Monitoring notice

Who this is for

This notice is for people who use a computer on which their employer, school or other organisation has installed the WatchTower agent. Organisations may give it to their staff or users as part of telling them about monitoring. It does not replace the organisation’s own notice, which should explain why it monitors and how it uses the information.

WatchTower is provided by Nikah AI Ltd, trading as WatchTower. The organisation that installed the agent is the controller and decides what is switched on; we process the information for it. WatchTower is not offered to households for monitoring family members.

What the agent collects by default

The name, operating system and security settings of the device, its IP address and the signed-in user account names.
Programs that start and stop, their command lines, the files they touch (names, locations and fingerprints, not the contents), network connections and the domains contacted.
Installed software and missing updates.
Security detections and any action taken, such as stopping a program or isolating the device.

What the organisation can switch on or use

Which applications are used and for how long, document and window titles, and websites visited (domains, or full addresses).
Data-loss prevention, which checks files being copied to USB, uploaded or emailed for patterns such as card or National Insurance numbers, and records a redacted finding.
Remote support sessions, in which an administrator can see the screen: screenshots are taken every few seconds while the session is open and held briefly (10 minutes by default). Remote support is available unless the organisation turns it off.
Phishing simulations: test emails that record whether they were opened or a link was clicked. Anyone who clicks sees a short training page. Nothing typed into a page is collected.

What WatchTower cannot do

WatchTower has no keylogging, no microphone recording and no webcam capture, in any setting. Apart from the optional data-loss checks and scanning files for malware, it does not read the contents of documents or emails.

Schools and pupils

A school can switch on an education profile, which turns off the activity-tracking features (application and time tracking, document and window titles, and web addresses) while keeping security protection on. The school remains the controller and should explain the monitoring to pupils and parents in a way suited to their age.

How long it is kept and who sees it

Only the organisation’s authorised console users can see the information. Detailed telemetry is deleted automatically after the retention period the organisation has set (normally between 14 and 365 days); alerts and the audit log are kept while the organisation uses WatchTower. We do not sell the information or use it for advertising.

Your rights