Privacy Policy

1. Data controller

OpenWebhook is operated by David Lorenzo García, a self-employed sole trader ("autónomo") registered in Spain.
Tax ID (NIF): 12395061Q
Address: Urbanización Espejo del Mar, 04002 Almería, Spain
Privacy contact: support@openwebhook.co

2. Data processed by OpenWebhook

OpenWebhook does not require an account, name, email address, or payment details. Depending on how you use the service, it processes the following categories:

• Session identifier. Your browser creates a UUIDv6 used to route requests to your live inspector.
• Webhook request data. Method, path, query parameters, headers, body, source IP, receive time, and payload size pass through server memory while a request is relayed.
• Local event history. The latest 200 events are stored in IndexedDB on your device, not in our server database.
• Aggregate website analytics. Public pages use Simple Analytics as described below.

3. How webhook requests are handled

The server reads an incoming request and forwards it over a Server-Sent Events connection to browsers listening to the matching UUID. Request data exists transiently in process memory for this purpose. It is not written to an application database, file, queue, or server-side event history.

If no browser is connected, a valid request receives a response and is discarded. The production reverse proxy is configured not to create an access log for OpenWebhook, so UUIDs, paths, query strings, and source IPs are not retained there.

4. Browser storage and retention

A strictly necessary first-party cookie stores the UUID for up to one year so your endpoint survives a browser restart. IndexedDB stores a maximum of 200 events for that UUID. Older events are removed automatically.

You can delete one event, clear the complete local history, or generate a new session at any time. Clearing browser site data also removes the cookie and IndexedDB records. Browser vendors may evict local storage under their own policies.

5. Purposes and legal bases

Where the GDPR applies, data is processed to:

• provide the webhook inspection service you request, under Article 6(1)(b) GDPR;
• keep the service secure, prevent abuse, diagnose failures, and understand aggregate usage, based on our legitimate interests under Article 6(1)(f) GDPR;
• comply with a legal obligation where Article 6(1)(c) GDPR applies.

The session cookie is required to provide the endpoint and is not used for advertising or cross-site tracking. OpenWebhook does not use webhook content to train AI models, build advertising profiles, or sell personal data.

6. Privacy-first analytics

Public pages use Simple Analytics to measure aggregate product usage. The integration uses no advertising cookies and is configured to respect Do Not Track. Webhook bodies, headers, UUIDs, and live event details are not sent to Simple Analytics.

7. Service providers and international transfers

OpenWebhook uses OVHcloud for hosting and Simple Analytics for aggregate web analytics. These providers process limited data only to supply their services and publish their own privacy and security terms. The production service and analytics provider are based in the European Union.

We do not sell or rent data. Data may be disclosed when required by applicable law or a valid order from a competent authority.

8. Security and appropriate use

Traffic is encrypted with HTTPS/TLS. The application runs behind a restricted reverse proxy, applies request-size and connection limits, and does not expose a payload database. No internet service can guarantee absolute security.

A webhook UUID is a bearer secret: anyone who knows it can send requests or connect to its live stream. Generate a new session if the URL is exposed. Do not submit production secrets, payment card data, health information, credentials, or data you are not authorized to process.

9. Your responsibilities

If you configure another service to send personal data to OpenWebhook, you are responsible for having a lawful basis and for informing the affected individuals where required. Use test or synthetic payloads whenever possible.

10. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may request:

• access to personal data concerning you;
• rectification of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability where legally applicable; and
• withdrawal of consent where processing relies on consent, without affecting prior lawful processing.

Email support@openwebhook.co to exercise a right. We may need enough information to verify and locate a request, but OpenWebhook normally cannot associate a person with a random UUID and does not retain server-side event history. Local browser records remain under your control.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

11. Operational records

The application produces startup and unexpected-error logs for reliability and security. It is designed not to include webhook bodies, request headers, query strings, or UUID URLs in those logs. Infrastructure providers may process basic network metadata as necessary to operate and protect their systems.

12. Changes to this policy

Material changes will be reflected on this page by updating the date above. The current version is always available at openwebhook.co/privacy.

13. Contact

Questions about this policy or personal data can be sent to support@openwebhook.co.