Privacy Policy

1. Introduction

HostWebhook ("we", "us", "our") operates hostwebhook.com. We provide workflow automation infrastructure: you receive events from webhooks, schedules, and connected apps, then route them through pipelines that transform, filter, enrich, and deliver the result wherever you choose. This Privacy Policy explains what we collect, why, who else touches it, and what you can do about it.

It covers the dashboard, the API, the CLI, the hosted chat and voice pages, and every node that runs inside a pipeline.

2. Two Kinds of Data

Almost every question about privacy on this platform has a different answer depending on which of these two you mean, so we separate them up front.

• Account Data — information about you as our customer: your email, your sessions, your billing record. For this data we are the controller and this policy describes what we do with it.
• Customer Data — everything that flows through your pipelines: webhook payloads, records pulled from connected apps, files, chat transcripts, and the configuration you build. Some of it may be personal data about people who are not our customers.

For Customer Data we act as a processor (service provider) and you are the controller. We process it only on your documented instructions — which, in practice, means the pipelines you build and run. We do not mine it, profile it, sell it, or repurpose it. You are responsible for having a lawful basis to send us that data and for telling the people it describes what you are doing with it.

3. Information We Collect

By category, with the purpose for each:

• Account and identity — email address, name, avatar URL, timezone, and (if you sign in with Google) your Google account identifier. Used for authentication, notifications, and support.
• Session and security — IP address, approximate country and city derived from it, browser User-Agent, client type (web, CLI, mobile), and last-used timestamp. Used to show you your active sessions, to let you revoke one, and to detect abuse.
• Pipeline configuration — nodes, transforms, filters, schedules, prompts, connections, and canvas layout.
• Event and run data — incoming payloads, the output of each node, delivery attempts, retries, and errors.
• Credentials — OAuth tokens, API keys, bot tokens, signing secrets, and database connection strings you save. Encrypted at rest and never returned to the browser once stored.
• Files — anything uploaded to the media library or pulled in by a file node, plus derived thumbnails.
• Conversations — messages exchanged on a hosted chat page, and transcripts of voice agent calls.
• AI content — prompts, model responses, tool calls, token counts, and cost. See section 4.
• Usage and billing — event counts, AI credits consumed, plan tier, and your Stripe customer and subscription identifiers.
• Audit logs — who in your organization did what, and when a credential was read and by which node.

We do not collect advertising identifiers, cross-site tracking data, biometric data, or precise geolocation.

4. AI Features

HostWebhook uses AI in two distinct ways, and the difference matters because it changes whose account the data is sent under and who chose the provider.

4.1 AI we run for you (platform AI)

Some features in the dashboard call a model on our own account and bill you in AI credits. Today these are: rewriting a prompt you are drafting, building a pipeline from a description on the canvas, the in-app assistant chat, adapting and scoring social media captions per platform, and generating descriptions for MCP tools. These run on Anthropic's Claude models. What we send is the text you typed plus the surrounding context the feature needs — for the canvas builder, that includes the shape of your pipeline.

4.2 AI you run yourself (the AI Node)

When you put an AI Node in a pipeline, it runs under your own credential with the provider you pick: Anthropic, OpenAI, Google, or a self-hosted Ollama endpoint. Whatever the node receives — which can include the full event payload — is sent to that provider under their terms and privacy policy, not ours. Choosing a provider is choosing where that data goes. A self-hosted Ollama endpoint keeps it on infrastructure you control.

4.3 Supporting AI services

• Embeddings — vector memory and vector store nodes send text to OpenAI to produce embeddings for similarity search.
• Voice agents — audio is transcribed and synthesized through OpenAI and ElevenLabs. Call audio and transcripts are stored in object storage.
• Memory backends — conversation memory can live in our built-in vector store or in a backend you point at: your own MongoDB, your own PostgreSQL, or ContextWindow. You choose, with your credential.
• MCP servers — an AI Node can call tools on external MCP servers you connect. This is off by default and enabled per node; the node sends those tools only the arguments the model produces.

4.4 AI trace logging

So you can debug what a model actually did, we record each AI call: the prompt and system message, the response content, tool calls, token counts, latency, cost, and any error. These traces power the observability panel in your dashboard, are visible only to your organization, and are deleted on your plan's retention schedule along with the rest of your run history.

4.5 What we do not do with AI

• We do not use your data — prompts, payloads, files, or configuration — to train, fine-tune, or evaluate any model, ours or anyone else's.
• The providers we call on your behalf do not train on API traffic under their commercial terms.
• We do not use AI to make automated decisions that produce legal or similarly significant effects about you. Every AI Node runs inside a pipeline you built, on data you routed to it, toward an outcome you defined.
• We do not profile you or your end users for advertising.

Model output can be wrong. Treat anything a pipeline generates as a draft that needs a human check before it reaches a decision that matters.

5. How We Use Your Information

We use what we collect to:

• Run your pipelines — receive events, execute nodes, and deliver results to the destinations you configured
• Authenticate you, keep sessions valid, and let you review and revoke them
• Send failure alerts, approval requests, system notices, and account email
• Meter usage against your plan and process billing
• Keep the service up: monitor health, diagnose failures, prevent abuse, and enforce rate limits
• Provide support when you ask for it
• Comply with legal obligations

Where the GDPR applies, our legal bases are performance of a contract (running the service you signed up for), legitimate interests (security, abuse prevention, and service improvement), and legal obligation (tax and accounting records).

