Legal

Privacy Policy

Last updated: September 29, 2026

This policy explains what this website, sqldatacollector.com, collects about you, including in the customer account area, what AlertLink Technologies does with it, and what the SQL Data Collector software itself sends, which is very little. It is deliberately specific: it describes only what the site and the product actually do.

1. In short

The public pages of this site set no cookies and run no analytics or advertising trackers. Signing in to your customer account sets a few cookies that are strictly necessary for it (section 11).
We collect what you type into the trial request form and your account, the order and licence details Paddle sends us, and the challenge code you paste to get a licence key. For trial requests, sign-ins and downloads we also record a salted hash of your IP address, your browser's user-agent string, and the time.
We use it to run your account, send you the installer and your licence keys, and follow up about the trial and early access. No newsletters. Nothing is sold or shared for marketing.
The software runs inside your own network and sends nothing to us except an anonymous once-a-day check for updates.
Email contact@alertlinktech.com to get a copy of what we hold about you, correct it, or have it deleted.

2. Who is responsible

AlertLink Technologies LLC, a Tennessee limited liability company trading as AlertLink Technologies, operates this site and is responsible for the information described here. You can reach us at contact@alertlinktech.com, or by post at AlertLink Technologies LLC, PO Box F, Lawrenceburg, TN 38464, USA.

3. The trial request form

This site asks you for information in two places: the trial request form on the home page, described here, and your customer account (sections 5 to 8). The checkout on the pricing section is provided by Paddle and is covered in sections 8, 10 and 11. The form collects:

your name;
your work email address;
your company;
the number of SQL Servers you want to monitor, as a range;
an optional message.

When you submit it, the server also records a salted hash of your IP address, your browser's user-agent string, the date and time, how long the form took to fill in, and whether it was sent with JavaScript. The hash is a one-way fingerprint that lets us spot repeat requests without keeping the address with your request. The web server's ordinary access log still records the address, like any request (section 12). The IP hash is also used to limit how many requests one visitor can send per hour. To filter automated submissions, the form includes a hidden field that people never see and a check on how quickly the form was sent. There is no CAPTCHA. The page also asks the server for a short browser check code when you start filling the form in, and sends it back with your request. It is a signed timestamp, it contains nothing about you, it sets no cookie, and no other company is involved.

4. Where your request goes

Three things happen with a request.

It is written to a private log file on AlertLink's web host. The file is not web-accessible.
It is recorded in the site's customer database. This creates your customer account (section 5), or adds the request to the account you already have for that email address. The database keeps the details from the form and the request's status, and later who at AlertLink approved or declined it and when. The salted IP hash is kept in the account's audit trail.
It is emailed to contact@alertlinktech.com so that a person can read it and reply. That email includes the details from the form, the IP hash and the user-agent string.

You then receive a fixed acknowledgement email confirming that the request arrived. It is the same message for everyone. When AlertLink approves the request, the site emails you a private download link (section 7). If AlertLink declines it, the site emails you a short message saying so, with a note from AlertLink when one was written.

A submission that looks automated — because it filled in the hidden field, was sent within three seconds, did not carry the browser check and reads like marketing, or comes from an email domain imitating ours — is not emailed, is not recorded in the customer database, and gets no acknowledgement. It is written to the private log and kept in a review folder on the same host so that a person at AlertLink can read it and, if it turns out to be genuine, release it into the normal process. A request that simply did not carry the browser check, and does not look like spam, is emailed and recorded as usual, marked for a second look. During a flood of requests a submission is simply refused.

5. Customer accounts

Your customer account, at /account/, is where you see your licences and orders (including any refund), get installer download links and licence keys, add servers to a licence, and open Paddle's billing portal when it is available (section 8).

How an account is created

The site creates an account automatically when you send a trial request (section 4) or when Paddle tells us about you (section 8). That happens when you enter your email address in Paddle's checkout, even if you do not finish the purchase, and when you buy. The account's email address is the one you used on the form or at checkout. AlertLink can also add an account by hand, for example when you ask us to by email.

What the account holds

your email address, name and company;
your Paddle customer ID, once Paddle tells us about you (section 8);
internal notes, which AlertLink staff may write and which the site adds when Paddle reports a different email address or Paddle customer ID for you. Notes are never shown to you;
when the account was created and last changed.

Linked to the account are your trial requests, licences and orders, download links and downloads, key requests, and requests to add servers, described in the sections that follow. You can change your name and company on the account page. To change the email address, write to us.

Signing in

There is no password. You enter your email address at /account/login.php and, if that address has an account, the site emails you a sign-in link. The link works once and expires after 15 minutes. The page gives the same answer whether or not the address has an account. If it has none, nothing is sent, but the address you typed is recorded in the audit trail described below.

