Last updated: July 13, 2026
SDNBros ("we", "us", "our") operates the SDNBros Webhooks platform at webhook.sdnbros.app. This Privacy Policy explains how we collect, use, and protect your information.
| Data Type | Purpose | Retention |
|---|---|---|
| Email address | Account creation, login, notifications | Account lifetime; deletion requests handled by support |
| Password (hashed) | Authentication | Account lifetime; deletion requests handled by support |
| Webhook payloads | Core service functionality | Plan-based in primary event storage; object-storage and backup copies may remain longer |
| IP addresses | Event diagnostics, rate limiting, abuse prevention, audit, and marketing attribution | Retained with the related event, audit, or marketing record |
| Usage metrics | Service operation, plan enforcement, billing, analytics | No automated 90-day expiry |
| Product and marketing telemetry | Page path, CTA, referrer and UTM, and browser metadata | No automated expiry |
| Audit and security records | Accountability, diagnostics, and security | No automated expiry |
| Legacy WaaS data | Previously configured outbound endpoints, signing secrets, custom headers, message payloads, and metadata; outbound sending is disabled | No automated expiry; deletion requests handled by support |
| Payment info | Billing (processed by Stripe) | Managed by Stripe |
Webhook payload bodies do not have application-layer encryption. We inspect and process payloads as needed to provide the Service, including event classification, signature verification, delivery, and user-requested analysis. Periodic cleanup removes expired primary event rows and selected related database records, but does not guarantee deletion of object-storage copies, backups, or every derived operational record.
When an authorized user explicitly requests AI analysis for an event, we send Anthropic an event context containing state, HTTP method, provider, event type, content type, response status and latency, an error summary of up to 500 bytes, request headers, up to 2 KB of request-body preview, and up to 1 KB of response-body preview. Header values whose names indicate authorization, cookies, API keys, tokens, secrets, passwords, credentials, or signatures are redacted; header names ending in -key are also redacted. Other header values are limited to 200 bytes each. The entire event context is capped at 8 KB.
When an authorized user submits a natural-language analytics query, the query text is sent to Anthropic to produce a structured filter. Matching event rows and payloads are not sent as part of that request. If Anthropic is unavailable or not configured, the Service uses a local keyword fallback.
We do not sell, rent, or share your personal information with any third parties for marketing purposes.
Webhook payload bodies, provider and legacy WaaS signing secrets, and legacy WaaS custom headers do not have application-layer encryption in the current implementation. Access is limited through application authorization and infrastructure controls; rotate credentials if exposure is suspected.
Current technical controls include:
You have the right to:
We use one essential cookie (token) to maintain your authenticated session. Browser local and session storage are used for theme, UI state, and local tool history. We also record limited server-side product and marketing telemetry described above. We do not use third-party advertising cookies.
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email.
For privacy-related inquiries, contact us at anton@sdnbros.com.