Privacy Policy

Version 2026-08-28 · Last updated: August 28, 2026

This Privacy Policy describes how ChangeEagle (operated from Sweden) ("we", "us", "our") processes personal data when you use ChangeEagle (the "Service"). We act as the data controller for processing described here, unless stated otherwise.

1. Data we collect

We collect the following categories of data when you use the Service:

• Account data — email address, salted password hash (we never store your plain-text password), account role and plan, timezone, and a coarse country guess derived from browser language settings at signup.
• Monitor configuration — URLs you submit, monitor names, condition types and parameters, check frequency, quiet-hour settings, alert email addresses, and pause/active status.
• Operational and security data — session identifiers, hashed client identifiers for audit and rate limiting, user agent strings, and records of sensitive account actions (such as login, monitor changes, and policy acceptance).
• Billing data — if paid plans are offered, payment-related identifiers and subscription status as provided by our payment processor. We do not store full payment card numbers on our servers.

We do not use third-party advertising trackers or behavioral analytics platforms for cross-site profiling.

2. Monitored URLs and extracted content

When you create a monitor, we store the URL and settings you provide. On each check we fetch the public page, extract relevant content — such as visible text, prices, availability signals, and structural hints — and store check results needed to run the Service and show you history.

• We store extracted values and short descriptions of changes, not full page HTML, in normal operation. Diagnostic metadata may include error categories, HTTP status, and truncated snippets where needed to troubleshoot failures.
• You choose which URLs to monitor. You are responsible for ensuring you have a lawful basis to monitor that content and that doing so does not infringe third-party rights.
• We do not intentionally collect credentials, payment card data, or other sensitive categories from monitored pages. Do not configure monitors for pages that require authentication you are not authorized to use.

3. AI provider processing

Where AI-assisted extraction or condition evaluation is enabled for a monitor, we send relevant page text and context to our AI provider (currently OpenAI, listed in section 5) solely to classify, summarize, or evaluate whether your condition is met. We do not use your data to train AI models, and our AI provider processes it only to answer that request.

• Submissions are limited by size caps, daily budgets, and technical safeguards.
• We do not send your account password or session tokens to AI providers.
• Provider processing is governed by their terms and privacy practices in addition to ours.
• AI output may be cached briefly to reduce duplicate calls for unchanged page content.

4. Email provider processing

When a monitor condition is met, we send alert emails to addresses you configure using an email delivery provider. The provider processes recipient addresses, message content, and delivery metadata on our behalf to transmit notifications.

Alert emails contain monitor names, monitored URLs, condition summaries, and links back to the Service. Do not add third-party email addresses without their consent.

5. Who else processes your data

We use the following providers to run the Service. Each processes only what it needs for its role, on our instructions.

If we change or add a provider, we update this list. Monitors with AI features turned off send nothing to the AI provider.

6. Cookies and sessions

We use a strictly necessary session cookie to keep you signed in after authentication. The cookie contains a random session token, not your password. Sessions expire after a defined period or when you log out.

We may store a local preference for cookie consent where applicable. For more detail, see our Cookie Policy.

7. Retention

We retain data only as long as needed for the purposes described in this policy:

• Account and monitor data — retained while your account is active and until you delete a monitor or request account deletion.
• Check history and alerts — retained with the parent monitor and removed when the monitor or account is deleted, subject to backup cycles.
• Sessions — expire automatically or are revoked at logout and account suspension.
• Legal acceptance records — retained to demonstrate which policy version you accepted and when.
• Audit and security logs — retained for a limited period appropriate to security, abuse investigation, and operational needs.

8. Deletion

You may delete individual monitors from your dashboard. You may delete your account and associated personal data yourself at any time under Settings → Account & plan, or by contacting support@changeeagle.com from your registered email address.

Upon verified deletion, we will remove or anonymize personal data within a reasonable period, except where retention is required for legal obligations, dispute resolution, fraud prevention, or enforcement of our terms. Backups may persist for a limited time before being overwritten.

9. Security

We implement technical and organizational measures designed to protect personal data, including hashed passwords, HTTP-only session cookies, access controls, and rate limiting. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Audit logs store hashed client identifiers rather than raw IP addresses. We avoid storing full page HTML, AI prompts, or other highly sensitive content in audit records.

10. International transfers

We and our subprocessors may process data in countries other than your own, including where our infrastructure, email, or AI providers operate. Where required by applicable law, we aim to use appropriate safeguards — such as standard contractual clauses or equivalent mechanisms — for cross-border transfers.

The availability of specific safeguards depends on your jurisdiction and the providers we use at the time of processing.

11. Your rights

Depending on where you live and applicable law, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to receive a portable copy. You may also withdraw consent where processing is consent-based, without affecting the lawfulness of prior processing.

To exercise these rights, contact support@changeeagle.com from your account email. We may need to verify your identity before responding. We will respond within a reasonable period as required by applicable law.

You may lodge a complaint with a data protection or privacy authority in your jurisdiction if you believe our processing violates applicable law.

12. Contact

Privacy questions and data subject requests: support@changeeagle.com.

For terms of use, see our Terms of Service. For acceptable monitoring practices, see our Fair Use Policy.