Privacy Policy

This Privacy Policy explains how Brady Cusack (“Hookie,” “we,” “us”) collects, uses, discloses, and protects personal information in connection with the Hookie webhook platform (the “Service”). It applies to our websites, the marketing site, the console, and the API.

1. Two roles: controller and processor

Hookie plays two different privacy roles, and it matters which data we are talking about:

• Controller — account data. For information about our customers and website visitors (names, emails, billing details, usage analytics), we decide how and why it is processed, so we are the controller.
• Processor — your event data. For the event payloads you ingest and route through the Service — which may contain personal data about your end users — we act only as a processor on your instructions. You are the controller of that data and are responsible for its lawful collection and use. If you require a Data Processing Agreement, contact [email protected].

This Policy focuses on data for which we are the controller. Our handling of your event data as a processor is governed by these Terms, our security practices, and any DPA between us.

2. Information we collect

You provide:

• Account information — name, email address, and organization details. You sign in with a one-time code emailed to you, or with your GitHub or Google account; in that case we receive the name, email address and account identifier that provider shares, and, for a Google Workspace account, its Workspace domain. Hookie does not store passwords.
• Billing information — plan selection and Stripe subscription identifiers. We do not receive or store your full payment-card details; those are handled by Stripe.
• Support and communications — messages you send us.

Collected automatically:

• Usage and log data — API requests, ingest and delivery metadata, event counts, IP addresses, timestamps, and error/observability traces used to operate, secure, and improve the Service.
• Website analytics — our marketing site at hookie.ai and the console at app.hookie.ai use Cloudflare Web Analytics to see how the sites are used and how fast their pages load. It records the page path, the referring page, the visitor’s country, device type, browser, operating system, navigation type and page-load timings. We use it to understand which pages are read and how they perform, and we do not use it to identify visitors.
• Cookies — a session cookie for authentication, and short-lived (10-minute) encrypted cookies that carry a sign-in with GitHub or Google across the round trip to that provider. All are SameSite=Lax, HttpOnly and Secure. We use only cookies necessary to provide the Service and do not use third-party advertising cookies.

Event data you route (processor role): payloads you ingest may contain personal data about your end users. We process it only to provide the Service (store, route, deliver, stream, and — if you enable it — run AI triggers).

3. How we use information

We use controller data to:

• provide, operate, secure, and maintain the Service and your account;
• process subscriptions and payments (via Stripe);
• enforce quotas, prevent abuse, and investigate security incidents;
• communicate with you about your account, changes, and support; and
• comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use your event data to train AI models.

4. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service, prevent abuse, and understand how our sites are used), consent (where required, e.g., certain communications), and legal obligation (e.g., tax and accounting).

5. How we share information

We share information with:

• Service providers (subprocessors) who process personal data on our behalf, listed in full below.
• Legal and safety — when required by law, to enforce our Terms, or to protect the rights, property, or safety of Hookie, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell personal information or share it for cross-context behavioral advertising.

Subprocessors

We update this list before a new subprocessor starts processing personal data.

Transfers you direct

Some features send data where you tell them to. Hookie is not the recipient’s customer, and these recipients are not our subprocessors; the transfer happens on your instructions as the controller:

• Destinations and customer-portal endpoints — the URLs you (or your customers, through the portal) configure to receive deliveries, including third-party services such as Slack, Datadog or Resend, object-storage buckets (AWS S3, Cloudflare R2, Google Cloud Storage), and message queues and topics (Amazon SQS, Google Cloud Pub/Sub) you name. For a Pub/Sub destination, Hookie also exchanges your service account’s key for an access token at Google’s OAuth endpoint (oauth2.googleapis.com), on your instructions and with your credential. For an endpoint you give a Cloudflare Turnstile secret, Hookie sends each form submission’s Turnstile token and the submitter’s IP address to Cloudflare’s Siteverify endpoint (challenges.cloudflare.com), with your secret, to check it before the submission is stored.
• HTTP workflow steps — the endpoints your workflows call, with the data you map into each request.
• Broadcast Logs — the observability vendor you connect (for example Datadog, Grafana Cloud, PostHog or Sentry) to receive your project’s logs and traces. Event payloads and AI prompts, inputs and outputs are not sent.
• Database sources and WebSocket triggers — the systems you connect for Hookie to read from.
• Connected coding agents — the agent you authorize, acting as you through the MCP server.

