Privacy policy

Who we are

AlertMyBusiness is operated by the business named in the footer of this site, registered in Australia. We are the controller of personal information collected through this service. Contact details are on the Contact page; privacy questions go to the same address with Privacy in the subject line.

What we collect and why

• Account details: your name and email address, provided by the site you signed in through, so we can send you alerts and let you sign in.
• Business profile: business name, country, registration number, industry, size bands, how you operate, pay cycle and alert preferences, so alerts match your business.
• Locations: addresses you enter and the coordinates we geocode from them, so we can match power outages and local notices.
• Websites and domains: addresses you ask us to watch, and the results of our checks and scans of them.
• Tools and suppliers: the services you tell us you use, and supplier registration numbers you add.
• Staff email addresses for breach monitoring, only when a verified domain owner adds them with the consent box ticked. They are stored encrypted with a hash for lookup, and deleted instantly when removed.
• Team members: names and emails of people you invite, so they receive alerts.
• Notification channels: phone numbers for SMS, push subscriptions, Slack, Teams and webhook addresses.
• Usage records: alert history, acknowledgements, delivery attempts and audit entries, because a reliable log is part of the service.
• Technical records: server logs with request paths and timing. IP addresses are not stored; for abuse prevention we keep a one-way hash salted daily.

Public pages and the breach check tool

Public pages need no account. The free breach check sends the email address you type to Have I Been Pwned and shows the result. We do not store or log the address; we count only how many checks ran.

User reports (I am having problems with this service) store the vendor, the problem type, your country or state and a daily-salted hash for rate limiting. No IP address is stored.

Lawful bases (GDPR and UK GDPR)

• Performance of a contract: providing the alerts and account you asked for.
• Consent: marketing-style emails (digests, reports, tips), staff email breach monitoring, and SMS. You can withdraw consent at any time in Notifications.
• Legitimate interests: security, fraud prevention, measuring which public pages are read, and improving the accuracy of alerts, balanced against your interests.
• Legal obligation: keeping records required by tax and consumer law.

Who processes your data

We use these providers, each under a contract that limits what they may do with the data:

• Stripe (payments; card numbers never touch our servers)
• Twilio (SMS delivery)
• The site's email provider (transactional and digest email)
• Anthropic (plain-English summaries of public incident, vulnerability and scam text; no personal data is sent)
• Google (Maps geocoding of business addresses; Safe Browsing checks of website addresses)
• Cloudflare (network security, inbound status email routing)
• Vultr (servers in Sydney and a second region for uptime checks)

Data may be processed in Australia, the United States and the European Union. Transfers out of the EU and UK rely on standard contractual clauses or the provider's adequacy decision.

Advertising and cookies

Public pages show advertising through Google AdSense. In the EEA, UK and Switzerland you are asked for consent before any advertising cookie is set; without consent you see non-personalised ads. Signed-in paying members see no advertising inside the app. Details are in the Cookie policy.

How long we keep it

• Account and profile: until you delete your account, then hard-deleted within 30 days (anonymised aggregates may be kept).
• Alert history: 90 days on the free plan, 2 years on paid plans, 7 years with the Compliance Evidence Log add-on, then deleted.
• Check and scan results: 13 months, so monthly reports can compare against a year ago.
• Staff emails for breach monitoring: until you remove them or delete the account.
• Enquiries: 2 years.
• Server logs: 30 days.

Your rights

You can see, export (JSON and CSV), correct and delete your data from Settings without asking us. You can also ask us to do any of that, to restrict processing, or to object to processing based on legitimate interests, by contacting us. We answer within 30 days.

Australia: you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). EU and UK: you may complain to your local supervisory authority or the ICO (ico.org.uk). California (CCPA/CPRA): you have the right to know, delete and correct, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising except through the advertising consent described above.

Security

Secrets and staff emails are encrypted at rest with AES-256-GCM, all traffic uses TLS, staff access is limited and logged, and every admin action is in an append-only audit log. Full detail is on the Security page. If a breach affecting you occurs, we notify you and the relevant regulator as the law requires.

Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children.

Changes

We update this policy when the service changes and show the date at the bottom of the page. Material changes are announced by email to account holders. Last updated 2026-10-26.