Privacy Policy

Plain-language summary: we store your email, your endpoints, and the webhook requests you send us. We delete requests automatically. We do not sell anything to anyone, and we do not read your payloads.

What we collect

• Account data — your email address, an optional display name, a hashed password, and your API key.
• Endpoint configuration — names, forwarding URLs, and the signing secrets you paste in.
• Captured requests — the headers, body, query string, source IP and timing of every request sent to your ingest URLs.
• Billing data — a Paddle customer id and subscription status. Card numbers go to Paddle directly and never touch our servers.

How long we keep it

Captured requests are deleted automatically after 3 days on the free plan and 30 days on Pro. Account and billing records are kept while your account exists, and billing records for as long as tax law requires after that.

What we do with it

We use it to run the service: displaying your requests back to you, forwarding them where you asked, and emailing the alerts you configured. We do not sell it, share it with advertisers, or use payload contents to train anything.

Who else touches it

• Paddle.com Market Ltd — our merchant of record. They process payments, calculate and remit sales tax and VAT, and issue invoices. They receive your email address and billing country.
• Our hosting and email providers — running the servers and delivering alert emails.

That is the entire list.

Your rights

You can export your data through the API, delete any endpoint and its history from the dashboard, and delete your whole account from the settings page — which removes everything immediately. For anything else, email hello@saasfoundry.app.

Security

Traffic is served over HTTPS. Passwords are hashed with Django's default PBKDF2. Signing secrets and captured payloads are stored in our database and visible only to your account.

Cookies

One session cookie to keep you signed in and one CSRF cookie to keep forms safe. No analytics cookies, no third-party trackers.