6. Data retention

• Account data is retained while your account is active and for a reasonable period afterward as needed for legal, tax, and dispute-resolution purposes.
• Event data (records, raw submissions, delivery history — each delivery’s status, attempts and the response your destination returned — the AI call log — each AI call’s prompt, input and output — workflow runs — each run’s context, which starts as a copy of the event that started it, and its step log — and AI trigger runs, including the model’s output) is retained according to your plan’s retention window (currently 7 days on Free, 30 days on Pro, and 90 days on Team) and is automatically pruned after that period. A delivery that is still being attempted, or a workflow run that is still running or waiting, when its window ends is kept until it finishes, then pruned; a workflow run is kept for a full window after it last changed. An AI trigger run’s output is removed when its window ends, but the rest of its record (when it ran, its status, the model and token counts) is kept until the end of the calendar month it ran in, because it counts toward that month’s AI-run allowance.
• After a plan change that shortens retention — a paid plan downgraded or cancelled, a free trial ending, or a plan change we make to your workspace — we keep event data on your previous plan’s retention window for 7 more days, then apply the new plan’s window: event data older than it is permanently deleted at the next automatic prune. During those 7 days the console shows the date the older data will be deleted, and you can export it (Settings → Export & closure) or upgrade to keep it. If the plan is lowered again within the 7 days, the longest window still applies and the 7 days start again; moving to a plan whose window is at least that long ends them, since that plan keeps the data anyway. Closing a workspace is different and is described below.
• The workspace audit log (who changed what in your workspace, and when — for example a rule edited, a key revoked or a portal link withdrawn) is retained for the longer of your plan’s retention window and one year (365 days), then automatically pruned. It is kept longer than event data so that it can support a security review, and it holds identifiers and settings rather than event payloads. Audit entries cannot be altered, and none younger than a year can be deleted.
• Secrets (destination signing secrets and credentials such as a Slack destination’s incoming-webhook URL, an S3 or SQS destination’s secret access key, and a Pub/Sub destination’s service-account key and the access tokens minted from it, ingest signing secrets, and source connection configs) are encrypted at rest and never returned by the API; ingest keys are stored only as hashes.

Deleting data before its retention window ends

You do not have to wait for retention to remove event data. From the console, the API or a connected coding agent:

• Delete a record. Deleting one record permanently removes it together with every copy Hookie keeps of it: its raw submission, its delivery history (including the responses your destinations returned and any replays), deliveries held for it, the workflow runs it started (their context, step log and the AI calls they made) and the output of AI triggers that ran on it. It takes effect immediately. Copies already delivered to your destinations or other recipients you configured are theirs to delete.
• Purge a dataset. An owner or admin can delete every record in a dataset, received up to that moment, with the same copies. A large dataset is deleted in the background, normally within minutes.

The audit log records that a record was deleted or a dataset purged, and by whom, but never what the record contained.

Closing your workspace

The workspace owner can close the workspace from the console (Settings → Export & closure). Closing:

1. cancels the paid subscription immediately through Stripe, so nothing further is charged;
2. suspends the workspace immediately: its endpoints and keys stop accepting events, nothing is delivered, and its settings become read-only;
3. permanently deletes all of the workspace’s data 14 days later: every project, record, raw submission, delivery, workflow run, AI call, setting, secret, key and membership. During those 14 days the owner can undo the closure and keep the workspace as it was.

After deletion we keep only what the law or security requires: the workspace audit log for its retention window above (at least one year from each entry), a record that the workspace existed and was closed (its identifier, plan and dates, with its name removed), monthly usage totals, and the billing records Stripe keeps as our payment processor. Your personal account (your name and email address) is not deleted by closing a workspace, because you may belong to others; to delete it, contact [email protected].

Exporting your data

An owner or admin can download all of the workspace’s data at any time from the console (Settings → Export & closure), or with GET /admin/api/workspace/export: its configuration, members, every stored record and raw submission, delivery history, workflow and AI runs, and the audit log, as one JSON Lines file. Secrets are never included: signing secrets, destination credentials and secret header values, source and listener credentials, endpoint URL secrets, and key and token hashes are left out, and the file lists which fields were. Export before closing a workspace if you want a copy; once its data is deleted it cannot be recovered.

7. Security

We implement technical and organizational measures appropriate to the risk, including: AES-256-GCM encryption of secrets at rest, SHA-256 hashing of ingest keys (plaintext shown once), HMAC-signed outbound deliveries, per-tenant isolation on every read and write, IP allowlists, edge rate limiting, a strict Content-Security-Policy, CSRF protections, and an append-only audit log kept for at least a year. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International transfers

The Service runs on Cloudflare’s global network, so data may be processed in countries other than yours. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. Under the GDPR/UK GDPR and CCPA/CPRA, these include the rights to know, access, delete, correct, and to non-discrimination for exercising your rights; we do not sell or “share” (as defined by the CCPA) your personal information.

To exercise rights over controller data, contact [email protected]. For rights concerning event data we process on a customer’s behalf, please contact that customer (the controller); we will assist them as their processor, and customers can act on an access, portability or erasure request themselves by exporting their workspace, or by deleting the records concerned (see “Deleting data before its retention window ends” above). We may need to verify your identity before responding, and we will respond within the timeframes required by law.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us personal information, contact [email protected] and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be signaled by updating the “Last updated” date and, where appropriate, by additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

12. Contact

Privacy questions or requests: [email protected] · Brady Cusack, 1606 Headway Circle STE 9318, Austin, TX 78754. If you are in the EEA or UK and have a concern we cannot resolve, you also have the right to lodge a complaint with your local supervisory authority.