Privacy Policy

Last updated: October 6, 2026

1. Introduction

Welcome to EventForge. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our webhook infrastructure service. Please read this policy carefully to understand our practices regarding your personal data.

By using EventForge, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

We collect several types of information:

Account Information

  • Email address
  • Password (stored securely using industry-standard hashing)
  • Account preferences and settings

Webhook Data

  • HTTP request headers
  • Request body/payload
  • Source IP addresses
  • Timestamps and metadata

Usage Information

  • Server logs: your IP address, browser user agent, the pages and API endpoints you request, and when
  • The IP address and browser user agent of each sign-in and each subsequent token refresh, retained until 30 days after the session's fixed expiry
  • Analytics data from Google Analytics: only on our marketing pages, the documentation and the sign-up page, and only if you accept analytics cookies (see section 6)

3. How We Use Your Information

We use collected information for:

  • Providing and maintaining the Service
  • Processing and routing your webhook events
  • Managing your account and subscription
  • Sending service-related communications
  • Improving and optimizing our Service
  • Detecting and preventing fraud or abuse
  • Complying with legal obligations

4. Data Storage and Security

How we protect your data:

  • Traffic between your browser or your webhook senders and EventForge is encrypted with TLS
  • Passwords are stored as bcrypt hashes. The links in our emails and your session tokens are stored as SHA-256 hashes, so a copy of the database does not reveal them
  • The service and its database run on servers of our hosting provider in Finland (EU)
  • Only the EventForge team has access to the servers and the database

We keep webhook events, their deliveries and your rules until you delete them. Deleting a project deletes its events, rules and delivery history. To delete your account and everything in it, email privacy@event-forge.app from the address of your account; we delete it within 30 days.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in limited circumstances:

  • Service Providers: companies that run parts of the Service for us: Stripe (payments), Brevo (account emails; Brevo counts opens and link clicks in these emails), Google (analytics, only with your consent) and our hosting provider
  • Legal Requirements: When required by law, court order, or government request
  • Business Transfers: In connection with a merger, acquisition, or sale of assets
  • Protection: To protect the rights, property, or safety of EventForge, our users, or others

6. Cookies and Browser Storage

Strictly necessary, always on:

  • ef_session cookie: keeps you signed in on the dashboard pages. It expires 15 minutes after your session was last refreshed
  • accessToken and refreshToken in your browser's local storage: your sign-in session. Signing out removes them
  • ef_analytics_consent in local storage: your analytics choice, kept for 12 months
  • ef_session_resume_at in session storage: stops the page from retrying a failed sign-in refresh in a loop; it is gone when you close the tab
  • scalar-reference-selected-client-v2 in local storage: the language of the code samples on the API reference page, set when the page opens; it stays until you clear your browser's storage

Analytics, set only if you accept:

  • Google Analytics cookies (_ga and _ga_*), only on our marketing pages, the documentation and the sign-up page. They tell us how visitors find the site and how many of them sign up, and they are kept for up to 2 years

We use no advertising cookies. Stripe Checkout runs on stripe.com and sets its own cookies there. You can change your choice at any time:

7. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal data
  • Portability: Request transfer of your data to another service
  • Objection: Object to certain processing of your data
  • Restriction: Request restriction of processing

To exercise these rights, please contact us at privacy@event-forge.app.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. We take appropriate safeguards to ensure your data remains protected in accordance with this Privacy Policy and applicable laws.

9. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Terms of Service FAQ Home