Privacy Policy

Who we are

Heimdall is operated by Warewave Teknoloji Sanayi ve Ticaret Limited Şirketi, Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul, Türkiye. For people in Türkiye, the KVKK Privacy Notice gives the details required by Turkish law; this policy summarises how we handle data for everyone.

What we collect

Account data: name, e-mail, password (stored only as a salted hash), language and time zone.

The phone number a user adds to their own profile. A number receives nothing but a single confirmation link until its holder accepts; it is stored encrypted and shown masked everywhere.

Service data your organisation puts into Heimdall: monitored URLs and hosts, check results, incidents, status pages, on-call rules and status-page subscribers. For this data we act on behalf of your organisation.

Billing data: plan, add-ons, SMS and call usage, invoice details and invoices. Card details are handled by our payment provider and never reach us.

Technical data: IP address, sign-in and security logs, kept for a short time.

How we use it

To run the service: check your monitors, open incidents and alert the right people by e-mail, chat, SMS and calls.

To confirm with the owner of a phone number that they want alerts, and to honour STOP requests.

To bill you, keep the service secure and meet legal obligations.

We do not sell personal data and we do not send marketing by SMS.

Sharing

Mobile operators carry our SMS and calls. The service runs in Huawei Cloud's data centres in Istanbul, Türkiye. Backups of the database are encrypted by us and then kept with Amazon Web Services in Stockholm, Sweden; public status pages are delivered through Amazon CloudFront. E-mails are sent through Google Workspace, so your name, your e-mail address and the content of the e-mail are processed by Google, also outside Türkiye. Payments are processed by iyzico (Türkiye). These providers process data for us under contract. Authorities receive data only when the law requires it.

Cookies

We use one strictly necessary cookie: the session cookie that keeps you signed in. No analytics or advertising cookies, and nothing from third parties. The Cookie Policy has the details.

Retention

We keep data only as long as needed: for example SMS bodies 90 days, raw check results 30 days, a removed phone number 30 days. Some records (invoices, consent records) are kept longer where the law requires.

Your rights

You can download your data and delete your account from your profile, and stop SMS and calls by replying STOP. For anything else, write to contact@warewave.tech; we answer within 30 days.

Changes

When this policy changes we update the version and date above and, for material changes, notify you by e-mail.