Privacy Policy

For account registration, security, billing, website operation and support, the Hookstride operator generally determines the purposes of processing. For personal data that a customer chooses to submit in event payloads or destination configuration, the customer determines the purpose and permitted recipients, and Hookstride generally processes the content on that customer's instructions. The Data Processing Addendum describes that service-provider role.

Depending on how you use the Services, we may process:

• Account and organization: names, email addresses, account verification history, workspace/project names, invited members, role assignments, preferences and support correspondence.
• Authentication and security: one-time sign-in challenges, MFA enrollment state, recovery-code verification records, encrypted session material, credential hashes, audit entries, access timestamps, IP addresses and suspected-abuse diagnostics.
• Integration configuration: destination URLs, incoming provider/source identifiers, project keys and signing-secret records, event routing rules, reference mappings and webhook settings.
• Customer event content: event types, IDs, payloads, delivery timestamps, destination responses (which may contain short response previews), retry outcomes and inbound provider notifications.
• Billing: selected plan, project, payment reference, amount, currency, credit balance, verification result, and transaction status. The payment processor handles checkout credentials and applicable payment instruments on its own systems.
• Technical information: device/browser information, requested URLs, errors, security logs, and network identifiers needed to run and protect the Services.

We do not require identity-document photos, biometric data, medical information, or payment card numbers to deliver ordinary webhooks. Customers should avoid including them in event payloads unless expressly agreed and legally authorized.

We receive information directly when you sign up, configure a project, submit a webhook, pay, or contact support; from authorized workspace administrators who invite you; from configured sending applications or third-party providers; and automatically from browsers, servers and security systems as needed to operate the service. If you elect Google sign-in, identity information may be received from Google to authenticate your session.

We use information to provide contracted services, authenticate users, manage team permissions, deliver and troubleshoot webhooks, meter usage, reconcile payments, answer requests, maintain technical security, prevent abuse, and meet legal and accounting obligations. Depending on the data and governing law, processing is based on contract performance, legal obligation, legitimate operational interests, or consent where required. Where consent is relied upon, you may withdraw it without affecting processing already lawfully performed.

We do not sell customer event payloads or use them to build advertising profiles. We do not use submitted webhook content to train general-purpose AI models as part of the current Services.

Customers decide which events to submit, the personal information included, which destinations receive events, and the lawful grounds for those disclosures. A submitted event may be delivered more than once, retried, or logged as part of an error investigation. Your destination may independently store the data after receipt; its handling is governed by the receiving party's own rules.

If your information appears in an event sent by a customer and you want to exercise a privacy right, contact the customer controlling the source application first. Hookstride will assist the customer, or respond directly when the law requires and we can verify the request.

Information may be shared with service providers supporting hosting, network security, database/storage, email delivery, payment processing, identity sign-in and customer support; with receiving webhook destinations selected by the customer; with workspace administrators subject to their role; and with authorities where legally required. We restrict provider access to purposes related to running the service and apply appropriate contractual and security controls where applicable.

Our Service Providers and Subprocessors page describes currently identified third-party service categories and relevant providers. A provider's own services and policies may also apply if you leave Hookstride to sign in or complete checkout.

Service operations and third-party providers may involve storing or accessing information outside your country. Where applicable law restricts international transfers of personal data, the relevant parties must apply the safeguards required by that law, taking account of the transfer, provider, and processing purpose. We do not claim all information is kept exclusively in Ghana or that all transfers use a particular legal mechanism without a verified provider arrangement.

Organizations with specific data residency requirements should contact us before sending regulated personal data and should not assume a selectable hosting region is available.

Security measures used by Hookstride include HTTPS where configured, authenticated project access, restrictions on privileged operations, MFA-supported account protection, API credential controls, incoming provider verification, and restricted outgoing connectivity for applicable backend environments. Certain incoming source secrets are encrypted at rest; other service credentials are managed under their own storage and authorization controls.

No technology eliminates all risk. You are responsible for securing your API keys and receiving systems, minimizing payload contents, verifying webhook signatures, and responding appropriately to exposed credentials. Report suspected vulnerabilities throughSecurity and Vulnerability Reporting.

Webhook event history: the current standard retention setting is 30 days for delivered or terminally failed events, including associated attempts, after which scheduled pruning deletes eligible records. This is a configurable service setting, not a guarantee that every record vanishes exactly 30 days after submission. Pending and in-flight events may be retained while processing, investigation or recovery remains necessary.

Incoming gateway: inbound payload records are generally eligible for the event retention window after their linked deliveries have been removed. Minimal payload-free deduplication receipts can be retained longer (currently a 365-day default) to prevent an old provider notification being treated as new after content cleanup.

Other records: account, security and billing records may be held while a workspace is active or for reasonable legal, accounting, antifraud, incident-response or dispute purposes. Support messages, technical logs, caches and backups have operational schedules that may differ from webhook history. Where immediate deletion cannot be completed in backups or protected records, access is restricted and deletion follows the applicable lifecycle.

Customers should maintain their own application archives. Hookstride is not intended as the primary long-term storage system for business events.

The website uses necessary session and MFA-related cookies to authenticate and secure logins, and local browser storage to remember a light/dark appearance preference. We do not currently set first-party advertising or cross-site behavioral tracking cookies as part of the reviewed frontend. See the Cookie and Storage Policy for specific storage names, approximate lifetimes, and browser controls.

Subject to the law applicable to your information, you may request access, correction, deletion, restriction, or information about our processing; object to certain uses; or withdraw consent where consent is the basis. You may also seek appropriate remedies or complain to the competent supervisory authority. Under Ghana's Data Protection Act, 2012 (Act 843), rights include being informed and requesting access or rectification in the circumstances provided by the Act.

To make a request, select Privacy and data requests in our support form, describe the account or project involved and the action requested, and use an email address you control. We may verify identity or authority and ask for additional information before releasing or deleting records. We will respond within the period required by applicable law.

In Ghana, you may also contact the Data Protection Commission if you believe your data-protection rights have been infringed.

Hookstride is designed for users aged 18 and over, and we do not intentionally offer accounts to children. Customers must not send children's personal information through the Services unless appropriately authorized, lawful, and subject to additional measures agreed with us where required.

We investigate reasonably suspected misuse or unauthorized access and may take proportionate steps to contain incidents. Where notification to a customer, individual, or regulator is legally required, we will provide it as required by applicable law and the relevant agreement. We may preserve or disclose records to respond to enforceable legal requests, protect users, or establish and defend legal claims.

We may revise this policy when our services, processors, retention practices, or legal obligations change. Material changes will be reflected by an updated date and appropriate notice where required. Prior versions can be requested through support when available in our records.