Privacy Policy

Who We Are

DataCanary is a trading name of O'Sullivan Growth Consulting. We operate the DataCanary monitoring service at app.datacanary.io and the marketing website at datacanary.io.

For the purposes of applicable data protection law — including the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018 — the data controller is:

O'Sullivan Growth Consulting trading as DataCanary
Ireland
Contact: privacy@datacanary.io

What Data We Collect

Account and identity data

• Your name and email address, collected when you sign in via Google OAuth.
• Your Google account profile information (name, profile picture) provided by Google during authentication.

Google Analytics data

To provide the monitoring service, DataCanary connects to your Google Analytics 4 (GA4) property using read-only API access. We access:

• Event names, event counts, and event parameters from your GA4 property.
• Session and user metrics from your GA4 property.
• GA4 property identifiers and configuration metadata.

We store OAuth access tokens and refresh tokens to maintain your connection to the GA4 API. These tokens are encrypted at rest using AES-256-GCM encryption.

Usage and analytics data

We use Google Analytics 4 and PostHog on our own websites to understand how visitors use our service. This may include:

• Pages visited and features used within the application.
• Browser type, device type, and approximate location (country/city level).
• Referral source and session duration.

PostHog is used for product analytics and may record session behaviour to help us improve the service. We use the EU-hosted PostHog Cloud instance.

Communications data

If you subscribe to marketing emails or contact us directly, we retain the content of that communication and your email address.

How We Use Your Data

Providing the service

We use your account data and GA4 property credentials to run daily automated checks on your GA4 property for tracking issues, anomalies, and parameter changes, and to send you alert and summary emails.

Marketing communications

With your consent, we may send you emails about DataCanary features, updates, and related services such as GA4 audits or implementation services offered by O'Sullivan Growth Consulting.

You can withdraw consent and unsubscribe at any time using the link in any marketing email, or by contacting us at privacy@datacanary.io.

Improving our service

We use aggregated, anonymised usage data from Google Analytics and PostHog to understand how the service is used and to improve features and user experience.

How Long We Keep Your Data

• Check results and monitoring data: retained for 30 days, then automatically deleted.
• Active issues: retained until resolved or until you delete your property connection.
• Account and property data: retained for the duration of your account, and deleted within 30 days of account deletion.
• Marketing communication records: retained until you unsubscribe or request deletion.

Who We Share Data With

We do not sell your data. We share data only with the following sub-processors necessary to operate the service:

• Supabase — database and authentication. Servers located in the EU.
• Vercel — hosting and serverless functions. Covered by the EU–US Data Privacy Framework.
• Resend — transactional and marketing email delivery.
• Google LLC — OAuth authentication and GA4 API access.
• PostHog — product analytics. EU-hosted instance.
• Inngest — background job scheduling for daily monitoring runs.

Where sub-processors are located outside the EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions as the lawful transfer mechanism.

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Access — you may request a copy of the personal data we hold about you.
• Rectification — you may request that we correct inaccurate data.
• Erasure — you may request that we delete your personal data, subject to legal obligations.
• Restriction — you may request that we restrict processing of your data in certain circumstances.
• Portability — you may request your data in a structured, machine-readable format.
• Object — you may object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@datacanary.io. We will respond within 30 days. You also have the right to lodge a complaint with the Irish Data Protection Commission.

Cookies

Our websites use cookies and similar tracking technologies. Cookies used include:

• Session cookies — required for authentication and to keep you logged in to the app.
• Analytics cookies — set by Google Analytics 4 and PostHog to understand usage patterns. These are only set with your consent where required by law.

You can manage cookie preferences through your browser settings. Disabling cookies may affect your ability to use the service.

Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• AES-256-GCM encryption for stored OAuth tokens.
• HTTPS encryption for all data in transit.
• Row-level security on our database, ensuring users can only access their own data.
• Regular review of access controls and third-party integrations.

No method of transmission or storage is 100% secure. If you become aware of any security concern, please contact us immediately at privacy@datacanary.io.

Children's Privacy

DataCanary is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Where changes are material, we will notify you by email. Continued use of the service after the effective date constitutes acceptance of the updated policy.

Contact Us

For any privacy-related questions or to exercise your rights, get in touch: