// LEGAL

Privacy policy

Last updated: 21 October 2026.

This policy explains how PingVo (pingvo.cloud) collects, uses, stores, shares and protects personal data when you visit this website, create an account, sign in, or use the PingVo monitoring service.

1. Who we are

PingVo is a phone-line monitoring service operated by SIA “KpxData”, registration number 40203405472, registered address Lielvārdes iela 103 - 61, Rīga, LV-1084, Latvia (“PingVo”, “we”, “us”). Contact: contact@pingvo.cloud.

For account, billing and early-access waitlist data we act as the data controller. For the monitoring data generated on a customer's behalf — including the alert recipients a customer configures — the customer is the controller and we act as a processor on the customer's instructions.

2. What we collect

  • Account data — company name, the name and email address of each user, hashed passwords, and login and session records.
  • Sign-in provider data — if you sign in with Google or Microsoft, the basic profile details that provider shares with us (see section 3).
  • Configuration — the phone numbers you ask us to monitor, how often to test them, and where alerts should be sent.
  • Monitoring results — for each test, whether it connected, whether audio was present, whether the expected prompt played, timing, and the resulting classification.
  • Audio — a short recording captured during failed tests, plus the reference prompt you approve when setting up prompt matching.
  • Alert recipients — the email addresses and other destinations a customer configures for alerts. These are entered by the customer, who is the controller of them.
  • Billing data — plan, subscription status and invoice history. Card details are handled by our payment processor and never reach our systems.
  • Early-access waitlist — if you join the waitlist, your email address, plus the IP address and browser user-agent recorded when you submitted the form.
  • Free SIP OPTIONS check — if you use the free check, the IP address you submitted it from, the server address you entered and the address it resolved to, and the result.
  • Technical logs — IP addresses and request metadata recorded in our web and API logs and at our edge network provider, used to operate and secure the service.

Cookies. Public pages on this website set no cookies and run no analytics or tracking scripts. Signing in sets a session cookie (pingvo_session) that keeps you signed in. If you sign in with Google or Microsoft, one short-lived cookie (pv_oauth_nonce) is also set to carry that sign-in safely from start to finish; it expires within 10 minutes and is cleared as soon as you return. Both are strictly necessary to provide a service you asked for, so no cookie-consent banner applies. We set no advertising, analytics or cross-site tracking cookies.

The free SIP OPTIONS check page also loads Cloudflare Turnstile, which checks signals from your browser to tell people from automated traffic before a check is sent.

3. Why we process it (legal bases)

  • Providing your account and the monitoring service — including sign-in, test execution, alerts and audio from failed tests: performance of a contract (GDPR Art. 6(1)(b)).
  • Service and account email — alerts, security and billing notices (not marketing): performance of a contract (Art. 6(1)(b)).
  • Billing and keeping invoices: compliance with legal obligations (Art. 6(1)(c)).
  • Security and abuse prevention — login records, request logs and rate limiting: our legitimate interest in keeping the service secure (Art. 6(1)(f)).
  • Free SIP OPTIONS check — keeping who checked which server so we can prevent and answer abuse of the check: our legitimate interest in stopping the tool being used against third parties (Art. 6(1)(f)).
  • Early-access waitlist: your consent (Art. 6(1)(a)), which you can withdraw at any time by emailing contact@pingvo.cloud.

4. Sign in with Google and Microsoft

You can sign in to PingVo with a Google account or a Microsoft account instead of a password. When you do, we request only the standard openid, email and profile permissions.

What we access. Your name, your email address, whether that address is verified, and the provider's unique account identifier. We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google or Microsoft data, and we never receive your Google or Microsoft password.

How we use it. Only to authenticate you, to create or link your PingVo user account, and to show your name and email address inside the application (for example in the team member list and in account emails). We do not use it for advertising, profiling, or any purpose unrelated to signing you in. In particular, we never use Google user data for targeted or personalised advertising, never sell it to data brokers or information resellers, never use it to determine creditworthiness or for lending purposes, and never use it to develop, improve or train artificial intelligence or machine-learning models.

