This Privacy Policy describes how Webhook Watchtower (“Webhook Watchtower”, “we”, “us”, or “our”) handles personal data when you use the Service available at webhookwatchtower.co.uk (the “Service”). Webhook Watchtower is the data controller for the personal data described in this policy unless otherwise stated.
Please read this policy carefully. By registering for or using the Service you confirm that you have read and understood it.
1. Data We Collect
Account data
When you register, we collect your email address and any profile information you provide. Authentication is managed by Supabase; your password is never stored by us in plaintext or in a recoverable form.
Workspace and configuration data
We store the workspace name, project names, and the source and destination configurations you create. We also store usage metrics (event counts, delivery outcomes, and retry records) in order to operate the Service and enforce plan limits.
Webhook event data
Webhook events received through the Service (including HTTP headers, raw request bodies, source IP addresses, and associated metadata) are stored for the duration of your plan’s retention period. After that period, event data is permanently deleted.
Request headers, including authentication headers and provider signature headers, are stored as received rather than redacted. Delivery and replay preserve body bytes and a supported allowlist of provider signature and event identity headers. Authentication credentials, cookies, and unsafe transport headers are excluded from forwarding. Stored headers are protected by the same encryption at rest and access controls as the rest of your data in Supabase, our database provider, but they are not separately encrypted at the application level. Source tokens used to authenticate incoming webhooks are hashed and never stored in plaintext.
You are responsible for ensuring that any personal data present in webhook payloads is processed in accordance with applicable data protection law. Where the Service processes personal data contained in webhook payloads, we do so as a data processor acting on your instructions, and you remain the data controller for that personal data.
Billing data
Payment processing is handled entirely by Stripe. We do not store payment card numbers or CVV codes. We receive and retain a Stripe customer identifier, subscription status, and billing period information for account management purposes. Stripe’s privacy policy governs data they hold on their own systems.
Technical and diagnostic data
We collect standard server logs (including IP addresses, request timestamps, and HTTP response codes) to operate and secure the Service. We use Sentry for error monitoring; diagnostic data is sent to Sentry when application errors occur, with sensitive values such as authentication headers and signing secrets scrubbed before transmission. We also collect aggregated, anonymised usage statistics through Vercel Analytics to understand how the Service is used at an aggregate level.
2. How We Use Your Data
We use the data we collect to:
- create and manage your account and workspace;
- provide the Service: ingesting, storing, routing, retrying, and replaying webhook events;
- process payments and manage your subscription;
- send transactional communications, including account confirmation, workspace invitations, delivery failure alerts, and billing receipts;
- monitor the reliability and performance of the Service and investigate errors;
- enforce plan limits and rate limits;
- comply with applicable legal obligations.
We do not sell personal data. We do not use webhook event payloads for any purpose other than providing the Service on your behalf.
3. Legal Basis for Processing (UK GDPR)
We rely on the following legal bases:
- Contract performance: processing your account data and event data is necessary to provide the Service you have subscribed to.
- Legitimate interests: processing technical and log data is necessary to maintain the security, reliability, and performance of the Service.
- Legal obligation: we may retain certain records where required by applicable law, including financial records.
4. Sub-processors
We engage the following sub-processors to help deliver the Service. Each is bound by appropriate data protection agreements.
- Supabase: authentication, database hosting, and storage. Data is hosted within the European Union.
- Railway: infrastructure hosting for the API server and background worker services.
- Vercel: hosting for the web application.
- Stripe: payment processing. Stripe holds PCI DSS Level 1 certification.
- Resend: transactional email delivery for account and operational notifications.
- Sentry: application error monitoring. Sensitive values are scrubbed from error reports before they leave our servers.
We do not share personal data with any other third party except where required by law or with your explicit consent.
5. Data Retention
Webhook event data is retained for the period defined by your active plan: 1 day on Scout, 7 days on Guard, 30 days on Sentinel, 90 days on Bastion, and a custom period on Enterprise. Events outside the retention window are deleted automatically and cannot be recovered.
Account and workspace data is retained for as long as your account remains active. Following account closure or termination, personal data is deleted within 90 days, except where retention is required by law: for example, billing records which we are required to keep for 7 years under UK tax legislation.
6. Data Processing Agreements
Business customers who process personal data through the Service and require a formal Data Processing Agreement (DPA) may request one by contacting us at hello@webhookwatchtower.co.uk.
7. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Access: to request a copy of the personal data we hold about you;
- Rectification: to ask us to correct inaccurate or incomplete data;
- Erasure: to ask us to delete your personal data, subject to legal retention obligations;
- Restriction: to ask us to limit how we process your data in certain circumstances;
- Portability: to receive your data in a structured, commonly used, machine-readable format;
- Objection: to object to processing carried out on the basis of legitimate interests.
To exercise any of these rights, contact us at hello@webhookwatchtower.co.uk. We will respond within one calendar month. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.
8. Security
We apply industry-standard security measures including TLS encryption for data in transit, hashed source tokens, AES-256-GCM encryption for sensitive configuration values such as signing secrets, and role-based access controls throughout the Service. Sensitive headers are scrubbed from error reports before transmission to third-party monitoring services. No method of transmission over the internet is entirely secure; we cannot guarantee absolute security, but we take reasonable and appropriate technical and organisational measures to protect your data.
9. Cookies
We use only essential cookies required for authentication and session management. We do not use tracking or advertising cookies. Aggregate analytics are collected through Vercel Analytics using a privacy-preserving approach that does not use cookies or fingerprinting.
10. International Data Transfers
Your data is primarily stored and processed within the European Union via Supabase. Where any data is transferred outside the UK or EU, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses where applicable.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via an in-app notice before they take effect. The current version is always available at webhookwatchtower.co.uk/privacy. Continued use of the Service after the effective date of an updated policy constitutes acceptance of that policy.
12. Contact
For privacy-related questions, requests to exercise your rights, or data protection enquiries, please contact us at hello@webhookwatchtower.co.uk.