For each sign-in link the site stores the email address, a one-way hash of the link's secret part (never the link itself), a salted hash of your IP address, and when the link was requested, when it expires and when it was used. To limit abuse, one email address can ask for 5 links an hour, and one IP address for 20.

Opening the link signs you in on that browser: the site starts a session and sets the sdc_session cookie (section 11). For each session it stores a one-way hash of the cookie's value, a salted hash of your IP address and your browser's user-agent string as they were when you signed in, when the session started and when it was last used, and a random value that protects the account's forms. A session ends 30 days after you last used it and never lasts more than 90 days. Signing out ends it at once.

The audit trail

The site keeps a log of events on each account: trial requests and decisions, sign-in requests, sign-ins and sign-outs, changes to your details, download links created and downloads, key requests and keys issued, requests to add servers, visits to the billing portal, emails that could not be sent, and each update Paddle sends about your orders and licences. It also records account creation, merges and changes made by AlertLink staff or from Paddle, including note edits; key requests AlertLink rejects, with its internal note; and addresses typed into the admin sign-in form. Each event records the time, what happened, who did it (you or an AlertLink staff member, named by email address, or Paddle, or the site itself) and a few details, such as the address typed into the sign-in form or the server name on a key request.

Who at AlertLink sees it

AlertLink staff can see your account in the admin area of this site: your details and notes, licences and orders, trial requests, download links, key requests, requests to add servers, and the audit trail. Only AlertLink staff can sign in to the admin area. They use it to approve trials, issue keys, send download links and answer your questions.

6. Licence keys

A licence key is tied to the machine that runs the collector. To get one, open the Licence page in the app, copy the challenge code, and paste it into Licence keys on your account page.

What the challenge code contains

The challenge code is not encrypted. It is an encoding of three facts about the machine that runs the collector, plus a checksum:

its Windows machine GUID, a random identifier that Windows creates when it is installed;
the network domain the machine has joined, which is blank for a machine in a workgroup;
the machine's computer name.

Nothing else is in it: nothing about the SQL Servers you monitor, your users or your data. We need these three values because the key we issue is bound to them, so it works only on that machine. When you submit a code, the site checks it and stores it together with the three decoded values, the licence you tied it to, and the number of servers on that licence, so that AlertLink can see which machine a key is for. Your account page lists each request with its server name and domain.

The key we issue

A person at AlertLink produces each key with an offline tool and issues it within one business day. The key appears in your account and is emailed to you with the server name. A key records the number of servers it covers, its expiry date, the company name it is issued to, and a one-way fingerprint of the three machine values, and it is signed by AlertLink. The site stores the key with who issued it and when. A first purchase comes with two keys (see the Refund Policy): AlertLink signs both at once, and the site holds the full-term key, and later each renewal key, until the date it is released to your account. Before releasing one, the site checks the refund and chargeback records for the order (section 8), and it records when each key was released. If AlertLink does not issue a key for a request, it keeps an internal note of why, which is not shown to you.

Each key request is also emailed to AlertLink with your name or company, your email address, the server name and the domain.

7. Downloads

The installer is not a public download. Once your trial request is approved or you hold a licence, you can get a private download link from your account. AlertLink may also email you one, for example when it approves your trial.

Each link works up to 5 times within 14 days. The site stores only a one-way hash of the link, with who created it (you, or the AlertLink staff member who sent it), when it expires, how many times it has been used, and when it was last used. A link you create in your account is shown once, on the next page; the sdc_acct_link cookie carries it there (section 11). After that it cannot be shown again, but you can create a new one at any time.

Each download records the time, a salted hash of your IP address, your browser's user-agent string and the size of the file, linked to your account. A download is counted when it starts, so an interrupted download still uses one of the 5. A download link works without signing in, so anyone who has it can use it until it runs out. Keep it to yourself.

8. Records from Paddle

Paddle is the merchant of record for our orders (section 10). When you enter your details in the checkout, or buy, renew, cancel or change a licence, Paddle sends our site a signed notification. Paddle does the same when an order is refunded, credited or disputed by your bank (a chargeback). The site keeps:

for each licence, which Paddle calls a subscription: Paddle's subscription and customer IDs, its status, the price and whether it is on list or early-access pricing, the number of servers, the currency and price per server, the current billing period, the next renewal date, and any cancellation date;
for each order, which Paddle calls a transaction: Paddle's transaction and subscription IDs, its status and origin, the currency, subtotal, tax and total, the number of servers, the price, the invoice number, and the date;
for each refund, credit or chargeback, which Paddle calls an adjustment: Paddle's adjustment, transaction, subscription and customer IDs, what kind it is and whether it is full or partial, its status, the reason given for it, the currency, amount and tax, and the date. It is shown with the order it belongs to, on your account page and in the admin area;
your email address, name and business name, when Paddle's notification includes them. The site uses them to find or create your account, and fills in a name or company only where the account has none. When a notification names only a Paddle customer ID, the site may ask Paddle's API for that customer's email address and name. Until the email address is known, the account holds a placeholder address and cannot sign in or receive email.

