Watchtower
Privacy Policy
Last updated: 22 September 2026
Watchtower is operated by SHAJ Studio. This policy explains what data the application accesses, what it stores, and what it does not.
1. What Watchtower is
Watchtower is a monitoring application for HighLevel agencies. It is installed once at agency level, reads configuration and activity signals from the agency's sub-accounts, and reports problems by email and through a dashboard.
Watchtower is read-only. It holds no write permissions to any HighLevel account and cannot create, modify, or delete anything in a customer's account or their clients' accounts.
2. What we access
Watchtower requests read-only permissions, which the agency approves at install. These allow it to read:
- Sub-account configuration: workflows, custom values, custom fields, tags, pipelines, calendars, users, phone numbers, business profile settings
- Forms, surveys, and email campaign configuration and counts
- Aggregate activity signals: message send and delivery outcomes, email delivery statistics, conversation read state, appointment and opportunity creation events
The full list of permissions is shown on the consent screen before installation.
3. What we store
We store configuration metadata and event counts, not customer records.
Specifically, we store:
- Sub-account identifiers, names, timezone, business email, and a reference to the agency's own Stripe billing product for that sub-account, where the agency uses HighLevel's SaaS rebilling feature
- The configuration values our checks examine, for example whether a workflow is published, or whether a custom value is empty
- A standard an agency has chosen to capture from one of its own sub-accounts, used to check others built from the same template
- Counts and outcomes derived from activity events, such as how many messages were sent and how many failed
- Findings we generate, including the finding text, when it was first seen, when it was resolved, and, when an agency tells us a finding was wrong, the reason and any note they add. That note is free text the agency's own team writes.
- Agency settings: digest recipients, frequency, thresholds, and which checks an agency has muted, including any free-text reason given
- A record of each digest sent and whether it was opened, to measure whether digests are useful
We do not store contact records or message content. Incoming webhook data is stripped before it is written: contact names, email addresses, phone numbers, and the body text of emails and SMS messages are discarded and never persisted. What remains is the identifier and the fields our checks read.
4. What we send by email
Watchtower emails a digest to the recipients an agency configures, daily by default, or weekly, or paused, at the hour the agency sets. It contains sub-account names and the findings we detected, and links to your Watchtower dashboard, where each finding links straight to the setting in HighLevel that needs fixing. It does not contain contact data or message content.
Email is sent through Resend. Agencies choose their own recipients and can pause or stop email at any time from the settings page. Any recipient can also unsubscribe directly from a link included in every digest.
We record whether digest emails are opened, to measure whether they're useful.
5. Access credentials
OAuth tokens issued by HighLevel are encrypted at rest using AES-256-GCM. They are used only to make the read requests described above.
6. Deletion
When an agency uninstalls Watchtower, all of their data is deleted from our database immediately: sub-account records, findings, stored events, settings, and access tokens.
Short-lived operational records also exist outside that immediate deletion. Webhook delivery logs on our own side expire automatically within four days and contain no contact records or message content. Our infrastructure and email providers' own logs, backups, and records of emails already sent expire according to each provider's own retention period, not ours. This can include a copy of a sent digest, held by our email provider, which names sub-accounts and the findings reported in it.
A later reinstall starts fresh.
Agencies may also request deletion at any time by contacting us.
7. Sub-processors
- Neon: database hosting
- Railway: application hosting
- Cloudflare: network and security layer in front of the application
- Resend: transactional email delivery
- HighLevel: the source system Watchtower reads from
8. What we do not do
- We do not sell data
- We do not use customer data to train models
- We do not share data with advertisers
- We do not access accounts beyond those the installing agency has granted
9. Security
Data is transmitted over TLS. Tokens are encrypted at rest. Access to the dashboard requires a signed token or an authenticated HighLevel session, and every request is scoped to a single agency's own data.
10. Your agency's own clients
Where an agency's sub-accounts contain personal data belonging to their clients' customers, the agency remains the controller of that data. Watchtower acts as a processor, reads only what is described above, and stores none of it.
11. Changes
We will update this policy when what we store or access changes, and revise the date at the top.