Privacy policy

HookPulse is operated by Altix Code Ltd, a company registered in the Republic of Cyprus (“Altix”, “we”, “us”). This policy explains what personal data we collect when you use our website and dashboard (the “Service”), what passes through the Service when you publish and deliver webhook events, why, how long we keep it, who we share it with, and the rights you have over it.

Two different roles are in play throughout this policy, and they matter: for data about you and your account, Altix is the data controller. For the content of the events you publish through the Service — which may itself contain personal data about your own end users — you are the data controller and Altix is a data processor acting only on your instructions, for the sole purpose of signing, delivering and logging that content on your behalf. See "When we process data on your behalf" below.

1. Data we collect about you

When you sign up and use the Service, we collect:

Account details — your email address, an optional name, your organisation name, and a salted, irreversibly hashed copy of your password. We never store or have access to your actual password.

Team and permission data — if your account has more than one person on it, we store each member's email, role, who invited them, and when, so the account owner can manage access.

Billing information — your subscription plan, status, and renewal date. Card and payment details are collected and held by Stripe, our payment processor; we only ever receive a subscription and customer identifier from them, never your card number.

API keys — we store a one-way hash of each API key you generate, plus a short, non-secret prefix shown in the dashboard so you can tell your keys apart. The key itself is shown once, at creation, and never again.

Support and account communications — anything you send us by email, including transactional email we send you (password resets, email verification, team invitations).

Usage and security logs — sign-in timestamps, and a security audit log of membership actions on your account (invitations, role changes, removals, and account deletion requests), each tagged with the actor's email and the time it happened.

Technical data — standard web server and request logs (IP address, user agent, timestamps) generated when you use the dashboard, kept briefly for security and abuse prevention.

2. When we process data on your behalf

HookPulse exists to receive an event from your backend, sign it, deliver it to the webhook endpoints you or your own customers configure, retry it on failure, and keep a durable log of every attempt. That log — the request we sent, the response we got back, and when — is the product: it is how you and your own customers answer "did this webhook arrive, and what happened when it didn't."

Concretely, for each event you publish through the API we store and transmit, on your instructions and for no other purpose:

The event payload you submitted — arbitrary JSON from your own systems, which may itself contain personal data about your own end users (for example, an order or subscription event naming a customer). We do not inspect, parse for meaning, or use this content for any purpose beyond delivering and logging it.

The destination endpoint URL and, where you set one, a subscriber identifier in your own namespace, used to scope a delivery log to the right one of your customers.

Each delivery attempt's outcome — the response status code, response headers and body (or the error, if the receiving server could not be reached), and how long it took — appended, never overwritten, so a later attempt does not erase what an earlier one recorded.

You remain the controller of this data: you decide what to publish, where it is delivered, and who (for example, via a scoped, short-lived portal token) may view its delivery history. You are responsible for your own lawful basis for including personal data in an event, and for anything you owe your own end users about it under your own privacy policy.

Every signing secret and portal-token signing key is sealed at rest with AES-256-GCM; payloads and response bodies themselves are not separately encrypted beyond the database's own disk encryption, and access to them is restricted to your account and, for a given delivery, the scoped portal token you choose to issue for it.

3. Why we process it

To provide the Service itself — signing, delivering, retrying and logging the events you publish, and enforcing your plan's delivery allowance.

To bill you, via Stripe, for a paid subscription you chose.

To communicate with you about your account, including emails necessary to operate it (verification, password resets, team invites) and, if you have not opted out, occasional product updates.

To maintain a security audit trail of who did what on your account, so account owners can review activity and we can investigate suspected compromise.

To comply with our legal and accounting obligations, including tax law.

4. Who we share it with

We do not sell personal data, and we never share your event payloads or delivery history with anyone except at your own direction (for example, a portal link you issue to one of your customers). We share account data only with the processors needed to run the Service, each bound by contract to use it solely to provide their service to us:

Stripe, Inc. — payment processing and subscription billing.

