Privacy Policy

Effective Date: September 30, 2026

Welcome to the Privacy Policy for Login AlertX. This policy explains how we collect, use, process, disclose, and protect your personal data when you visit our website at loginalertx.com (the “Website”), purchase our software through WooCommerce, or use the Login AlertX software for Windows and the Login AlertX – Companion mobile app (collectively, the “Software”). The Website and the Software are together the “Services”.

The Website and the Software handle data very differently, so this policy is organised in three parts:

• Part A – Website & Purchases: what we collect when you browse our site, buy a license, or contact us.
• Part B – The Software & Companion App: what stays on your device, and exactly what leaves it and where it goes.
• Part C – Your Rights & General Terms: security, retention, your rights, and how to reach us. This part applies to both.

Depending on your location, different privacy frameworks apply. For users in India, we process personal data in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (“GDPR”), and for California residents, the California Consumer Privacy Act (“CCPA”).

Under the DPDP Act, we act as the Data Fiduciary, you are the Data Principal, and the service providers that process data on our behalf (such as HubSpot, Google, Microsoft, and payment processors) act as Data Processors. Separately, when you enable a notification channel in the Software, the Software sends your alerts to that third-party service at your direction. Those services operate under their own privacy policies, listed in Section 6.

By using our Website or Software, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our services.

Part A – Website & Purchases

1. Consent and Lawful Basis

Under the DPDP Act, we process your personal data based on your free, specific, informed, unconditional, and unambiguous consent, indicated through a clear affirmative action (such as when you purchase our software, submit a contact form, or enable settings or notification channels in the Software). This Privacy Policy serves as the notice required under Section 6 of the DPDP Act, detailing the purposes and categories of data processed.

You have the right to withdraw your consent to data processing at any time (e.g., by unlinking your mobile app, disabling specific features or channels in the Software, or requesting account deletion). The withdrawal of consent will not affect the lawfulness of any processing carried out before your withdrawal, and may result in the termination of certain features or services.

2. Information We Collect on the Website

We collect and process personal data that is necessary, adequate, and relevant for the specified purposes of providing and improving our Website and Software (data minimisation).

2.1 Purchases (WooCommerce)

When you purchase a Software license through WooCommerce, we collect your full name, email address, billing address, phone number, and order details. Payment details (card numbers, UPI credentials, net banking information) are entered directly with our PCI-compliant payment gateways (Razorpay and PayPal) and are never stored or seen by us.

2.2 Support and Enquiries (HubSpot)

If you contact us via our contact forms, support tickets, or chat widgets, we use HubSpot as our CRM. We collect your name, email address, and any details or logs you voluntarily provide in your communication.

2.3 Analytics, Cookies and Site Performance

• Website Usage & Behavioral Analytics: Through Google Analytics and Microsoft Clarity, we collect data about your website interactions, including operating system, browser type, device details, IP address (anonymized), clickstreams, page views, and time spent on pages. This helps us understand visitor engagement and improve usability.
• CRM Tracking: We use HubSpot tracking cookies to identify user sessions and personalize support and marketing communications.
• Site Performance & Security (Jetpack): Our WordPress site uses Jetpack (by Automattic) for site security, performance, and basic visitor statistics. Jetpack may process technical data such as your IP address, browser details, and pages viewed.
• Cookies: We use cookies to enhance website function. These include essential cookies (WooCommerce shopping cart), performance cookies (Google Analytics, Microsoft Clarity), and functionality cookies (HubSpot). You can manage cookies via your browser settings or our cookie consent banner.

3. How We Use Website Information

• E-commerce & Licensing: To process transactions, deliver software license keys, manage subscription status, and handle billing via WooCommerce and payment gateways.
• Customer Support & CRM (HubSpot): To maintain user relations, address technical queries, manage accounts, and process feedback.
• Website Optimization: To analyze website performance, track conversion rates, diagnose bugs, and improve site layouts.
• Compliance: To comply with statutory tax laws, billing compliance, and legal authorities.

4. Website Service Providers

We do not sell, rent, or trade your personal data. For the Website and purchases, we use the following service providers, each of which processes data only for the services it performs for us. Each provider’s own privacy policy is linked below.

Legal Compliance: We may disclose personal data if required by a court of law, statutory authority, or government regulations, or to protect the legal rights, safety, and property of our company or our users.

