Data processing agreement

Effective 5 September 2026 · UK GDPR, EU GDPR, CCPA service-provider terms

This DPA is between the Webhookmill customer (“you”) and Media Yard LLC (“we”, the processor), a United States limited liability company that operates Webhookmill at https://webhookmill.com. New Jersey is our place of establishment. Postal address: Media Yard LLC, PO Box 73, Pennsauken, NJ 08110. Contact hello@webhookmill.com. It is incorporated into the Terms when you use the API, dashboard, or customer portal. You do not need a wet signature for it to apply. For a countersigned copy, email hello@webhookmill.com from the account email. The legal hub lists every policy we publish.

It is meant to satisfy Article 28 UK GDPR (as defined in the UK Data Protection Act 2018), Article 28 EU GDPR, and, where California law applies to that processing, CCPA/CPRA service-provider terms.

Roles

If you determine the purposes and means of the processing of event payloads and customer endpoint data, you are the controller and Media Yard LLC is the processor.

If you process that data on behalf of another controller, you are the processor and we are the sub-processor. Module Three of the 2021 EU SCCs applies instead of Module Two.

For your account email, magic-link session, API-key hashes, and Stripe billing identifiers (Pro and Scale only; Stripe is not used on Starter), Media Yard LLC is the controller. That pile is described in Privacy, not here.

Subject matter

Running outbound webhook delivery: sign, enqueue, deliver, retry, log, and display events in your dashboard and in the customer portal you share. Duration: the life of the account plus the plan retention window for delivery logs. Nature: receive, store for the retention window, transmit over HTTPS, retry on a published backoff, display attempt history. Purpose: so you can send signed webhooks to your customers and they can see delivery status. Types of data: endpoint URLs, signing secrets, event types, event payloads, idempotency keys, attempt metadata, status codes, response snippets, timestamps. Data subjects: whoever appears in a payload or at an endpoint you configure — typically your end customers and their users. You instruct us not to use that pile for Media Yard’s own product research or advertising. Do not enqueue special-category data or PHI unless you have a lawful basis and accept that Webhookmill is not HIPAA certified.

Annex 1 populates SCC Annex I.A, I.B and I.C.

Instructions

You instruct us to process processor data only to sign, enqueue, deliver, retry, log, and display it for the plan window (7 days Starter, 30 days Pro, 90 days Scale), and to operate the customer portal for the endpoint token you share. We will not process it for another purpose unless UK or EU law requires it. No sale of the payload pile. No training a Media Yard model on it. If an instruction would make us break the law, we will say so in writing to hello@webhookmill.com on the account.

Confidentiality and security

Technical and organisational measures are in Annex 2. We review them at least annually. We do not claim SOC 2 or HIPAA.

We will notify you without undue delay, and in any event within 48 hours of becoming aware, of a personal-data breach affecting processor data. That notice will say what happened as we know it, which categories of data are involved, what we are doing, and how to reach us.

We assist you, taking into account the nature of the processing and the information we have, with Articles 32 to 36 and with data-subject requests about processor data.

Subprocessors of processor data

Annex 3 is the list. The public copy is in Privacy.

Before a new subprocessor begins processing processor data we will update Annex 3 and Privacy and email the account owner at least 30 days in advance. You may object by writing hello@webhookmill.com within that window. If we cannot accommodate the objection, you may stop enqueueing events and close the account. We impose data-protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible to you for their performance. On request we will provide a copy of each subprocessor agreement, with reasonable commercial redactions.

Stripe and Resend process account data for which we are the controller. They are not subprocessors of event payloads. Destination hosts you configure receive the signed POST you asked us to send; they are your processors or controllers, not ours.

International transfers

Processor data is hosted in the United States. The Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated:

• Module Two where you are the controller; Module Three where you are a processor
• Clause 7 docking: off
• Clause 9 Option 2, 30 days
• Clause 11 optional body: off
• Clauses 17 and 18: Ireland
• Annex I.A / I.B / I.C = Annex 1; Annex II = Annex 2; Annex III = Annex 3

We have documented the Clause 14 assessment of US law for this processing, including FISA 702 and the CLOUD Act, and will make it available to you or a competent supervisory authority on request.

United Kingdom — UK Addendum

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Switzerland

References to the GDPR are read as references to the Swiss FADP, the FDPIC is the competent authority in Annex I.C for Swiss transfers, and “member state” is read so Swiss data subjects keep the right to sue in their place of habitual residence.

We are not certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

Assistance, return or delete, audits

At the end of the service, at your choice we will delete processor data or return it (export of endpoint configuration and delivery history still within the retention window) and delete remaining copies, and we will certify deletion on request. Invoice and tax records we must keep contain no webhook payload bodies beyond what billing requires.

Close the account by writing hello@webhookmill.com from the account email, or from Settings when that control ships. Cancel plan only stops paid billing; processing of delivery data continues on Starter until you close. We answer rights emails from the account email within one month where UK or EU GDPR requires it. Backups age out. We will give you the security information we actually have. We do not run customer-directed penetration tests on shared infrastructure.

On written request no more than once in twelve months, we make available the information reasonably necessary to demonstrate Article 28. Where that is not enough, you may audit, or appoint an independent auditor who is not our competitor, on thirty days’ notice, during business hours, at your cost unless the audit finds material non-compliance.

CCPA

Where the CCPA/CPRA applies to processor data, Media Yard LLC is a service provider / contractor. We will not sell it, share it for cross-context advertising, retain, use, or disclose it except for the business purposes in Annex 1, combine it with other personal information except as those laws allow, or use it outside the direct business relationship. We will tell you if we can no longer meet those obligations.

Liability and law

Liability follows the Terms, except where UK GDPR Article 82, EU GDPR Article 82, the Clauses, or a similar rule requires a different split. New Jersey law and New Jersey venue for the contract, without limiting those mandatory rules or the Ireland forum in the Clauses for claims the Clauses give to data subjects.

This page is not legal advice. Media Yard LLC does not have lawyers on staff.

Annex 1 — SCC Annex I.A, I.B, I.C

Annex 2 — TOMs

TLS in transit. API keys stored hashed. Signing secrets stored encrypted at rest where the product supports it, accessible only to deliver. Access to processor data limited to people who run Webhookmill, under confidentiality. Delivery logs age out on the plan window. Rate limits and the Acceptable Use Policy reduce abuse of the enqueue API. We review these measures at least annually. We do not train a Media Yard model on payloads. See How we use AI.

Annex 3 — Subprocessors of processor data

This table is the list for processor data from the delivery pile. Stripe and Resend are account processors (we are controller), not subprocessors of payloads. Destination HTTPS hosts you configure receive the signed POST; they are not Media Yard subprocessors.