Resend (via its SMTP relay) — delivery of transactional email.

Cloudflare, Inc. — bot and abuse protection (Turnstile) on our sign-up and password-reset forms.

Hetzner Online GmbH — our infrastructure host, where our servers and databases physically run (EU-located).

Your own webhook endpoints — the URLs you configure — necessarily receive the event payloads you ask us to deliver to them. That delivery is the Service; it is not a third-party disclosure we make of our own accord, it is the one you instructed.

Issued invoices are recorded in Altix Code Ltd's own internal invoicing system, used across our products, so we can meet our accounting and tax obligations as a single company.

Some of these processors are located outside the European Economic Area. Where that is the case, we rely on the European Commission's Standard Contractual Clauses, or an equivalent recognised safeguard, to cover the transfer.

We may also disclose data where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Altix, our customers, or others.

5. How long we keep it

Account data, published events, and their delivery and attempt history are kept for as long as your account is active — there is currently no separate automatic expiry for delivery logs beyond the life of the account, because the log is what you and your own customers rely on to answer delivery questions after the fact.

If you delete your account, every app, endpoint, API key, event and delivery record it holds, and every team member's access, are removed immediately and permanently — see "Deleting your account" below.

Invoices already issued remain in our invoicing system independently of your account, for as long as Cyprus tax and accounting law requires us to keep financial records (currently up to seven years).

Security audit log entries are retained after an account is deleted, because the point of a security log is to survive the event it may need to explain; entries are kept for as long as needed for security, fraud-prevention, and legal purposes.

Server and request logs are kept briefly (typically a few weeks) and then deleted or anonymised.

6. Deleting your account

Account owners can permanently delete their account from Settings at any time. Doing so:

Cancels any active subscription immediately — you are not billed again, and lose access right away rather than at the end of the billing period.

Permanently deletes every app, endpoint, API key, published event and delivery attempt history the account holds.

Removes every team member's access to the account immediately.

Records that the deletion happened, in a log entry that is not deleted with the account (see above).

Does not affect invoices already issued, which remain in our invoicing system under our legal retention obligations, independently of the deleted account.

This action cannot be undone. The dashboard asks you to type your account's name to confirm before it proceeds.

7. Cookies

Our own website and dashboard use a single strictly necessary cookie to keep you signed in. We do not use advertising or cross-site tracking cookies on this site.

8. Your rights

If you are in the European Economic Area, the UK, or another jurisdiction with similar protections, you have the right to:

Access the personal data we hold about you, and get a copy of it.

Correct inaccurate data.

Erase your data, including by deleting your account yourself as described above.

Restrict or object to certain processing.

Receive your data in a portable format.

Withdraw consent, where processing relies on it (for example, optional product-update emails).

Lodge a complaint with your local data protection authority — for Cyprus, the Office of the Commissioner for Personal Data Protection.

To exercise any of these rights, email privacy@altixcode.com. If the data you are asking about is the content of an event — data about one of our customer's own end users, passing through the Service in transit — we are a processor for that data, not the controller, and will direct the request to the account that published it, which is the controller responsible for responding, unless they have instructed us otherwise.

9. Security

Passwords are hashed with bcrypt and never stored in plain text. API keys are stored as a one-way hash; only a short prefix is kept in the clear for identification. Endpoint signing secrets and portal-token signing keys are sealed at rest with AES-256-GCM. Invite and password-reset links use single-use, cryptographically random tokens that are hashed at rest. Traffic to the Service, and every outbound delivery we make to your endpoints, is encrypted in transit with TLS. Access to production infrastructure is restricted to the people who need it to operate the Service.

10. Children

The Service is intended for businesses and professionals and is not directed at, or knowingly used to collect data from, children under 16.

11. Changes to this policy

If we make a material change to this policy, we will notify account owners by email and update the effective date above before the change takes effect.

12. Contact

Altix Code Ltd (Cyprus). For any question about this policy or your data, email privacy@altixcode.com.