Who we are
PayHook is operated by Omadillo Sidikov, an individual. Contact: hello@payhook.co.
The site and the waitlist
When you join the waitlist, PayHook stores the email address you enter, the payment provider you optionally pick, and, if you arrived through a tagged link, the name of its source. Nothing else about you is stored.
The email address is used to send you the early access invite and, during the beta, one or two short emails asking how PayHook works for you. Reply to any of them and we will not ask again. There is no newsletter, and the list is never sold or shared. It is kept in a Cloudflare D1 database, and the site is served by Cloudflare Pages.
Page views and button clicks on payhook.co are counted with Plausible Analytics, which sets no cookies and stores no personal data: the counts are aggregated and cannot be traced back to you.
If you pick a colour theme, the choice is kept in your browser's local storage under the key payhook-theme and never leaves your browser.
The app: two roles
The app holds two kinds of data, and PayHook's role differs for each.
- Your account data: how we reach you and your project's settings. PayHook decides why and how it is used, so for this data PayHook is the controller.
- The events your payment provider sends to your project (Stripe, Paddle, Lemon Squeezy, Polar or Dodo Payments). They can carry personal data of your own customers: names, email addresses, billing addresses, sometimes IP addresses. You decide to send them to PayHook and what for, so you are the controller and PayHook processes them on your behalf, as the section "Processing your customers' data" sets out.
What the app stores about you
- Your email address: in the hello@payhook.co mailbox, and as the name of your project in the app's database, so that we can reach you about your project and find and delete it when you ask. It is never shown in the app's pages or API answers, and never written to logs.
- Your project: its id, the payment provider you chose, the signing secret of PayHook's endpoint at your provider (not the secret of your own endpoint), and the URL of your app if you give it to us, for relay or for replays.
- A fingerprint (hash) of each read token. The token itself is shown to you once and is not stored.
Your webhook signing secret is encrypted (AES-256-GCM) with a key that is kept outside the database.
What the app stores from your webhooks
For every event that reaches your project's address, PayHook stores:
- the body, byte for byte as it arrived (a body larger than 1 MiB is stored as its first 1 MiB);
- the request headers as they arrived, which include the IP address of the server that sent the event (your payment provider's), added by our hosting edge;
- the signature check: valid, invalid or not checked, and the reason;
- the provider's event id, and a few facts read from the body to group the events of one subscription or order: the subscription or order reference, the customer reference, the status, whether the body carries a reference to your user, and when the event happened.
If you use relay, PayHook also stores what your app answered to each delivery attempt: the status code, the first 16 KiB of the answer and the timing. If you replay an event with an edited payload, the edited payload is stored with that delivery.
What the app does not collect
The app sets no cookies, runs no analytics and loads no third-party scripts or fonts. In your browser, the inspector keeps your project id and read token in session storage, which is cleared when you close the tab, and your colour theme in local storage under the key payhook-theme. Neither leaves your browser except the token, which is sent to PayHook's API to authorise your requests.
To limit abuse of the public addresses, the app counts requests per IP address in memory for a short time. These counts are never written to the database.
Why we use it
- To run the service you asked for: receive, store, verify, show, relay and replay your events (performance of our agreement with you).
- To keep the service secure and working: limits on requests, error logs without content, investigating abuse (our legitimate interest).
- To write to you about the beta: the invite, service notices, and one or two requests for feedback. Reply to any feedback request and we will not ask again (our legitimate interest, with your right to object).
We do not sell or rent any data, use it for advertising, or train AI models on it.
AI explanations
PayHook does not send your events to any AI service. When plain-language explanations of events ship, using the Claude API by Anthropic, only facts about a chain of events will be sent, such as event types, statuses, times and the rule that fired: no body, header, name, email, address or reference to a customer. This policy will be updated, with notice to you, before that.
Who processes the data
| Who | What for |
|---|---|
| Supabase | The app's database: events, deliveries, project settings. |
| Railway | Runs the app and keeps its logs. |
| Cloudflare | Serves payhook.co and keeps the waitlist; resolves the names app.payhook.co and hooks.payhook.co without seeing their traffic; forwards mail sent to hello@payhook.co. |
| Google (Gmail) | The hello@payhook.co mailbox. |
| Plausible | Counts page views on payhook.co, with no personal data. |
How long we keep it
- Events, with their deliveries and your app's answers: deleted automatically 30 days after they arrive, by a daily job.
- Backups: Supabase keeps backups of the database, so a deleted event can remain in a backup for a while after it is deleted.
- Logs: the app's own log lines never contain bodies, headers, tokens or secrets. Railway keeps request logs (time, path, status and the client's IP address) for up to 30 days.
- Your project and its settings: until you ask us to delete them, or until the beta ends. We delete them within 7 days of your request.
- Emails: 12 months after the last message of the conversation.
- Your waitlist entry: until you ask us to delete it.
Security
Every connection to the app and to its database uses verified TLS. Webhook secrets are encrypted with a key kept outside the database, and read tokens are stored as fingerprints. The app's API runs under a database role that cannot delete data: old events are deleted by a separate retention job under its own role, and a project is deleted by the operator. Only the operator has access to production.
Your rights
You can ask to see, correct, export or delete the data PayHook holds about you, to restrict or object to its use, and you can complain to your data protection authority. Write to hello@payhook.co; we answer within one month.
If one of your customers asks about their data in your events, that request is yours to answer as the controller. We will help: on your request we delete specific events or your whole project.
Processing your customers' data
For the events your provider sends, PayHook acts as your processor, and these terms apply:
- Instructions. PayHook processes the events only to provide the service as you configure it: receive, store, verify, show, relay to your app and replay on your request.
- Confidentiality. Only the operator can access production data, and anyone given access in the future will be bound to confidentiality.
- Security. The measures in "Security" above.
- Subprocessors. Those in the table above. We will tell you before adding or replacing one; if you object, you can leave the beta and have your data deleted.
- Help with requests. We help you answer your customers' requests, for example by deleting given events.
- Breaches. If a breach affects your data, we tell you without undue delay after we learn of it, with what we know and what we are doing.
- End. When you leave or the beta ends, we delete your project's data; backups expire on their own schedule.
- Information. We answer reasonable questions about how your data is processed.
Changes
We will email you about material changes before they take effect. The date at the top says which version applies.