We collect information you provide directly to us, such as when you create an account, configure webhooks, or contact us for support.
Personal Information:
- Email address
- Name
- Account credentials (password hash or SSO provider identity)
Technical Information:
- Webhook configurations, endpoints, and relay target settings
- A metadata-only activity trail and delivery outcomes; payload bodies are excluded from this retained history
- Accepted-event payload bodies while they are processed in delivery, retry, and operational dead-letter queues
- Originating IP addresses of incoming relay requests
- Error reports
Billing Information:
- Organization billing contact, business name, billing address, and tax identifiers
- Stripe customer, subscription, invoice, payment status, and transaction identifiers
- Selected plan, billing interval, plan-change previews, cancellation state, and optional cancellation feedback
- Payment-card details are collected and stored by Stripe; PayloadRelay does not receive or store full card numbers
We use the information we collect to provide, maintain, and improve our services.
- To provide and operate the PayloadRelay service
- To process webhook requests and transformations
- To communicate with you about the service
- To process subscriptions, invoices, taxes, payment recovery, and plan changes
- To monitor and analyze usage patterns
- To detect and prevent fraudulent activity
- To comply with legal obligations
We do not sell, trade, or otherwise transfer your personal information to third parties, except as described in this policy.
We may share information:
- With your consent
- To comply with legal obligations
- To protect our rights and prevent fraud
- With service providers who assist in our operations
- In connection with a business transfer or acquisition
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
- Encryption of data in transit (HTTPS) and sensitive data at rest (AES-256)
- Access controls and authentication measures
- CSRF protection and secure, HttpOnly session cookies
- Passwords hashed with BCrypt
We retain your information for as long as necessary to provide the service and fulfill the purposes outlined in this policy, unless a longer retention period is required by law.
- Account information: Until account deactivation or as required by law
- Webhook and endpoint configurations: Until deleted by you or account deactivation
- Metadata-only activity trail and delivery outcomes: Retained for 30 days, then automatically deleted; payload bodies are not included in this trail
- Accepted-event payload bodies: Held in delivery and retry queues while processing; successful messages are acknowledged and removed, scheduled retries move between queues, and failed messages may remain in operational dead-letter queues until remediated or purged
- Verified Stripe webhook events: Retained for 30 days for reliable processing, replay, and incident investigation
- Billing relationship and transaction records: Retained while the account is active and afterward as required for accounting, fraud prevention, dispute handling, and legal obligations
- Optional cancellation feedback: Retained only as long as reasonably needed for product analysis and support
You have certain rights regarding your personal information, subject to applicable laws.
- Access: Request access to your personal information
- Correction: Request correction of inaccurate information
- Deletion: Request deactivation of your account by contacting us
- Portability: Request a copy of your data in a portable format
- Objection: Object to certain processing of your information
- Withdrawal: Withdraw consent where processing is based on consent
We use a minimal set of cookies necessary to operate the service.
Cookies we use:
- Authentication cookie: A secure, HttpOnly cookie used to maintain your session
- CSRF token cookie: Used to protect against cross-site request forgery attacks
We only use essential cookies required for the service to function. We do not use analytics or tracking cookies. Disabling cookies will prevent you from using the service.
Our service may integrate with third-party services. This privacy policy does not cover the practices of these third parties. We encourage you to review their privacy policies.
- OAuth authentication providers (Google, Microsoft, Apple) if you use SSO sign-in
- Infrastructure and hosting services
- Stripe: payment processing, customer billing portal, invoicing, tax calculation, payment recovery, and subscription management
- Third-party relay targets you configure (webhooks, email recipients, Slack, Discord, Microsoft Teams, PagerDuty, Telegram, and Google Sheets)
Stripe processes billing data under its own privacy policy and applicable data-processing terms. This section should be reviewed by qualified privacy and tax advisers before commercial launch.
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information during such transfers.
Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us.
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.
If you have any questions about this Privacy Policy or our data practices, please contact us: