Privacy Policy

1. Information We Collect

Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, sign-in credentials, and organization details. We receive your account identifiers and profile information from Clerk; we never see or store your password.

Billing information. Paid plans are processed by Stripe. Stripe collects and stores your payment-card details directly — we never receive or store full card numbers. We retain your Stripe customer and subscription identifiers, your plan, and your billing status.

Service data. To provide monitoring, we store the configuration you create — the URLs, hostnames, IP addresses, ports, and settings of the monitors you set up; the servers you register; and the metrics your agent reports (CPU, memory, disk, network, load, and systemd service names). We store the results and history of these checks.

Communications data. The notification destinations you configure, such as email addresses, chat webhook URLs, and bot tokens. Credentials of this kind are encrypted at rest.

Mobile phone numbers. If you opt in to SMS or text-message alerts, we collect the mobile phone number you provide and a record of your opt-in (timestamp and the action that opted you in). We use this information solely to deliver the alerts you have configured and to honor opt-out and HELP requests.

Mobile app data. The Ensju companion app for Android and iOS uses the same account as the web. It stores only the session token issued by Clerk, kept in the platform's encrypted secure store (iOS Keychain / Android EncryptedSharedPreferences). The app does not collect device advertising identifiers, does not include analytics or crash-reporting SDKs, does not request location, contacts, photos, microphone, or camera permissions, and does not track you across apps or websites.

Usage and technical data. Logs of requests to the Service — including IP address, browser type, timestamps, and actions taken — used for security, debugging, and abuse prevention.

Website and product analytics. For usage analytics we run a privacy-friendly tool (Umami) that we self-host on our own infrastructure — no third-party analytics company is involved in it. It records only aggregate, non-identifying usage such as page views, referring site, approximate region, and browser type; it sets no advertising or cross-site tracking cookies, builds no individual advertising profile, and is not present in our mobile app.

Marketing-site visitor identification. On our public marketing pages only — not the signed-in app, and not the mobile app — we also use a third-party service, Leadsy (vtag.ai), that helps us recognize the businesses that visit ensju.com so we can follow up with prospective customers. It may receive your IP address and on-page activity and may set its own cookies.

2. How We Use Your Information

We use the information we collect to:

• operate, maintain, and secure the Service;
• run your monitors and deliver the alerts you have configured;
• process payments and manage your subscription;
• provide customer support;
• detect, prevent, and respond to abuse, fraud, and security incidents;
• send service, security, and account notices;
• comply with legal obligations; and
• understand usage so we can improve the Service.

3. We Do Not Sell Your Data

We have never sold, rented, or traded your personal information or your service data, and we never will. We do not share it with advertisers or data brokers, and we do not use it for advertising or profiling. 17 Solutions is funded by subscriptions — not by your data.

Mobile phone numbers and opt-in data are never shared with third parties or affiliates for marketing or promotional purposes. We share this information only with the carrier and messaging-platform sub-processors needed to deliver the messages you asked for.

4. SMS / Text Message Notifications

We send SMS or text-message alerts only to users who have explicitly opted in by adding a mobile phone number to a notification channel in their account and confirming consent. You may opt out at any time by replying STOP to any message you receive from us; replying HELP returns help instructions and our support contact.

Message frequency varies based on the monitors and alerts you configure — some accounts will receive no SMS messages for weeks, others will receive several during an incident. Message and data rates may apply depending on your mobile carrier and plan.

We use SMTP2GO to deliver SMS messages. SMTP2GO handles your phone number and message content only as our sub-processor under contract, and is bound by the same restriction: your mobile information is not used for marketing or shared with affiliates or third parties for promotional purposes.

We do not sell or rent mobile phone numbers, opt-in records, or message content to anyone, for any purpose.

5. Newsletter and Marketing Email

If you subscribe to our newsletter or request a resource such as a guide, we add the email address you provide to our marketing list, which is managed for us by MailerLite as a sub-processor. These messages are separate from the service, security, and alert emails tied to your account.

Every marketing email includes an unsubscribe link and you can opt out at any time. We never add you to marketing email without an action on your part, and if you never subscribe we never send you marketing email. This mailing list is unrelated to the Ensju mobile app, which sends no marketing.

6. How We Share Information

We share information only with the service providers ("sub-processors") that help us operate the Service, each bound by contract to protect it and to use it only on our instructions. They fall into a few categories:

• Authentication and billing — to sign you in and process payments;
• Infrastructure and hosting — to run the application, database, and probe network;
• Communications — to deliver the email, SMS, and newsletter messages you configure or request;
• Observability — to manage operational logs (with personal data such as IP and email addresses redacted before they are shipped);
• Mobile app updates — to deliver over-the-air updates to our mobile companion app.

