Privacy Policy

This Privacy Policy explains how Whooks (“Whooks,” “we,” “us”) collects, uses, and shares information when you use Whooks (the “Service”). It's part of our Terms of Use.

1. Information we collect

Account information

We only collect basic account information: your full name, email address, and password. This is collected and managed through our authentication provider, Clerk. Your password is handled by Clerk, and we don't see or store it ourselves.

Information you set up in Whooks

• Integration details: the provider (such as Stripe, Clerk, or Resend), environment, name, and the webhook endpoint we generate for you.
• Webhook signing secrets you provide so we can verify incoming events. These are encrypted.
• Notification rules, preferences, and settings, such as which events notify you, sound, and your timezone.
• API key details: the key's name, a short prefix, and when it was created and last used.
• Anything you send us directly, like support requests.

Events from your connected services

When a service you've connected sends a webhook to Whooks, we process the event so we can notify you and show it in your dashboard. For each event we keep details such as the provider, event type, severity, status, environment, and timestamp.

The full event payload, which can include personal information about your own customers, is saved only if payload storage is turned on for your account. See Section 3.

Technical data

Like most services, our hosting and backend providers generate basic technical logs, such as IP address, browser type, and timestamps, when you use the Service.

2. How we use this information

• To run the Service: authenticating you, receiving and verifying events, showing them in your dashboard, and sending notifications, including through the Chrome extension.
• To apply the rules and settings you choose.
• To power AI features, only if you enable them and only as described in Section 4.
• To communicate with you: security notices, service updates, and replies to your requests.
• To keep the Service safe: detecting abuse, fraud, and violations of our Terms.
• To fix problems and improve the Service.

3. Event payloads & your controls

You decide whether Whooks stores the content of your events.

• Payload storage is optional. You can turn it off so event payloads aren't saved in our database.
• When payload storage is off, we still receive each event and send you a notification that it was triggered. We keep the event's details (provider, type, severity, status, and time), but not its payload.
• Turning storage off applies to events received afterward. If you want payloads we already saved to be removed, contact us at the email below.
• Webhook signing secrets are encrypted, and are used only to verify that events really come from your provider.

4. AI features

AI features, like asking questions about your event history, are optional.

• We don't share your event payloads with AI providers unless you authorize it when you enable AI.
• If you enable AI, relevant event data and your questions may be sent to third-party AI model providers solely to generate answers for you.
• If payload storage is off, there are no saved payloads for the AI to use.
• You can turn AI features off at any time.

5. Cookies

We use cookies and similar technologies only where needed to run the Service, such as keeping you signed in and protecting your session. These are set through Clerk.

6. How we share information

We share information with:

• Service providers who help us run the Service: Clerk (authentication), Convex (database and backend), and hosting infrastructure.
• AI model providers, only if you enable AI and authorize sharing, and only as described in Section 4.
• Legal or safety reasons: to comply with law, respond to lawful requests, or protect the rights and safety of Whooks and its users.
• In connection with a merger, acquisition, or sale of assets, subject to this Policy (or a successor policy you're notified about).

We do not sell your personal information.

7. Data retention

We keep your account and Whooks data for as long as your account is active. If you delete your account, we delete or anonymize your personal information within [X days], except where we need to retain it longer for legal, security, or fraud-prevention purposes.

8. Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing (for example under GDPR if you're in the EU/UK, or CCPA/CPRA if you're in California).

You can update your account information through your account settings, or contact us at rbluena@gmail.comto exercise these rights. We'll respond within the timeframe required by applicable law.

If your events include personal information about your own customers, you're responsible for responding to their requests. We process that data on your behalf and will help where we reasonably can.

9. Children's privacy

Whooks isn't directed at anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has provided us information, contact us at rbluena@gmail.comand we'll delete it.

10. International data transfers

We and our service providers may process information in countries other than where you live, including [United States]. Where required, we use appropriate safeguards for these transfers (for example, standard contractual clauses).

11. Security

We use reasonable technical and organizational measures to protect your information, including encrypting the webhook signing secrets you give us. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

12. Changes to this Policy

We may update this Policy from time to time. For material changes, we'll provide notice before they take effect.

13. Contact

Questions about this Policy, or want to exercise your privacy rights? Reach us at rbluena@gmail.com. [If you have EU users, consider whether you need a designated EU representative under GDPR Art. 27.]