Data & Privacy Notice

1 · Overview

WhoWatches operates a receiver-side observatory: instrumentation deployed at the edge of subscriber properties to characterize automated activity directed at those properties.

WhoWatches is a property of BotConduct.

2 · What we observe

Automated activity directed at your public property. This includes signals associated with the requesting client and its behavior on your property. We do not disclose the specific signal taxonomy publicly; it constitutes the operational basis of the observatory.

3 · What we do not observe

Personally identifiable information of your end users
Form submissions, account credentials, payment data, or authenticated session content
Cookies, session tokens, or user state
Page content rendered to your end users

4 · Two distinct uses of observed signals

We use observed signals in two ways. Both are described here explicitly.

4.1 · Subscriber-specific intelligence

Signals observed on your property are processed to produce the intelligence delivered to you: weekly briefs, monthly deep dives, webhook events, dashboard. Subscriber-specific data is retained for 90 days from collection and deleted within 30 days of cancellation. You can request export or earlier deletion at any time.

4.2 · Cohort intelligence (observatory)

Signals observed across all subscriber properties are combined into anonymized cohort intelligence used to characterize automated actors, behavioral patterns, and cross-property correlations. Cohort intelligence does not identify individual subscribers, properties, or end users. It is the basis for the strategic interpretation we deliver to subscribers and for public research published by BotConduct.

Cohort intelligence is retained indefinitely as it constitutes the operational basis of the observatory. Deletion of subscriber-specific data on cancellation does not remove anonymized contributions to cohort intelligence, because such contributions cannot be re-identified to the originating subscriber. This is disclosed explicitly here so that subscribers can make an informed decision before subscribing.

5 · What “anonymized” means in practice

Cohort intelligence operates on actor-level abstractions: a specific bot operator, a behavioral pattern, an infrastructure cluster. It does not retain property-level identifiers, subscriber identifiers, or URL-level specificity tied to a single subscriber. A finding such as “exhibits extraction behavior across multiple monitored properties in the AI-native vertical” cannot be reverse-engineered to identify which specific properties contributed observations.

6 · Where data is processed

Primary processing infrastructure is located in the European Economic Area (Finland). Subprocessors operate under contractual data protection arrangements consistent with applicable law.

7 · Legal basis (GDPR, where applicable)

For subscriber-specific intelligence: performance of contract with the subscriber.
For cohort intelligence: legitimate interest of WhoWatches/BotConduct in operating the observatory, balanced against the rights of data subjects. End users of subscriber properties are not data subjects of our processing because we do not collect personal data of end users; we observe characteristics of automated (non-human) clients directed at subscriber properties.

8 · Your rights as a subscriber

Receive a copy of subscriber-specific data observed on your property
Request deletion of subscriber-specific data at any time
Export all subscriber-specific observations as JSON
Audit our methodology under NDA (enterprise tier)

Opt out of contributing anonymized signals to cohort intelligence is not available under standard subscription; this is by design, as cohort intelligence is the operational basis of the service. Enterprise subscribers may negotiate alternative arrangements under custom DPA.

9 · Subprocessors

Paddle (payment processing).

10 · Compliance arrangements

Custom Data Processing Addendum (DPA) available for enterprise customers. Contact: desk@whowatches.io

11 · Changes to this notice

Material changes communicated 30 days in advance to active subscribers via the email associated with the subscription.

12 · Contact

For privacy questions, data requests, or compliance arrangements: desk@whowatches.io

WhoWatches is a property of BotConduct. Operations: Argentina. Processing infrastructure: European Economic Area.
This privacy notice is under final legal review.