Security and data handling

Last updated: 5 November 2026

Watchtower is a sub-account monitoring app for agencies on HighLevel (also called GoHighLevel or GHL), made by SHAJ Studio. This page says how it connects to your account, what it can read, what it keeps and how to remove it. The Privacy Policy is the full legal text.

How it connects

Watchtower connects through the HighLevel Marketplace using OAuth. You install it at agency level and approve its permissions on the screen HighLevel shows. There are no API keys to create or paste. We never ask for your HighLevel password.

Permissions

Watchtower asks for 36 permissions. 35 are read-only. The 36th lets Watchtower ask HighLevel for a read-only access token for each sub-account. It cannot change any data. Section 2 of the Privacy Policy lists what the permissions let it read.

Read-only

Watchtower never edits, creates or deletes anything in a sub-account. Every request that fetches data is a read. The only other requests are the OAuth requests that obtain and refresh its own access tokens.

What it stores

• Configuration details, such as whether a workflow is published or a custom value is empty
• Counts and outcomes, such as how many messages were sent and how many failed
• The findings it creates
• The recipient addresses you add for the morning email
• The names shown in findings, such as a form, workflow or calendar name
• Internal record IDs

What it does not store

Contact names, email addresses, phone numbers or message content from the contacts in your sub-accounts. It does not keep call transcripts either.

How tokens are protected

The access and refresh tokens HighLevel issues to Watchtower, for the agency and for each sub-account, are encrypted with AES-256-GCM before they are saved. The encryption key is kept separate from the database. It can be replaced without a reinstall. We do not write tokens to our logs. Data travels over TLS and database backups are encrypted.

Retention and deletion

• Uninstall Watchtower at agency level and your agency's records, including tokens, findings, recipients and settings, are deleted right away.
• A small number of sub-account event records are removed by a daily clean-up after 90 days at the latest. A delivery log is deleted after 4 days at the latest.
• Our database host keeps a restore history of 2 days. Encrypted backups are kept for up to 7 days.
• If a single sub-account is removed while your agency stays installed, we stop monitoring it and delete its token. Its findings, name and settings are deleted after 14 days.
• If your HighLevel account becomes inactive, monitoring is paused and your data is deleted after 14 days unless the account becomes active again.

Section 6 of the Privacy Policy has the full detail, including the exceptions.

Agency isolation

Each agency sees only its own sub-accounts, findings and settings. Every request is scoped to one agency's own data.

How to revoke access

Uninstall Watchtower from your agency view: App Marketplace, then Installed Apps, then Agency Apps. Open the menu on the Watchtower row and choose Uninstall. Access ends and the deletion above starts.

Trial

7-day free trial. Billing and cancelling happen in your HighLevel account.

Questions

Write to support@shajstudio.com. Watchtower is made by SHAJ Studio and is not affiliated with HighLevel.