Privacy

https://webhookmill.com is operated by Media Yard LLC, PO Box 73, Pennsauken, NJ 08110. Contact hello@webhookmill.com.

If you are in the United Kingdom or the European Economic Area, UK GDPR and EU GDPR apply to personal data we process about you. Media Yard LLC is the controller of account and billing data described here. Event payloads and customer endpoint data you enqueue are handled as a processor under the DPA. We have not appointed a DPO. We have not appointed an Article 27 representative in the Union. If we do, this section will name them.

We do not sell personal data. We do not run advertising pixels on the product. We do not train a model on your webhook payloads.

Roles in one line

Account email, magic-link session, API-key hashes, and Stripe billing identifiers: Media Yard LLC is the controller. Event payloads, endpoint URLs, signing secrets, event types, delivery attempts, status codes, and response snippets you enqueue so we can deliver and log them: you are the controller and Media Yard LLC is the processor (DPA).

What we collect as controller

• Account email for magic-link authentication
• API key hashes (we do not email the secret again after you copy it)
• Plan, Stripe billing identifiers, and invoice status on Pro and Scale (we do not store full card numbers; Stripe is not used on Starter)
• A session cookie after sign-in
• Server logs (IP, user agent, timestamps) needed to keep the site and API up
• What you write to hello@webhookmill.com

We do not ask for phone numbers. We do not collect advertising identifiers.

What we process as processor

When you enqueue an event we process, to deliver and log it:

• Endpoint URLs, signing secrets, and event types you configure
• Event payloads and optional idempotency keys
• Delivery attempts, status codes, response snippets, and timestamps
• Customer-portal views of that delivery history for the endpoint token you share

Retention of delivery logs follows the plan window: 7 days Starter, 30 days Pro, 90 days Scale. See the DPA.

What we do not collect

We do not sell personal data. We do not run advertising or remarketing pixels on the product. We do not ask for phone numbers for SMS. We do not run a model over your webhook payloads in v1.

How we use controller data

We use email to sign you in and to send transactional notices. We use Stripe to bill Pro and Scale. We use logs to keep the product up and to enforce the Acceptable Use Policy. We do not use payloads to train a Media Yard model.

Cookies and analytics

We only use cookies that are strictly necessary to run a session or keep you signed in after a magic link. We do not use advertising, analytics, or remarketing cookies on the product. If that changes, this page will say so before any tracking script ships.

Who else processes data

Processor data (delivery pile — DPA Annex 3)

Account processors (we are controller)

Before a new party begins processing delivery (processor) data we will update this page and the DPA and email the account owner at least 30 days in advance. We may disclose data if the law requires it, or if Media Yard LLC is sold, to the buyer under this notice.

International transfers

The product is hosted in the United States. For EEA, UK, or Swiss personal data in the delivery pile, transfer terms are in the DPA (2021 EU SCCs Module Two / Three, UK Addendum, Clause 7 docking off). We have documented the transfer impact assessment of US law and will make it available on request. We are not certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

Security and breach

Traffic uses TLS. API keys are stored hashed. Signing secrets are stored so we can sign; rotate them if a destination is compromised. Access is limited to people who run Webhookmill. If we become aware of a personal-data breach, we notify affected account holders without undue delay and, where the law requires, within 48 hours. Processor-data breach notice under the DPA is also within 48 hours.

Retention

Delivery logs: plan window (7 / 30 / 90 days). Account records stay until you ask us to close the account. Invoice and tax records stay as the law requires. Backups age out.

Your rights

Email hello@webhookmill.com from the account email to access, correct, export, or delete your account data. If UK GDPR or EU GDPR applies, you may also object, restrict, or complain to a supervisory authority (ICO, your EU SA, or Swiss FDPIC). We answer within one month. Erasure of delivery logs still respects the plan retention window and legal holds on invoices.

CCPA and similar US state laws

We do not sell or share personal information as those words are used in the CCPA/CPRA. We do not use it for cross-context advertising. Virginia, Colorado, Connecticut, Utah, and New Jersey: email hello@webhookmill.com from the account email.

Children

Webhookmill is a B2B product for indie SaaS teams. You must be 18 or older. We do not knowingly create accounts for anyone under 18.

Changes

We will date this page when it changes and, for a material change, email the account if we have one.

Contact

Media Yard LLC, PO Box 73, Pennsauken, NJ 08110 · hello@webhookmill.com

No advertising pixels. No model over your payloads in v1.