Privacy policy · WebhookVault

1. Scope

This policy applies to webhookvault.net, the WebhookVault application and API, and related services (together, the “Services”), operated by WebhookVault (“we”, “us”). It covers personal information about visitors, account holders and members of customer workspaces. Data that customers send to or process through the Services (“Customer Data”) is addressed in section 5. Use of the Services is also governed by our Terms of service.

2. Information we collect

Information you provide.

Account information: name, email address and authentication credentials, including two-factor authentication and passkeys.
Workspace information: workspace names, members, contacts, settings and configuration.
Communications: messages you send us through the contact form, in-app support or email.

Information collected automatically.

Device and usage information: IP address, browser and device type, pages viewed, referring pages, the campaign that brought you to the Services, approximate location derived from your IP address, and dates and times of access.
Log and security information generated by your use of the Services, including sign-in and account events.
Information collected through cookies and similar technologies, described in section 7.

Information from third parties.

Sign-in providers: if you sign in with a third-party account, we receive your name, email address and account identifier from that provider.
Payment provider: Paddle, our merchant of record, provides us with the status of your purchases and subscriptions. Payment card details are collected and held by Paddle, not by us.
Advertising partners: information about the advertising campaign that referred you.

3. How we use information

To provide, operate and maintain the Services and your account.
To authenticate users and secure accounts and the Services.
To process purchases and manage subscriptions.
To send service communications, such as verification, security, billing and operational notices.
To respond to requests and provide support.
To measure and improve the Services and our website.
To measure the performance of our advertising.
To detect, prevent and respond to fraud, abuse and security incidents.
To comply with legal obligations and enforce our terms.

4. Legal bases for processing

Where the General Data Protection Regulation or the UK GDPR applies, we process personal information on the following bases: performance of a contract, to provide the Services you request; legitimate interests, to secure, measure and improve the Services and to communicate with you, where those interests are not overridden by your rights; consent, for advertising cookies and similar technologies where consent is required; and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time.

5. Customer Data

Customers use the Services to receive, store and forward data sent by third-party systems. That data may include personal information about the customer’s own users. For Customer Data, the customer is the controller and we act as a processor, processing it only to provide the Services and in accordance with the customer’s instructions and our Terms of service. We do not sell Customer Data or use it for advertising. Customers are responsible for having a lawful basis for the data they send to the Services. Requests from individuals concerning Customer Data should be directed to the relevant customer.

6. How we share information

We share personal information with:

Service providers that host, deliver, secure and support the Services, including hosting, network, content delivery, email delivery, security and anti-abuse providers, acting on our behalf.
Paddle, our merchant of record, which processes purchases, payments and tax under its own privacy policy.
Advertising partners, to measure the performance of our advertising, subject to your cookie choices.
Sign-in providers, where you choose to sign in with a third-party account.
Authorities, regulators or other parties where required by law or legal process, or where necessary to protect the rights, safety or property of WebhookVault, our users or others.
A successor or acquirer in connection with a merger, acquisition, financing or sale of assets.
Other parties with your consent or at your direction.

We do not sell personal information.

7. Cookies and similar technologies

We use cookies and similar technologies that are:

Strictly necessary, to sign you in, secure the Services and remember your preferences. These cannot be switched off.
Analytics, to understand how the website and the Services are used.
Advertising, set by our advertising partners to measure the performance of our advertising.

Where required by law, advertising cookies are used only with your consent. You can change your choice at any time through Cookie settings at the foot of our website. We treat a Global Privacy Control signal as a refusal of advertising cookies. You can also block or delete cookies in your browser; some parts of the Services may not work without strictly necessary cookies.

8. International transfers

We and our service providers may process personal information in countries other than the one in which you live. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions or appropriate safeguards such as the European Commission’s standard contractual clauses.

9. Retention

We keep personal information for as long as necessary for the purposes described in this policy, including providing the Services, maintaining security, resolving disputes and meeting legal, tax and accounting obligations. Customer Data is retained according to the customer’s plan and settings and is deleted when the customer deletes it or closes their account, subject to limited retention in backups for a short period. Billing records are retained as required by law.

10. Security

We use technical and organisational measures designed to protect personal information against unauthorised access, loss and misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive it in a portable format, and to withdraw consent. You can manage much of your information directly in the Services, including closing your account. To exercise other rights, contact us as described in section 16. We may need to verify your identity before acting on a request, and we respond within the time required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

12. United States privacy rights

Residents of certain US states may have rights to know, access, correct and delete personal information, and to opt out of the sale of personal information, the sharing of personal information for cross-context behavioural advertising, and targeted advertising. We do not sell personal information. Our use of advertising technologies may be considered sharing or targeted advertising under some state laws; you can opt out through Cookie settings, and we honour Global Privacy Control signals as an opt-out. We will not discriminate against you for exercising these rights. You may use an authorised agent to submit a request where the law allows.

13. Children

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If we learn that we have collected such information, we will delete it.

14. Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

15. Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last changed. Where changes are material, we will provide notice through the Services or by email.

16. Contact

For questions or requests about this policy or your personal information, contact us through our contact page or at [email protected].