How we store it. The account identifier, name and email address are stored with your PingVo user record in our EU-hosted database, encrypted in transit and at rest, with access limited to authorised personnel who need it to operate the service. We do not store Google or Microsoft access tokens or refresh tokens after sign-in completes.

Sharing. We do not sell, rent or transfer data received from Google or Microsoft to third parties, other than the hosting sub-processors needed to run the service (section 8) or where required by law.

Retention and deletion. This data is kept while your user account exists. When your user or company account is deleted, it is deleted with it. You can also ask us to delete it at any time by emailing contact@pingvo.cloud, and you can revoke PingVo's access from your Google account at myaccount.google.com/permissions.

PingVo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Audio recordings

Recordings are test-scoped. Audio is held briefly in memory during a test, kept only when the test fails, and discarded otherwise. Prompt matching is performed on the machine that captured the audio — for numbers tested by an agent running in your own network, that analysis happens inside your network.

Setting up prompt matching records a few short captures of the number answering, so you can choose which one to keep as the reference. Captures you do not approve are deleted after 7 days.

Any monitored number can be configured so that no audio is ever stored. The checks still run and still alert; nothing is retained afterwards.

6. How long we keep it

Retention depends on your plan and is enforced automatically by a job that runs every day. Deletion is permanent.

  • Test results and incidents — Free plan 7 days, trial 30 days, Pro and Enterprise 90 days. Enterprise agreements may set a different period.
  • Audio from failed tests, and diagnostic call traces — deleted together with the test result they belong to, so they follow the plan periods above. Audio is kept only for failures.
  • Reachability checks on a carrier connection — 30 days, even on plans with a longer period. These are by far the highest-volume records we hold and are capped separately.
  • Alert delivery records — 90 days. Copies of webhook payloads sent to your systems are kept for 7 days.
  • Unapproved prompt-matching captures — 7 days.
  • Approved reference prompts — kept while the number is monitored.
  • Free SIP OPTIONS checks — 30 days, to prevent abuse. A result link stops working after 7 days.
  • Early-access waitlist entries — kept until the address is invited to the service, or until you ask us to remove it.
  • Account and billing records — kept while the account exists and afterwards where required by law.

7. Where it is processed

Your stored data — the database, stored files and audio — is held in the European Union, in Microsoft Azure's West Europe region.

Some of the providers listed below necessarily process data outside the European Economic Area — our edge network sees requests wherever they arrive, our email provider is in the United States, and our payment processor makes onward transfers there. Where that happens, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

8. Who we share it with

We do not sell personal data and do not share it for advertising. We use the following sub-processors to run the service:

  • Microsoft Azure — hosting, database, file storage and key management. European Union (West Europe).
  • Cloudflare — DNS, TLS and edge proxying for pingvo.cloud, and the Turnstile bot check on the free SIP OPTIONS check. Global edge network; may process IP addresses and request metadata outside the EU.
  • Postmark (ActiveCampaign) — alert and account email delivery. United States.
  • Stripe — payments and invoicing, contracted through Stripe Payments Europe Ltd (Ireland), with onward transfers to the United States.
  • Telephony carriers — placing the test calls. A carrier necessarily sees the number being dialled. We have not yet contracted a carrier for the service; each one is named here before it processes any data.

If you choose to sign in with Google or Microsoft, that provider acts as an independent controller of the sign-in itself, under its own privacy policy. Beyond the above, we disclose personal data only where required by law.

9. Your rights

Subject to applicable law you may request access to, correction of, or deletion of your personal data, request a portable copy, object to processing, or withdraw consent where processing is based on it. You also have the right to lodge a complaint with a supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija), or the authority in your EU country of residence. Deleting your account removes its monitoring data on the schedule above.

10. Security

Data is encrypted in transit and at rest. Passwords are stored using a modern password-hashing algorithm and are never recoverable in plain text. Connections from monitoring agents are mutually authenticated and are outbound only — nothing needs to be exposed in your network.

11. Changes

We may update this policy. Material changes will be communicated to account administrators before they take effect. We will also notify account administrators before adding a new sub-processor to the list in section 8.

12. Contact

Data-protection enquiries and requests to exercise the rights above: contact@pingvo.cloud.