Privacy Policy

Last updated: October 10, 2026

This policy explains what personal information Cinnamons Consulting Services, LLC ("we", "us") collects through our websites and through ORDSwatch, HTTPDwatch and NGINXwatch (the "Services"), why, and what you can do about it. It covers both the hosted edition (which we run for you) and the self-hosted edition (which you install on your own servers).

Who we are

Cinnamons Consulting Services, LLC is the company behind the Services. For any privacy question or request, write to privacy@cinnamonsservices.com.

What we collect

When you visit our websites

Usage statistics. We count page views with Umami, analytics software that runs on our own server. It sets no cookies, does not build profiles and does not follow you across sites. It records the page, the referring site, browser and device type, and an approximate country derived from your IP address; the IP address itself is not stored. You can switch it off with "Opt out of analytics" in the cookie notice (or "Cookie settings" at the bottom of every page).
Server logs. Like every web server, ours log requests (IP address, time, page, browser) for security and troubleshooting. These logs are kept for a limited time and are not used for marketing.
Fonts. Our product websites load the Inter typeface from Google Fonts, so your browser connects to Google when you open them. Google receives your IP address as part of that request.

When you use the hosted edition

Account details: name, email address, company, and the sign-in method you choose. Passwords are stored only as salted hashes.
Organization data: your plan, users and roles, invitations, and settings such as alert rules and sign-in configuration. Secrets you enter (for example an LDAP bind password or an identity-provider client secret) are encrypted at rest.
Monitoring data sent by your agents: health and status of the servers you monitor, response times, configuration you choose to manage, log lines, traffic counts and error summaries. Log files stay on your servers: log lines are sent only when you view them live or in the log viewer, and the traffic and error summaries are built on your server with client IP addresses removed.
History: uptime, traffic and error statistics are kept for the period your plan includes (7 days on Starter, 30 on Professional, 90 on Enterprise) and then deleted automatically.
Support tickets you open, with any diagnostic information you choose to attach.
Billing: payments are handled by Stripe. We never see or store your full card number; we keep your Stripe customer and subscription references and your billing history.

When you use the self-hosted edition

The self-hosted edition runs entirely on your servers and your monitoring data never reaches us. To check your license, your installation contacts our license server with the license key, a random installation ID, the server's host name and the product version. If you register for a free license we also keep the name, email address and company you give us, and the IP address the request came from, to issue the key and prevent abuse. Support tickets opened from a self-hosted installation are relayed through our license server to our help desk.

Why we use it

To provide, secure and support the Services and your account.
To process payments and send transactional email (sign-up confirmation, invitations, password resets, alerts you configure, billing notices).
To prevent fraud and abuse, and to meet legal and accounting obligations.
To understand, in aggregate, how our websites are used so we can improve them.

We do not sell your personal information, and we do not use it for advertising.

Only with service providers that help us run the Services, under contracts that limit their use of it:

Stripe — payments and invoicing.
Resend — delivery of transactional email.
Our hosting provider — the servers the Services and websites run on, located in the United States.
Google — font delivery on our product websites (see above).

If you connect your own Duo, LDAP, SAML or OIDC provider, sign-ins go through that provider under your own agreement with it. We may also disclose information when the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply.

Cookies

Our websites set no cookies of their own; the choice you make in the cookie notice is stored in your browser's local storage, not in a cookie. The hosted applications use a strictly necessary session cookie to keep you signed in; it is removed when you sign out or it expires. We do not use advertising or cross-site tracking cookies.

How long we keep it

Account and organization data are kept while your account is active and deleted after you close it, except where we must keep records longer for legal, tax or accounting reasons. Monitoring history follows your plan's retention period. Free-license registrations are kept while the license is in use.

Security

Connections to the Services use HTTPS. Agents must authenticate before they can send data, each organization's data is kept separate, secrets are encrypted at rest, and access to production systems is restricted. No system is perfectly secure; if a breach affects your personal information we will notify you as the law requires.

Your choices and rights

You can view and change most of your information in the application. You can also ask us to give you a copy of your personal information, correct it, delete it, or stop a particular use of it, by writing to privacy@cinnamonsservices.com. Depending on where you live (for example California, or the European Economic Area and the United Kingdom) you may have additional rights under local law, including the right to complain to your data-protection authority. We will not discriminate against you for using these rights.

Children

The Services are for businesses and are not directed to children under 16. We do not knowingly collect their personal information.

International transfers

We are based in, and our servers are located in, the United States. If you use the Services from elsewhere, your information is transferred to and processed in the United States.

Changes

We will post any change to this policy on this page and update the date at the top. If a change is significant, we will also tell account owners by email before it takes effect.

Contact

Cinnamons Consulting Services, LLC — privacy@cinnamonsservices.com