The site also keeps a copy of each subscription, transaction and adjustment record exactly as Paddle sent it, and a private log file of every notification Paddle sends, with the time it arrived, the IP address of Paddle's server, and the full content. Paddle decides what these contain. They can include a description of the payment method, such as the card type, last four digits, expiry date and cardholder name, but never your full card number. For a business they can also include its company number, tax number and contacts. For purchases, failed payments, cancellations, overdue payments, refunds, credits and chargebacks, AlertLink also receives a summary by email.

Billing portal

Manage billing appears next to your licence in your account when AlertLink has connected the Paddle API and the licence has a Paddle customer ID. It asks Paddle for a one-time link to Paddle's customer portal for your Paddle customer ID and licence, then sends you there. Receipts, invoices, your payment method and cancellation are handled in that portal by Paddle. The visit is noted in the audit trail. When Manage billing does not appear, use the links in your Paddle receipt email, or email contact@alertlinktech.com.

Adding servers

When you add servers to a licence, the site records the request: the licence, the current and new number of servers, the old and new prices, its status, the amount due and Paddle's transaction ID when they are known, and any error Paddle reports. When AlertLink has connected the Paddle API, the site asks Paddle for the price before you confirm and then asks Paddle to apply the change. Paddle charges the payment method it holds for the difference over the rest of the current term, or credits it toward your next renewal when the new price band makes the total lower; if that payment fails, nothing changes. You and AlertLink then receive a confirmation email. Otherwise the request is recorded, AlertLink is told by email, and AlertLink sends you a Paddle invoice, or arranges a credit, for the difference.

9. What we use it for

We use your details to run your account; to send the trial installer link, your licence keys and the other emails listed below; to keep order and licence records; to keep sign-ins and downloads secure and limit abuse; and to follow up about the trial and early access: answering your questions, asking how it went, and, if you want one, arranging a licence. That is all. There are no newsletters and no marketing lists, and we do not use your details for advertising or profiling.

Emails the site sends

All of them are plain text and go to the email address you gave us, which is the one on your account:

the acknowledgement of a trial request;
a sign-in link, when you ask for one;
a private download link, when AlertLink approves your trial or sends you a link;
a short message if AlertLink declines your trial request;
your licence key, when AlertLink issues it, and a message when a full-term or renewal key is released to your account;
a reminder about 45 days before each renewal of your licence, with the renewal date and how to cancel;
a confirmation when servers are added to your licence through Paddle.

AlertLink itself receives emails about new trial requests, key requests, requests to add servers, and Paddle orders, refunds and chargebacks, so that a person can act on them. Receipts and invoices come from Paddle, not from this site.

We do not sell your details, and we do not share them for marketing. The only parties that handle any of them are these.

Paddle, when you make a purchase. Paddle is the merchant of record for our orders and collects your payment details under its own privacy policy. AlertLink never sees your full card number. Our site sends Paddle only what your licence needs: your Paddle customer and subscription IDs when you open Manage billing, the new number of servers and its price when you add servers, and your Paddle customer ID when it asks Paddle for your email address and name (section 8). The home page also loads Paddle's checkout script from Paddle's servers, so Paddle receives your IP address when that page loads.
Hostinger, the company that hosts this website. It stores the site, its customer database, the private log files, and the ordinary web-server access logs, its mail servers send the emails this site sends, and it acts as our processor.
Google Fonts. The site's typefaces, on the account pages too, load from Google's servers, so Google receives your IP address when a page loads, as with any web request. Google handles that under its own privacy policy.

Nobody else receives your details.

11. Cookies and tracking

The public pages of this site, such as the home page, the documentation and these policies, set no cookies and run no analytics or advertising trackers. The site sets cookies only on the account pages under /account/ and on AlertLink's own admin pages. Each one is strictly necessary: it keeps you signed in, or carries a message or a new download link to the next page. None is used for tracking, analytics or advertising.

