Privacy Policy

What we collect

Account data: your name and email address, used for authentication and billing.

Webhook payloads: when you route webhooks through a HookShield ingest URL, we store the payload body, headers (with secrets such as Authorization and Cookie redacted), delivery status, and latency — because storing dropped payloads is the core of the service.

Usage data: endpoint configuration, event counts, and plan/subscription state.

How we use it

To forward, store, display, and replay webhook payloads on your behalf.

To detect silent failures (overdue heartbeats, failed forwards) and power alerts.

To bill your subscription and enforce plan limits.

We do not sell your data or use stored payloads for advertising.

Retention

Stored payloads are retained per your plan: Free — 24 hours, Standard — 7 days, Pro — 30 days. A scheduled job permanently deletes events older than your plan window.

Account and billing records are kept while your account is active and as required for tax/legal purposes.

Security

All traffic is encrypted in transit (TLS). Forwarded payloads are signed with an HMAC secret unique to each endpoint, and replays are stamped x-hookshield-replayed-from so receivers can dedupe safely.

Sensitive inbound headers are redacted before storage. Stripe processes payments; we never see or store card numbers.

Sub-processors

Supabase (database + authentication), Vercel (hosting + compute), Stripe (payments). Each processes data only as needed to run the service.

Your rights (UK GDPR)

You can request access, correction, export, or deletion of your personal data at any time by emailing hello@hookshield.co.uk. Deleting your account removes your endpoints and stored events.

You also have the right to complain to the ICO (ico.org.uk).