What Onserva collects, what it does not, and who else sees it. Written against what the software actually does — every claim here was checked against the code before it was written down.
In effect from 12 August 2026. No Fear Tech Ltd, company number 16758357, registered in England and Wales, at 6 Mallard Way, Dereham, England, NR19 1FJ.
Onserva is a service provided by No Fear Tech Ltd, a company registered in England and Wales. For the personal data described on this page we are the data controller, except where we say otherwise.
For anything to do with your data — a question, a request, or a complaint — write to hello@onserva.com.
Where you use Onserva to monitor servers that hold other people’s data, you are the controller of that data and we are your processor for the limited purposes described below.
This is the part most people want to know, so it comes first. The agent installed on your server sends aggregate system statistics, and nothing else:
That last one exists so the dashboard can offer to switch web-traffic monitoring on for you, instead of asking you to edit a configuration file over SSH. Nothing is switched on until you press the button, and the agent only ever looks in a short list of standard locations that is compiled into it.
It does not send the contents of any file, any database, any environment variable, any credential, or anything belonging to your customers. It has no mechanism to do so — it reads the statistics the operating system publishes about itself and nothing else, and it runs as an unprivileged user that could not read most of your data even if it tried.
If you switch on web-traffic monitoring, the agent reads your reverse proxy’s access log locally and reports numbers: requests per second, how many returned an error, and how long responses took. The request paths, visitor IP addresses, user agents and referrers in that log are parsed past and discarded on your machine. None of them are transmitted to us and none are stored.
From agent 0.6.0, those traffic numbers are also broken down by the website they were for — the domain names you configured your own server to answer to, such as example.co.uk. That is so the dashboard can tell you which of your sites is busy or struggling, rather than only that the machine is. A domain name you chose to host is information about you, not about your visitors: the same rule as above still holds, and nothing about any individual visitor or request leaves your machine.
When an alert opens, we ask Anthropic’s Claude to explain what the readings mean and to choose a fix from a fixed list. What it receives is the aggregate numbers above and recent history of the same numbers.
It also receives the per-site traffic numbers where you have web-traffic monitoring on — including the domain names of your own sites — because "which site is struggling" is usually the whole diagnosis.
It does not receive logs, request paths, visitor addresses, customer records, or anything from inside your server. It has no access to your machine and never will.
Anthropic processes this as our sub-processor. Under Anthropic’s commercial terms, data sent through the API is not used to train their models.
The AI’s answer is advice attached to an alert. Nothing it proposes runs anywhere until you authorise it.
We use this to run the service, to bill you, and to answer you when you get in touch. We do not sell it, and we do not use it for advertising.
The lawful bases are: performance of our contract with you (running the service and billing for it); our legitimate interests in keeping the service secure and in a defensible record of who authorised what; and your consent, for analytics on this website.
The public onserva.com pages set no cookies and load no third-party scripts unless you agree to them.
Google Analytics is loaded on every page but is switched off until you say yes: consent for analytics storage starts denied, and the banner’s “That’s fine” is what switches it on. Choosing “No thanks” stores nothing that travels anywhere — your answer is kept in your browser’s local storage, not in a cookie, so it never leaves your device.
The decline button is the same size and weight as the accept button. That is deliberate: a banner where refusing is harder than agreeing is not consent.
We run no advertising and no cross-site tracking, whichever you choose.
The dashboard at app.onserva.com sets the cookies needed to keep you signed in. Those are strictly necessary and are not optional — without them there is no way to stay logged in.
The chat on this site is an AI assistant provided by ElevenLabs. It tells you so itself; it is not a person and never claims to be.
What you type in it is sent to ElevenLabs and to the model behind it in order to answer you. If you use the voice option, your microphone audio is recorded and sent to ElevenLabs for speech recognition — that is what makes it work, and it is why the voice option only starts when you press the button, never on page load.
Do not put passwords, card numbers, server credentials or anyone else’s personal data into the chat. It is a sales assistant, not a support channel with access to your account, and it cannot see your servers.
Conversations may be retained by ElevenLabs as our sub-processor, and we may read them to improve the answers. If you would rather not use it, everything it can tell you is also on this website, and a human is at hello@onserva.com.
Payment is taken on this website using Stripe’s embedded checkout. The card fields are served and processed by Stripe inside our page, so your card number is never transmitted to or stored on our servers.
Stripe acts as an independent controller for payment data and holds it under its own privacy policy and its regulatory obligations. We receive confirmation of payment, your billing address, and the last four digits of the card.
When your payment succeeds, we create your Onserva account and email you a single-use link to choose a password and set up two-factor authentication.
If you ask us to build a new server, you hand over its temporary sign-in once. That credential is encrypted in Supabase Vault and deleted the moment the work begins — before the first command runs — so it exists in storage for minutes and is never retained afterwards.
The provisioning worker holds it only in memory, for the length of one job, and runs on neither our platform nor any monitored machine.
The recipe’s first task is to replace that access with key-based sign-in under an ordinary account, verify the key works, and then switch off root and password sign-in permanently.
We keep this list short on purpose. Each of these is a company that necessarily handles some of your data in order for Onserva to work:
Some of these are based outside the UK. Where data is transferred out of the UK it is done under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent approved mechanism.
We will tell customers before adding a sub-processor that handles their data.
Under UK GDPR you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it, and ask for it in a portable form.
Write to hello@onserva.com and we will answer within one month. We will not charge you for this, and we may ask you to confirm who you are first.
Where we rely on your consent — website analytics, and the chat — you can withdraw it at any time. For analytics, clearing this site’s data in your browser will make the banner ask you again.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/, and you do not have to come to us first.
Two-factor authentication is mandatory on every account, including ours. Isolation between customers is enforced by the database itself rather than by our code. The agent opens no port on your machine and holds no credential of yours.
The security page describes all of this in detail, including where the limits are.
If something goes wrong in a way that puts your data at risk, we will tell you and, where the law requires it, the regulator — within 72 hours of becoming aware.
If we change anything that affects how we handle your data, we will update this page and change the date at the top. Where the change is significant we will email customers rather than rely on you noticing.
Questions about any of this? hello@onserva.com, or see how Onserva is built.