Privacy Policy

At Script Monitoring, Inc. ("Script Monitoring", "we") we respect your privacy. This policy covers what we collect when you use the platform, what our tag does and does not record on your payment pages, how we use it all, and the rights you have.

Most privacy policies describe one relationship. Ours describes two, and the distinction decides who you should ask about what.

For your account, we are the controller. The name, email, company and billing details you give us when you sign up are ours to explain, and this policy explains them.

For what the tag observes on your pages, we are a processor acting on your instructions. You decide which pages carry the tag and which of them are payment pages. We monitor what you point us at, and handle that data only to provide the service to you. A Data Processing Agreement is available on request at [email protected]. If one of your customers asks what a script did during their checkout, that request goes to you, and we support you in answering it.

We ask for only what the service needs. Three categories:

Account information. Name, email address, company name, and password. If you are on a paid plan, billing details are handled by our payment processor, Stripe. Card details go directly to Stripe; we never receive or store your full card number.

Script telemetry from your pages. This is the product. For each page view in scope, the tag records which scripts executed, their origin and payload hash, what they touched in the DOM, and where they sent data. It also records the response headers we monitor for change, and the load chain showing which script pulled in which other script.

Usage data. Session duration, device, browser, IP address and error logs for the dashboard: data about you using our application, not about visitors to your site.

Website analytics. When you visit scriptmonitoring.com we use analytics to understand how the site is used: pages viewed, clicks, referrer, device, browser and approximate location.

Page-view counts. Page views are the only metered unit on every plan, so we count them per site in order to bill accurately and to enforce plan limits.

This is the section worth reading twice, because our tag runs on payment pages.

The subject of monitoring is the script, not the person. The tag records what scripts did. It does not store user-entered values: not card numbers, not CVVs, not passwords, not form contents of any kind.

The point of the product is noticing when a script reads a card field. Reading that field ourselves would make us part of the problem we detect. It would also drag your cardholder data environment across our boundary, which is the opposite of what a PCI DSS 6.4.3 and 11.6.1 control is for.

The tag is also fail-open. If our service is unreachable your page renders and your checkout completes normally. We are a monitoring dependency, never an availability dependency, and never a party to the transaction.

We use your data to run the service, keep it secure, and improve the product.

We do not sell your data, and we do not use your script telemetry for advertising.

We don't sell your data. We share it only with infrastructure providers, such as Amazon Web Services for hosting, Stripe for payments and an analytics provider for our website, and only as far as they need to provide their service to us.

Your data is stored and processed on Amazon Web Services servers in the United States.

We keep account data for as long as your account is active. If you close your account, your data is permanently deleted within 30 days and removed from backups within 90 days.

Under GDPR and comparable laws you have the rights below. You can exercise them from the dashboard or by writing to [email protected].

If you are a visitor to a site that uses our tag, we are a processor for that data and the site operator is your first point of contact. Tell us who they are and we will help route your request.

We use cookies on our dashboard for session management and basic analytics, and our website uses analytics cookies to understand how visitors use it. We do not use advertising trackers.

Our tag does not set cookies on your pages and does not track visitors across sites. It reports on scripts, and adding a tracking cookie to a compliance tool would be indefensible. You can change cookie preferences in your browser at any time.

Your data is encrypted in transit (TLS) and at rest (AES-256), and access to production systems is limited to the people who need it to run the service.

See our security page for the technical detail, including what the tag collects and how it is scoped.

For anything privacy-related, write to [email protected]. We usually reply within two business days.

Script Monitoring, Inc.