Cookie	What it does	How long it lasts
sdc_session	Keeps you signed in to your account. It holds a random value; the site stores only a one-way hash of it.	30 days after you last used your account, and never more than 90 days after you signed in. Deleted when you sign out.
sdc_flash	Carries a one-line message, such as "Saved." or "You are signed out.", to the next page. It holds only that message.	Up to 5 minutes. Deleted as soon as the message is shown.
sdc_acct_link	Carries a download link you just created to the next account page, the only place it is shown. It holds the link itself and is sent only to pages under `/account/`.	Up to 10 minutes. Deleted as soon as the link is shown, or when you sign out.
sdc_admin	Keeps AlertLink staff signed in to the admin area. Customers never receive it.	12 hours. Deleted at sign-out.

All four are marked Secure, so they travel only over HTTPS; HttpOnly, so scripts on a page cannot read them; and SameSite=Lax, so other sites cannot make your browser send them in the background. Except for sdc_acct_link, they are set for the whole site, so your browser sends them with every request to sqldatacollector.com, but only the site's account, admin and download pages read them.

Because these cookies are strictly necessary for the account you asked for, the site does not ask for consent and shows no cookie banner. If you block them, the public pages still work, but you cannot sign in.

The home page loads Paddle's checkout script from Paddle's servers so that the pricing section can open the checkout. That script and the checkout run under Paddle's privacy policy, and Paddle may set its own cookies, for example during a purchase.

12. Server logs

Like every web host, Hostinger keeps ordinary web-server access logs for this site. They record each request, including the visitor's IP address, the page requested, the time, and the browser's user-agent string. AlertLink does not use them to track visitors. The same applies to the once-a-day update check made by the software (section 14), which version 7.14.0.0 and later send to this site. Older builds send it to an address on alertlinktechnologies.com, a site also hosted by Hostinger (section 10), which keeps the same kind of log. The server also keeps a PHP error log. It can record the email address of a message that could not be sent, and Paddle customer, subscription or transaction IDs.

13. How long we keep it, and your choices

Some records are deleted automatically:

sign-in link records, once they are more than a day past their expiry; the site clears them as sign-in links are requested and used;
sessions, when you sign out, and some time after they expire (section 5);
rate-limit counters, which are keyed by a salted hash of an IP address, a hash of an email address typed into the sign-in form, or an account number: from time to time once they are more than a week old (the trial form's once they have been unused for two hours);
held submissions once released or discarded, after 90 days; ones still waiting for review are kept until a person decides;
the sdc_flash and sdc_acct_link cookies, within minutes (section 11).

Everything else is kept until AlertLink deletes it: your account, trial requests, download links and downloads, key requests and keys, licence and order records, requests to add servers, the audit trail, and the private log files. Trial request records are kept while we need them to follow up on the trial or early access, and afterwards as ordinary business records. An account that holds an active licence is kept for the licence term, and its order, licence and key records are kept afterwards as ordinary business records.

At any time you can email contact@alertlinktech.com to:

ask for a copy of the details we hold about you;
have them corrected;
have them deleted.

We reply from the same address. Once your record is deleted, we will no longer be able to follow up on your trial, and you will no longer be able to sign in. Paddle keeps its own records of your orders under its own privacy policy.

The site also keeps a copy of its database each day for 14 days, so that it can be restored after a fault. A deleted record disappears from those copies within 14 days.

14. The software itself

SQL Data Collector is a Windows service and web console that runs entirely inside your network. It monitors the SQL Servers you point it at and stores what it collects in a database on a SQL Server you choose. AlertLink Technologies has no access to that database, to your monitored servers, or to anything the software collects.

The software sends nothing to AlertLink except one thing: once a day it makes an anonymous HTTPS GET request for a signed update manifest. Version 7.14.0.0 and later request it from https://sqldatacollector.com/updates/sqldatacollector.json. Earlier builds were set to https://alertlinktechnologies.com/updates/sqldatacollector.json, an address that does not serve the file; installing 7.14.0.0 or later moves an install to the new address. The request identifies neither you nor your estate, and you can switch it off in the app's settings. Like any web request, it is recorded in the web server's access log with the requesting IP address. The challenge code on the app's Licence page is never sent automatically; it reaches us only if you paste it into your account or send it to us yourself (section 6).

If you connect to a monitored server with a SQL login rather than Windows authentication, the software can, optionally, store that login's password. Stored passwords are encrypted with AES-256-GCM and kept in your own collector database; they never leave your network. Installs that use Windows authentication store no passwords at all.

15. Children

This site and the software are for businesses. They are not directed at children, and we do not knowingly collect details from children. If you think a child has sent us a request, email us and we will delete it.

16. Changes to this policy

If what the site or the software collects changes, this page changes with it. The current version is always posted at this address with the date at the top.

17. Contact

Questions about privacy, or a request for a copy, correction, or deletion: contact@alertlinktech.com.