a monitoring integration (e.g. a Postgres, Redis, or Jenkins instance), a webhook or VCS provider, a notification channel (e.g. Slack or PagerDuty), or your own AI provider API key, the credentials you supply are encrypted at rest and used solely to make the connection you configured work.

Cookies and similar technologies

We use the following categories of cookies and local storage on our website and dashboard:

• Strictly necessary cookies, a single session cookie required to authenticate your login and keep your dashboard account secure. It is set with the HttpOnly and SameSite=Lax attributes, so it can never be read from JavaScript and is not sent along with most cross-site requests. This cookie cannot be disabled.
• Analytics cookies, set by PostHog (our product analytics provider) on our public marketing website only (kubewatchlabs.com), never on the authenticated dashboard, which runs no analytics tracking at all. You can opt out at any time on our Cookie Preferences page.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service. Processing telemetry, rendering dashboards, evaluating alert rules, and delivering notifications are core functions that require us to store and compute over your Data.
• Account management. Creating and managing your account, authenticating logins, processing payments, and issuing invoices.
• Product improvement. Aggregated and anonymized usage data helps us prioritize features, identify performance bottlenecks, and improve reliability. We do not use identifiable infrastructure telemetry for this purpose.
• Transactional communications. We send email notifications about your account, such as password resets, invoice receipts, Subscription renewal reminders, planned maintenance notices, and security alerts. These emails are required for the Service and cannot be fully unsubscribed from while your account is active.
• Marketing communications. With your explicit opt-in consent, we may send product update emails and newsletters. You can withdraw consent at any time via the unsubscribe link in any marketing email or at app.kubewatchlabs.com/settings/notifications.
• Security and fraud prevention. We analyze log data and account activity to detect and respond to unauthorized access, abuse, or violations of our Terms of Service.
• Legal compliance. We may process or retain data as required by applicable law, court order, or lawful government request.

3. Data Retention

We retain different categories of data for different periods based on business necessity and legal requirements:

• Account data (name, email, billing records) is retained for as long as your account exists, including while suspended for a lapsed trial or an unrenewed Subscription — suspension keeps your data intact, it does not delete it. Invoices and payment records may be retained longer where needed to comply with tax and accounting regulations.
• Deletion on request. Cancelling your Subscription does not delete your account or data by itself. To permanently delete your account and all associated data, email [email protected] with the subject “Account deletion request”; we will confirm the deletion timeline with you directly. This is irreversible once carried out. You can self-export your account and configuration data at any time beforehand — see “Right to data portability” below.
• Infrastructure metrics and logs are retained according to the retention window you configure for your organization in Settings → Usage & Limits (30, 90, or 180 days, or no limit).
• Support communications are retained for as long as needed to maintain a history of issue resolution.

4. Third-Party Sharing

We do not sell, rent, or barter your personal data or infrastructure telemetry to any third party for advertising or commercial purposes. We share data only in the following limited circumstances:

• Infrastructure providers. The Service is hosted with reputable cloud infrastructure providers under a signed Data Processing Addendum. Specific hosting region(s) are available on request by contacting [email protected].
• Payment processing (Paystack). All payment card transactions are handled directly by Paystack. KubeWatch does not store full card numbers or CVVs. See Paystack's own privacy policy for details on how they handle payment data.
• Product analytics (PostHog). We use PostHog to understand how visitors interact with our public marketing website only. It is never loaded on the authenticated dashboard, and never receives infrastructure telemetry, container logs, or dashboard account data. You may opt out at any time on our Cookie Preferences page.
• Your own AI provider (AI DevOps Agent, bring-your-own-key). If you connect your own OpenAI, Anthropic, Azure, or compatible API key to use the optional AI DevOps Agent feature, the log or diagnostic content you choose to submit for analysis is sent to that third-party AI provider directly under your own account with them — this is a connection you configure and control, not one KubeWatch operates as a sub-processor of. Your API key is encrypted at rest and never logged or displayed back to you in full.
• Legal requirements. We may disclose your information if required to do so by law, subpoena, court order, or other governmental authority, or when we believe in good faith that such disclosure is necessary to protect our rights or the safety of users.

5. Your Rights

Depending on where you reside, you may have the following rights with respect to your personal data. Customers in the EEA, UK, and Switzerland have these rights under the GDPR and UK GDPR. Customers in California have analogous rights under the CCPA/CPRA.

• Right of access. You may request a copy of the personal data we hold about you, including account information and a log of API activity.
• Right to rectification. You may request that we correct inaccurate or incomplete personal data we hold about you. Many fields can be updated directly in your account settings.
• Right to erasure (“right to be forgotten”). You may request deletion of your personal data. We will fulfill this request within 30 days except where retention is required by law (e.g., financial records) or is necessary to resolve a dispute.
• Right to data portability. You may export your account data (users, agents, alert rules, notification channels, integrations, API key metadata, and audit log) in JSON or CSV format at any time from Settings → Usage & Limits in the dashboard, or by contacting us. Infrastructure metrics and logs are already accessible live from the dashboard and REST API.
• Right to restriction of processing. You may ask us to restrict processing of your personal data in certain circumstances, such as while a dispute about accuracy is being resolved.
• Right to object. You may object to processing of your personal data for direct marketing at any time. You may also object to processing based on our legitimate interests, and we will stop unless we have compelling grounds that override your interests.
• Right to withdraw consent. Where processing is based on your consent (e.g., marketing emails, analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us at [email protected]. We will respond within 30 days and may ask you to verify your identity before processing the request. If you believe we have not handled your request appropriately, you have the right to lodge a complaint with your local data protection authority.

6. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please reach out to our Privacy team:

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a prominent notice on the Service before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.