Legal

Privacy Policy

Last updated: 6 July 2026 · Applies to webhooker.eu and app.webhooker.eu

This policy explains what data Webhooker collects, why, where it lives, and how to get it deleted. The short version: your account data and every webhook payload are stored on servers in the European Union, we collect nothing we don't need to run the service, and we never sell your data.

1. Introduction and Data Controller

Webhooker ("we", "us", or "our") operates an inbound and outbound webhook gateway available at webhooker.eu. We are committed to protecting the personal data of our users and customers in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable EU and EEA privacy laws.

For the purposes of GDPR, Webhooker acts as the Data Controller for personal data collected through this website and the platform. Our infrastructure and the data we process on your behalf is hosted exclusively within the European Economic Area (EEA). Where we engage third-party service providers who process personal data, we do so under binding Data Processing Agreements (DPAs) that ensure an equivalent level of protection.

For any privacy-related inquiries, please contact us at privacy@webhooker.eu.

2. Personal Data We Collect

We collect personal data in the following categories:

• Account data: name, email address, hashed password, and account preferences you provide when registering.
• Billing data: billing name, country, and VAT number where applicable. Full payment card details are handled exclusively by our payment processor and are never stored on Webhooker systems.
• Usage data: IP addresses, browser type and version, operating system, pages and features accessed, timestamps, and actions taken within the platform.
• Webhook payload data: the event payloads, request headers, signing metadata, and delivery logs you route through the gateway. This data may contain personal data of your own users. We process it solely on your instructions as a Data Processor.
• Support communications: messages you send to our support team, including any personal data contained therein.
• Cookie and tracking data: session identifiers and analytics identifiers described in Section 9.

3. Legal Basis for Processing

We process your personal data only where we have a valid legal basis under Article 6 GDPR:

4. How We Use Your Data

• Operating the gateway: receiving events on ingest URLs, verifying signatures, storing events durably, and delivering them to your destinations with retries and replay.
• Processing payments and issuing invoices, including VAT where required under EU regulations.
• Sending transactional notifications (delivery-failure alerts, billing receipts, security alerts). These are part of the service and cannot be opted out of while you hold an active account.
• Providing technical support and responding to inquiries.
• Detecting, investigating, and preventing security incidents, abuse, and violations of our Terms of Service.
• Conducting aggregated, anonymised analysis to improve platform performance and features.
• Fulfilling legal and regulatory obligations.

We never sell your personal data to third parties, and we never use your webhook payload data for advertising or model training purposes.

5. Data Sharing and Sub-Processors

We engage a limited set of trusted sub-processors to help deliver our services. Each sub-processor is bound by a DPA that imposes data protection obligations consistent with GDPR. Categories of sub-processors include:

• Cloud infrastructure providers — for the EU compute, storage, and networking underlying the gateway.
• Payment and billing processor (Creem) — for secure payment collection, subscription management, invoice generation, and VAT compliance. Creem acts as Merchant of Record for our transactions, meaning it is legally responsible for the sale and tax remittance.
• Transactional email providers — for delivery of account, alert, and billing notifications.
• Analytics providers — for aggregated, privacy-preserving usage analytics.
• Customer support tooling — for managing support requests and communications.

We do not disclose personal data to any other third party except when required to do so by applicable law, court order, or to protect the rights, property, or safety of Webhooker, our users, or the public. We will notify you of any such disclosure to the extent permitted by law.

6. International Data Transfers

Our primary infrastructure is located within the European Economic Area (EEA). Where a sub-processor operates outside the EEA, we ensure that any transfer of personal data is subject to appropriate safeguards as required by Chapter V of GDPR, including:

• An adequacy decision by the European Commission (e.g., EU–US Data Privacy Framework).
• Standard Contractual Clauses (SCCs) adopted by the European Commission.
• Binding Corporate Rules (BCRs) approved by a competent supervisory authority.

You may request a copy of the applicable transfer mechanisms by contacting privacy@webhooker.eu.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:

• Webhook events and delivery logs are deleted automatically when your plan's retention window ends: 14 days (Free), 30 days (Pro) or 90 days (Team).
• Account data is retained for the duration of your account and deleted within 30 days of account closure, unless a longer retention period is required by law.
• Billing and invoice records are retained for 7 years to comply with EU accounting and tax regulations.
• Platform logs (access logs, security logs) are retained for up to 90 days for security and debugging purposes.
• Support communications are retained for 2 years from the date of resolution.
• Anonymised and aggregated analytics data may be retained indefinitely as it no longer constitutes personal data.

8. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest using AES-256.
• Tenant-level isolation: each customer's sources, destinations, events and secrets are logically separated.
• Role-based access controls limiting internal access to personal data on a need-to-know basis.
• Regular vulnerability scanning and security reviews.
• Incident response procedures with notification timelines compliant with Art. 33 GDPR (72-hour supervisory authority notification) and Art. 34 GDPR (data subject notification where required).

No method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password, keep your signing secrets confidential, and enable two-factor authentication on your account.

9. Cookies and Tracking Technologies

We use the following categories of cookies:

• Strictly necessary cookies: required for authentication, session management, and CSRF protection. These cannot be disabled without impairing core functionality.
• Analytics cookies: used to measure aggregate usage patterns (page views, feature adoption). These are set only with your consent and process data in an anonymised or pseudonymised form where possible.

You can manage or withdraw cookie consent at any time via your browser settings or our cookie preference centre. Withdrawing consent for analytics cookies does not affect the operation of the platform.

10. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights under GDPR:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data where no overriding legal basis exists for retention. Deleting your account removes your sources, destinations, stored events, delivery logs and API keys.
• Right to restriction of processing (Art. 18): request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): object to processing based on legitimate interests, including profiling.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: you have the right to lodge a complaint with your national supervisory authority.

To exercise any of these rights, contact us at privacy@webhooker.eu. We will respond within 30 days as required by Art. 12 GDPR. Identity verification may be required before we fulfil your request.

11. Children's Privacy

Our platform is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@webhooker.eu and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email (at the address associated with your account) and by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the platform after the effective date of any changes constitutes your acceptance of the revised policy.

13. Contact and Supervisory Authority

For questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact privacy@webhooker.eu.

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your EU/EEA member state of residence or the competent lead supervisory authority.

See also our Terms of Service and Refund Policy.