Effective date: June 2, 2026 · Last updated: June 2, 2026
Operator: Lars Peters, Munich, Bavaria, Germany · privacy@watchover.me
Your privacy matters. This Privacy Policy explains what data Watchover collects, why we collect it, how we use and protect it, and what rights you have over it.
This policy covers two categories of people:
If you are a Protected Person reading this: a family member has enrolled your phone number in Watchover to help protect you from scam messages. This policy explains how your data is handled.
Watchover is operated by Lars Peters, an individual based in Munich, Bavaria, Germany. For the purposes of the General Data Protection Regulation (GDPR), Lars Peters is the data controller.
Contact for privacy matters: privacy@watchover.me
When you create an account and set up Watchover, we collect:
When the service is used, we collect and store:
The Protected Person interacts with Watchover only by forwarding messages and receiving automated responses via SMS. We collect:
We do not create a user account for the Protected Person. We do not collect their name, email address, or any data beyond what is described above.
When you use the Watchover dashboard, we may collect IP address, browser type and version, device type, pages visited and time spent, and referring URL. This data is used for security monitoring and service improvement. We do not use it for advertising.
We use the data we collect for the following purposes:
| Purpose | Legal basis (GDPR) | Legal basis (US) |
|---|---|---|
| Providing the service (analyzing forwarded messages, returning responses, powering the dashboard) | Performance of contract | Contractual necessity |
| Billing and payment processing | Performance of contract | Contractual necessity |
| Sending SMS messages to the Protected Person | Legitimate interest / consent | Consent (TCPA) |
| Security monitoring and fraud prevention | Legitimate interest | Legitimate business purpose |
| Improving the service (aggregate, anonymized scam pattern analysis) | Legitimate interest | Legitimate business purpose |
| Complying with legal obligations | Legal obligation | Legal obligation |
| Communicating with you about your account | Performance of contract | Contractual necessity |
We do not use your data or your Protected Person's data for advertising. We do not sell your data. We do not share it with data brokers.
Watchover uses AI to analyze forwarded messages. Here is what that means in practice:
Important: Under GDPR Article 22 and California's Automated Decision-making Technology (ADMT) rules effective January 1, 2026, you have the right to request human review of any automated assessment that significantly affects you. If you believe an automated assessment was significantly incorrect, contact us at privacy@watchover.me and we will review the case manually.
We share data only with the following categories of third parties, and only to the extent necessary to operate the service:
We do not sell your data. We do not share it with advertising networks, data brokers, or marketing platforms.
Watchover is operated from Germany. Some of our third-party service providers are located in the United States (Anthropic, Twilio, Stripe, Supabase, Vercel).
When we transfer personal data from the European Economic Area (EEA) to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable, and the adequacy and certification frameworks applicable to each provider.
By using Watchover, you acknowledge that your data may be processed in the United States and other countries whose data protection laws may differ from those of your country of residence.
| Data type | Retention period |
|---|---|
| Account information (email, name) | Until account deletion + 30 days |
| Payment records | 7 years (legal and tax compliance) |
| Forwarded message content and AI responses | 90 days from the date of the forward, then automatically deleted |
| Dashboard logs (risk classification, timestamp) | 12 months, then automatically deleted |
| Protected Person's phone number | Until removed from the account or account deletion |
| Technical/server logs | 30 days |
Automated deletion: Forwarded message content — including the text and any images your Protected Person sent — is automatically and permanently deleted after 90 days. This is the most sensitive data we hold and we delete it proactively regardless of whether you request it.
We take reasonable technical and organizational measures to protect your data, including:
No system is completely secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by applicable law (within 72 hours under GDPR where applicable).
If you are located in the European Economic Area or the United Kingdom, you have the following rights:
To exercise any of these rights, contact privacy@watchover.me. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority. In Germany, the relevant authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
Categories of personal information collected: Identifiers (email, phone number); commercial information (subscription records); internet/network activity (dashboard usage); and message content submitted through the service.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
To exercise your California rights, contact privacy@watchover.me. We may need to verify your identity before processing your request.
Regardless of your location, you may at any time:
Watchover's dashboard uses essential cookies to maintain your login session and provide the service. We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across websites.
We use privacy-respecting analytics (no personally identifiable tracking) to understand aggregate usage patterns and improve the service.
Watchover is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact privacy@watchover.me and we will delete it promptly.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the changes take effect. The updated policy will be posted at watchover.me/privacy with a revised effective date.
Your continued use of Watchover after the effective date of a revised policy constitutes your acceptance of the changes.
For any privacy-related questions, requests, or complaints:
Lars Peters
Munich, Bavaria, Germany
privacy@watchover.me
We aim to respond to all privacy requests within 5 business days and to resolve them within 30 days.
This Privacy Policy was last updated on June 2, 2026.