Part B – The Software & Companion App

This part covers the Login AlertX Software only. It is separate from the Website data described in Part A. The Software is built privacy-first: it runs on your device, and most of what it handles never reaches us. This part explains what stays on your device, and, just as clearly, what leaves it and where it goes.

5. What Stays on Your Device

The following is stored and processed locally on your device and is never transmitted to us:

• Notification Configurations & Credentials: SMTP server details, sender email and password, Google OAuth credentials, and the bot tokens, webhook URLs, and API credentials you enter for other channels. These are stored locally and securely (using Windows Credentials Manager or local encryption). We do not receive or store them.
• Webcam, Screenshot and Audio Capture: If enabled, the Software captures webcam images, screenshots, or microphone audio upon login events and stores them in a local directory on your device. We do not collect, view, or store them. If you choose to attach them to alerts, they are sent to the channel you configured (see Section 6.3), not to us.
• Event History & System Logs: Operational logs and the history of detected events are stored locally on your device (logs in %AppData%\LoginAlertX). They are not shared with us unless you choose to send them to us for support. You can manage local retention and clean up stored data from within the Software.
• Companion App Pairing Data: Pairing tokens and preferences are stored in your phone’s secure, encrypted storage. The Companion app does not access your phone’s camera, microphone, or location.

6. What Leaves Your Device

6.1 At a Glance

Everything not listed above, including your SMTP and channel credentials, webcam/audio/screenshot files, event history, and logs, stays on your device.

6.2 Data Sent to Us

• License validation: For license activation, premium validation, and piracy prevention, the Software transmits your license key, registered email address, and your machine name/hardware fingerprint (a unique identifier of your device) to our secure validation server at loginalertx.com.
• Companion app pairing: When you pair the Companion app using your licensed email, we store your app’s push token (an identifier issued by FCM) linked to your license, so that alerts can be delivered to your phone. Unlinking the app removes it.

6.3 Third-Party Services the Software Contacts

To deliver alerts and enrich them with location, the Software contacts third-party services. These are independent services with their own privacy policies, separate from this one. Please review them if you enable the related feature.

• Push alerts (Firebase Cloud Messaging, Google): If you pair the Companion app, alert text containing the event details (e.g., action type, timestamp, IP address) is sent to your mobile device via FCM over HTTPS/TLS. FCM is operated by Google, which processes this message to deliver it. We do not keep alert notification histories on our servers once they have been delivered to FCM. Firebase Privacy & Security
• WhatsApp alerts (Twilio and WhatsApp): If you enable WhatsApp alerts, your recipient phone number and the alert text are transmitted to Twilio, our messaging provider, which delivers the message through WhatsApp (operated by Meta). We do not keep a copy of WhatsApp alert content after delivery. WhatsApp alerts contain text only. Providers process this data under their own policies: Twilio Privacy Notice and WhatsApp Privacy Policy.
• Other channels (Telegram, Slack, Microsoft Teams, Google Chat, Discord, Email): If you enable these, the Software sends alerts directly from your device to that service using the credentials you supplied. We do not receive these alerts. Depending on your settings, alerts may include webcam images, screenshots, audio, and location details, which are then held by that service under its own policy. You control which channels and attachments are enabled.
• Location (ip-api.com): To enrich security alerts, the Software fetches your approximate location (city, region, country) from ip-api.com based on your public IP address. This request goes directly from your device to the provider. The result is processed locally and included in your alerts, but is not sent to or stored by our servers. See the ip-api.com privacy policy. If your device supports it and you enable it, more precise location from your device hardware may also be included in alerts sent to the channels you configure.

6.4 Your Control

• Every notification channel, including push and WhatsApp, is optional and off until you set it up. You can disable any channel, unlink the Companion app, or remove a recipient at any time from within the Software.
• If you prefer that alerts pass through as few third parties as possible, you can use only email through your own SMTP server or your own Google account.
• Alerts sent through push or messaging services are subject to those services’ handling once delivered to them; we cannot control their retention.

Part C – Your Rights & General Terms

7. Data Storage and Security

• Website & Cloud Storage: Personal data related to orders, licenses, and CRM entries is stored on secure databases hosted on our servers and on the secure cloud platforms of WooCommerce and HubSpot, protected by industry-standard encryption, firewalls, and strict access controls.
• Local Software Storage: Local configurations, credentials, webcam photos, audio recordings, screenshots, event history, and logs reside on your device, protected by the device’s system security.
• Mobile Companion App: Pairing credentials and preferences are encrypted within the Android/iOS secure storage directory.
• Security Standards: We implement HTTPS/TLS encryption for all data in transit. While we strive to employ best-in-class administrative, organizational, and physical security measures, no system is 100% secure, and we cannot guarantee absolute security.