The complete, current list of our sub-processors — naming each provider, what it does, the data it receives, and its location — is maintained at ensju.com/legal/subprocessors. We update that page whenever we add, remove, or replace a sub-processor.

Some supporting tools are self-hosted by 17 Solutions on our own infrastructure rather than run by an outside vendor — our website analytics (Umami) and the anti-abuse CAPTCHA on our public forms (mCaptcha). The data they process stays on our systems and is not shared with a third-party analytics or CAPTCHA provider.

We may also disclose information when required by law, to enforce our agreements, or to protect the rights, property, or safety of our users or the public. If 17 Solutions is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction; we will notify you, and any successor will remain bound by this Policy.

7. Data Retention

We retain account and billing records for as long as your account is active and for a reasonable period afterward to meet legal, tax, and accounting requirements. Monitoring history is retained according to your plan's retention window. Encrypted backups are kept on a rolling schedule. When you delete your account or ask us to delete your data, we remove your personal information and service data within 30 days, except where longer retention is legally required.

8. Data Security

We protect your information with industry-standard safeguards, including: encryption of all network traffic in transit (TLS); encryption of stored notification credentials with AES-256-GCM; hashing of agent enrollment tokens; access controls and least-privilege practices; and routine patching and security review. No method of transmission or storage is ever completely secure, and while we work hard to protect your information we cannot guarantee absolute security.

9. Mobile App

The Ensju mobile companion app (Android and iOS) is a view-only client for the same account you use on the web. It signs you in with Clerk and reads from the same API.

What we store on your device. Only the Clerk session token, in the operating system's encrypted secure store (iOS Keychain with the WHEN_UNLOCKED_THIS_DEVICE_ONLY accessibility class, which keeps it on this device and out of iCloud Keychain replication; Android EncryptedSharedPreferences, excluded from Android Auto Backup). Signing out, deleting your account, or uninstalling the app removes the token.

What we do NOT collect. No device advertising identifiers (Apple IDFA / Google AAID), no precise or coarse location, no contacts, photos, microphone, or camera access, no clipboard reads. There are no third-party analytics, attribution, or crash-reporting SDKs in the mobile app, and we do not track you across other apps or websites.

Permissions. The app requests only the network permission needed to talk to the Ensju API.

Over-the-air updates. When the app launches it checks our update service (Expo Application Services / EAS Update) for a newer JavaScript bundle. That request necessarily discloses your device's IP address, platform, and app version to the update service so it can deliver the correct update; the data is used only to serve app updates — not to profile, advertise to, or track you. EAS Update delivers code: it is not an analytics, attribution, or crash-reporting SDK, so the statement above still holds.

Notifications. Push notifications are not enabled in the current version of the mobile app. If push is added in a future release, this Policy will be updated and an explicit opt-in will appear in the app's settings.

10. Cookies

Inside the Service (the signed-in app) we use only the cookies necessary to operate it — principally the session cookies set by our authentication provider to keep you signed in — with no advertising cookies, third-party ad-network trackers, or cross-site tracking. Our public marketing pages additionally load a third-party visitor-identification script (Leadsy, described under “Information We Collect”) that may set its own cookies; it is not present in the signed-in app or the mobile app.

11. Your Rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal information, and to object to certain processing. You can update much of your information directly in the app, or exercise any of these rights by emailing privacy@ensju.com. We will respond within the timeframe required by applicable law, and we will not discriminate against you for exercising your rights.

Account deletion. You can delete your Ensju account at any time from the in-app Settings page (web: Settings → Danger zone; mobile companion: Settings → Account management → Delete account). Deletion is self-serve, immediate, and irreversible: active subscriptions are cancelled, any organizations where you are the only member are deleted together with their monitors, servers, channels, status pages, incidents, and subscribers, and your sign-in is removed. We send a confirmation email to your address on file. We retain billing records only to the extent required by tax and accounting law.

12. International Users

The Service is operated from the United States, and your information is processed there. If you access the Service from outside the United States, you consent to that processing.

13. Children

The Service is not directed to children and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. We will post the revised version with a new "Last updated" date and, for material changes, notify you by email or in the app.

15. Contact Us

Questions or requests: privacy@ensju.com, or 17 Solutions LLC, 361 Falls Rd. #663, Grafton, WI 53024, United States.