6. Google API Data

When you connect a Google account via OAuth2 to use Sheets, Drive, Docs, Calendar, Gmail, Contacts, or Analytics:

• We access Google data only to perform the operations configured in your pipelines, and only within the scopes you granted
• We store OAuth refresh tokens encrypted with AES-256-GCM
• We do not transfer Google data to third parties for our own purposes, use it for advertising, sell it, or allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or in aggregated and anonymized form for internal operations
• We do not use Google data to train generalized or non-personalized AI models
• HostWebhook's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements

One thing worth stating plainly: if you build a pipeline that takes data out of Google and sends it somewhere else — into an AI Node, an HTTP Action, a database, a Slack channel — that transfer happens because you configured it. You direct it, you are responsible for it, and it is not a transfer we make for our own purposes. You can see every such route on your canvas, and remove it there.

7. Data Storage & Security

• Records are stored in MongoDB with encryption at rest; files live in S3-compatible object storage
• Credentials — API keys, OAuth tokens, signing secrets, connection strings — are encrypted with AES-256-GCM and are never sent back to the browser after you save them
• All connections use HTTPS/TLS in transit
• Outbound requests to addresses you supply are validated against SSRF attacks, and databases that are not publicly reachable are contacted over a tunnel rather than by opening them to the internet
• Access to your data is scoped to your organization, and every credential read by a node is logged
• Account passwords are hashed; we never store them in a form we can read

No system is perfectly secure. We follow industry practice for access control and infrastructure security, and we keep the blast radius of any single failure as small as we can.

8. Data Retention

Operational data is deleted automatically on the schedule below. Retention scales with your plan:

• Audit and access logs are kept for at least 30 days on every plan, including Free. A plan can raise that floor but not lower it — these logs are how a security question gets answered after the fact.
• Credentials and OAuth tokens are kept until you delete them or revoke access at the provider
• Files stay until you delete them or delete the workspace holding them
• Account and organization records are kept for as long as the account exists
• Invoices and billing records are kept as long as tax law requires, even after deletion

Deleting your account is immediate and permanent. There is no soft delete and no undo: your sessions and your user record are destroyed before the request even returns, and the cascade that removes everything you own — organizations, workspaces, pipelines, credentials, run history, and stored files — runs right behind it. Backups age out on their own cycle within 30 days.

9. Subprocessors

These providers operate on every account, because they are how the platform runs:

These receive data only if you connect them. Adding a credential or a node is what starts the flow; removing it stops it:

• OpenAI — AI Node completions, text embeddings for vector memory, and audio transcription
• Google — Sheets, Drive, Docs, Calendar, Gmail, Contacts, Analytics, and Gemini models
• ElevenLabs — Speech synthesis for voice agents
• Slack, Discord, Telegram, WhatsApp — Message delivery and trigger events
• X, LinkedIn, Bluesky, Mastodon, Threads, Instagram, Facebook — Publishing and reading social media posts
• Notion, Atlassian (Jira, Confluence) — Reading and writing records in your workspace
• Firecrawl — Web page scraping and extraction
• AWS S3 — Object storage in a bucket you own
• MCP servers you connect — Tools an AI Node may call, scoped per node

Each provider has its own privacy policy and its own terms. We send each one the minimum the integration needs to work, and nothing else. We will update this list before adding a subprocessor that touches personal data.

10. Cookies

We use two cookies, both strictly necessary, both httpOnly so no script on the page can read them:

• accessToken — proves who you are on each request. Short-lived.
• refreshToken — issues a new access token so you stay signed in. Expires after 7 days of disuse.

That is the entire list. We run no analytics, no advertising pixels, and no third-party trackers — no Google Analytics, no Facebook Pixel, no session recording. Nothing follows you off this site. Because we set no optional cookies, there is no consent banner to click through, and clearing these two simply signs you out.

11. Your Rights

Wherever you are, you can:

• Access your personal data and pipeline configuration
• Correct anything inaccurate, from your profile settings
• Delete your account and everything it owns
• Export your data in a machine-readable format
• Revoke any OAuth connection or session at any time
• Object to or restrict processing based on legitimate interests
• Complain to your local data protection authority

California residents (CCPA/CPRA)

You have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them. Categories collected and their retention are listed in sections 3 and 8.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising — not in the last 12 months, and not as a matter of how this product is built. There is no advertising business here to sell it to. We honor Global Privacy Control signals, though with no sale or sharing to opt out of, the signal has nothing to disable.

To exercise any of these rights, use the dashboard settings or write to [email protected]. We answer within 30 days. If you are asking about data inside another company's pipeline, we will point you to that company — for Customer Data they are the controller and we act on their instructions.

12. International Transfers

Our infrastructure runs in the United States, and HostWebhook is operated from Mexico. If you are in the European Economic Area, the United Kingdom, or Switzerland, using the service means your data is transferred to and processed in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses for those transfers. Any node you configure to call a service in another region will send data there as well.

13. Children's Privacy

HostWebhook is a developer tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to us and we will delete it.

14. Security Incidents

If a breach affects your personal data, we will notify you without undue delay and, where the law sets a deadline, within it — 72 hours of becoming aware, under the GDPR. The notice will say what happened, what data was involved, what we have done, and what we recommend you do. If you believe you have found a vulnerability, report it to [email protected] and we will respond.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date, and for changes that meaningfully expand what we collect or who receives it, by email. Your continued use of the service after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at: [email protected]