8. Data Retention and Erasure

We retain personal data only for as long as necessary to fulfill the purposes of processing, or as required by applicable tax, accounting, and legal requirements.

• Order and Financial Data: Retained for the duration of the software subscription and as mandated by financial regulations (typically 7 years).
• HubSpot CRM Records: Retained as long as you maintain an active account or communication channel with us.
• License Keys and Device Identifiers: Retained until the license expires or is terminated.
• Companion App Push Token: Retained until you unlink the app or your license ends.
• Local Device Data: Retained locally on your machine. Temporary files (captured images, audio) are deleted by the Software after notification dispatch, and you can configure retention for other local data in the Software. Remaining data is removed upon software uninstallation.
• Third-Party Services: Data held by services you use to receive alerts (such as Google, Twilio/WhatsApp, Telegram, or Slack) is retained under their own policies.

Upon expiration of the retention period or receipt of a valid erasure request, we will securely delete or anonymize the personal data we hold, unless retention is legally mandated.

9. Rights of the Data Principal (Under the DPDP Act)

If you are a user in India, the DPDP Act grants you the following statutory rights regarding your personal data:

• Right to Access: Obtain a summary of the personal data we process about you, the purposes of processing, and the identities of third parties with whom your data has been shared.
• Right to Correction, Completion, and Erasure: Request correction of inaccurate data, completion of incomplete records, or erasure of data that is no longer necessary for the purpose of collection (unless legal retention is required).
• Right to Withdraw Consent: Withdraw your consent to data processing at any time.
• Right to Nominate: Nominate another individual to exercise your rights on your behalf in the event of death or physical/mental incapacity.
• Right to Grievance Redressal: Raise questions, concerns, or grievances regarding our data practices with our Grievance Officer.

10. Duties of the Data Principal

Under the DPDP Act (Section 15), Data Principals are obligated to comply with the following duties when submitting information or exercising rights:

• You must not impersonate another individual when providing personal data.
• You must not suppress or misrepresent material facts when providing personal data or filing requests.
• You must not register false or frivolous grievances or complaints.

11. Grievance Redressal Mechanism

If you have questions, concerns, or wish to exercise your rights as a Data Principal under the DPDP Act, you may contact our designated Grievance Officer:

Email: [email protected]
Response Timeline: We will acknowledge receipt of your grievance within 48 hours and attempt to resolve it within the statutory period of 30 days (or as prescribed under the DPDP Act rules).

If you are not satisfied with the resolution provided by our Grievance Officer, you have the right to file a complaint with the Data Protection Board of India (DPBI) in the prescribed manner.

12. Data Breach Management

We take security breaches seriously. In the event of a personal data breach impacting your information, we will notify the Data Protection Board of India (DPBI) and the affected Data Principals (users) in accordance with the procedures, guidelines, and timelines mandated under the DPDP Act.

13. Children’s Privacy

Our Services are not intended for individuals under 18 years of age. Under the DPDP Act, processing of children’s data (minors under 18) requires verifiable consent of a parent or guardian. We do not knowingly collect personal data from minors, nor do we perform behavioral tracking or targeted advertising directed at children. If we discover we have inadvertently collected data of a minor without parental consent, we will delete it immediately.

14. International Data Transfers

Our primary servers are hosted in the United States. Several of the providers named in this policy, including Google, Twilio, and Meta (WhatsApp), also operate internationally, principally in the United States. If you are accessing our Services from outside the United States (including India), your personal data may be transferred across borders. We ensure that all such cross-border transfers comply with the provisions of the DPDP Act and other relevant global data transfer mechanisms, ensuring your data is protected under equivalent security standards.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our software, website, or legal compliance mandates. When updates are published, we will revise the “Effective Date” at the top of the policy. We encourage you to review this document periodically.

16. Contact Us

For general support, licensing help, or questions about this policy (unrelated to formal grievances), please contact us at:

• Email: [email protected]
• Website: loginalertx.com

When contacting us, please include relevant context (e.g., license serial key, order details) to assist with your request. For Software troubleshooting, you may attach operational logs from your local %AppData%\LoginAlertX directory.