Privacy Policy

webhooks.cc is run by enkelt.design, a personally owned Danish business (personligt ejet mindre virksomhed) owned and operated by Mads Sauer. enkelt.design is the data controller for the personal data described in this policy.

Business

enkelt.design

CVR

45871290

Address

Lille Bygade 13, 2635 Ishøj, Denmark

Email

[email protected]

Our servers are in the European Union. The database that holds accounts, endpoints, captured requests, teams, and billing records runs on a server we rent from Hetzner Online GmbH in Falkenstein, Germany, and Hetzner keeps the backups of that server in Falkenstein too. Supabase, the database and sign-in software we use, runs on that same server; Supabase Inc. does not receive your data.

The emails we send leave from our own mail server in Copenhagen, Denmark, and are delivered through Amazon SES in Frankfurt, Germany. Product analytics are stored in PostHog's EU region in Frankfurt.

All traffic to webhooks.cc, including every webhook sent to an endpoint, passes through Cloudflare, which protects the site against attacks. Cloudflare decrypts and re-encrypts each request at the data center nearest to whoever sent it, which can be outside the EU. A few of the services we use are run by companies based in the United States; see International Transfers below and our list of subprocessors.

Account info. When you sign in with GitHub or Google, we receive your email address, display name, and profile picture from the OAuth provider. When you sign up with an email address and password, we receive the email address you provide; the password is stored only as a salted hash by our authentication system (Supabase GoTrue).

Teams. If you create or join a team, we store the team name, its members and their roles, and the email addresses of people invited to it.

Webhook data. We store the requests sent to your endpoints: HTTP method, path, headers, query parameters, request body, and sender IP address. Captured requests can contain personal data about other people, depending on what your senders include; see Webhook Contents.

Notifications. If you set a notification URL on an endpoint, each captured request sends its method, path, sender IP address, time, and the start of its body to that URL. You choose the destination.

API keys. We store API keys only as a hash, together with the name you give them, when they were created, and when they were last used.

Billing identifiers. If you subscribe to a paid plan, we store your Polar customer ID and subscription ID. Your payment details are collected by Polar; we never see or store payment card details.

Audit and sign-in records. When you change account, team, billing, API key, or endpoint settings, we record what changed, when, and your browser's user agent. Our sign-in system records sign-ups, sign-ins, and password resets together with your email address.

Usage counts. We count captured requests per endpoint per day. The counts contain no request contents.

Server logs. Our servers write technical logs, which can include IP addresses, so we can diagnose problems and stop abuse. Error reports and these logs go to StatOSS, our own monitoring service, which keeps them on servers in Denmark and Germany for up to 90 days; they never include the contents of captured webhooks. When a page of webhooks.cc fails in your browser, the browser sends StatOSS a report too: the error, the page address without its query, and your browser and operating system. The report leaves out your email address and your IP address, and StatOSS does not keep the IP address the report arrives from.

Analytics. See Analytics below.

To provide the service you signed up for (GDPR Art. 6(1)(b), performance of a contract): signing you in, capturing and showing your webhooks, teams, notifications, billing, and service emails such as sign-up confirmations, team invites, and quota notices.

To keep the service secure and working (GDPR Art. 6(1)(f), legitimate interest): rate limiting, abuse prevention, audit records, error monitoring, and server logs.

To improve the product (GDPR Art. 6(1)(f), legitimate interest): the analytics described below.

We do not sell your data or use it for advertising.

You decide what is sent to your endpoints. If captured requests contain personal data about other people, you are responsible for having a lawful basis to send it to us. We process that data only to provide the service to you: we store it, show it to you and your team, deliver the notifications you set up, and delete it on schedule. We do not use it for anything else.

If your organization needs a data processing agreement (DPA) under GDPR Article 28, email [email protected]. We review each request individually and reply with what we can offer.

We use these companies to run webhooks.cc:

• Hetzner hosts our servers and backups in Germany
• Cloudflare protects and delivers all traffic to webhooks.cc
• Webdock hosts our mail server and our error and log monitoring in Denmark
• Amazon SES delivers our emails from Germany
• PostHog provides product analytics from its EU region
• Polar sells our paid plans as merchant of record and processes payments

Our list of subprocessors shows what each one receives and where. If you sign in with GitHub or Google, that provider handles the sign-in under its own privacy policy. We do not use advertising networks.

Cloudflare, PostHog, and Polar are companies based in the United States, as are GitHub and Google if you use them to sign in. Where your personal data reaches a company outside the EU or EEA, the transfer is covered by the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses, or both. Our list of subprocessors shows which applies to each company.

We use PostHog to understand how people use webhooks.cc. PostHog keeps a random anonymous identifier in your browser's localStorage to recognize returning visitors on webhooks.cc. It does not use cookies and does not track you across other sites.

What we collect. Page views, time on page, clicks on links and buttons, page load performance, referrer URL, UTM campaign parameters, and which of our two visual styles you see. For signed-in users we associate these events with your account and send your email address and plan with them. Like any web request, sending them reveals your IP address to PostHog.

What we do not collect. We do not record your sessions, fingerprint your browser, track you across sites, or build advertising profiles.

Legal basis. We process this data under legitimate interest (GDPR Art. 6(1)(f)) to improve our service. You can object by emailing us, or opt out by using a standard content blocker that blocks PostHog.

Data location. Analytics events are sent through our own address, f.webhooks.cc, to PostHog's EU region and stored there. See PostHog's privacy policy.

Free plan: Captured requests are deleted 7 days after they are received.

Pro plan: Captured requests are deleted 31 days after they are received.

Team-shared endpoints: Requests billed to a team's subscription are retained for 31 days regardless of the endpoint owner's plan.

Guest endpoints: Endpoints created without an account, and their requests, are deleted 12 hours after they are created.

Account data: Your account, endpoints, teams, and API keys are kept until you delete them or your account.

Audit and sign-in records: Deleted after one year.

Usage counts: Kept after the requests themselves are deleted, so usage history stays available. When you delete your account they are no longer linked to you.

Server logs: Kept in size-limited files that are overwritten automatically as new entries arrive.

Backups: Hetzner keeps seven daily backups of our server and deletes the oldest each time it makes a new one, so data you delete leaves the backups after about a week.

Billing records: Polar keeps the records of your purchases as the law requires of a seller.

Cookies. Supabase sets the cookies that keep you signed in. When you create an account we also set a short-lived cookie (whk_signup, at most one hour) so our analytics can count the new account; it is deleted as soon as it has been read. We do not use tracking cookies.

localStorage. Your theme and visual style, which style you were assigned to if you are part of our design experiment, dashboard layout preferences, and PostHog's anonymous identifier.

Under the GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to restrict how we use it, receive it in a portable format, and object to processing based on legitimate interest, including analytics. Email [email protected] and we will reply within one month.

You can also delete your endpoints and their captured requests at any time from the dashboard, and your whole account from your account page.

If you think we handle your data unlawfully, you can complain to the Danish Data Protection Agency, Datatilsynet, or to the data protection authority in the EU country where you live or work.

We update the date at the top of this page whenever this policy changes.

Questions about this policy or your data? Email [email protected].