Who we are
SlingHook is run by Fulcrum Software in South Africa. For the personal information in your account we are the responsible party under South Africa’s Protection of Personal Information Act (POPIA) and the controller under the GDPR. Our information officer can be reached at support@example.com.
For the webhooks your endpoints receive, you decide what is sent and why, so you are the responsible party (controller) and we process that data on your behalf, as explained under Webhook data.
What we collect
| What | Why |
|---|---|
| Email address and a hashed password | To create your account, sign you in and contact you about it |
| Endpoints, settings, notes, scenarios, API token names (tokens themselves are stored only as hashes) | To run the features you set up |
| Monthly event counts | To apply your plan’s limits and show your usage |
| Plan, subscription status, billing dates and Paddle customer and subscription ids | To give you the plan you paid for |
| Hashed sign-in attempt records, kept for 24 hours | To stop password guessing |
| Server logs with IP address, browser and requested URL | To keep the service secure and fix problems |
We do not collect card numbers or bank details: Paddle collects those at checkout. We do not use advertising trackers or third-party analytics, and we do not sell personal information.
Webhook data
Each request sent to one of your endpoints is stored with its method, headers, query string, body, content type and the sender’s IP address. Replays and relays store the target URL and the response. This data can contain personal information about your own customers, depending on what your providers send.
- We use it only to show it to you and to forward or replay it where you tell us to.
- It is deleted automatically when it passes your plan’s history period (24 hours on Free, 30 days on Pro, 90 days on Team), unless you pin it or use it in a saved scenario. You can delete it yourself at any time.
- Anyone with an endpoint’s URL can send it requests, so treat endpoint URLs like passwords and send test data where you can.
- Masking secrets in the dashboard only hides them on screen; the stored request is unchanged.
Cookies and local storage
SlingHook sets one cookie: a session cookie that keeps you signed in. It is essential, so there is no cookie banner. The dashboard also saves preferences such as your theme, panel sizes and sound setting in your browser’s local storage; they never leave your device.
Who we share it with
We share personal information only with the service providers we need to run SlingHook, and only what they need:
- Paddle (Paddle.com Market Ltd, UK) is our reseller and Merchant of Record. It handles checkout, payments, invoices, tax and refunds, and receives your email and billing details for that. See Paddle’s privacy notice.
- Oracle Cloud Infrastructure hosts our servers and database.
- Google Fonts serves the fonts on our pages, so your browser sends your IP address to Google when it loads them.
We may also disclose information when the law requires it, or to protect SlingHook and its users from fraud or abuse. If SlingHook is ever sold, your information would pass to the new owner under this policy, and we would tell you first.
Where it is stored
Our servers are hosted by Oracle Cloud, and Paddle processes payments in the UK and elsewhere, so your information may be processed outside your country. Where POPIA or the GDPR requires it, we rely on our providers’ contractual safeguards for those transfers.
How long we keep it
- Webhook data: for your plan’s history period, as above.
- Account data: while your account is open. When you close it we delete it within 30 days, apart from backups, which roll off within a further 30 days.
- Billing records: Paddle keeps transaction records for as long as tax law requires. We keep subscription ids and dates for as long as needed to handle refunds and disputes.
- Server logs: up to 30 days.
Your rights
You can ask to see, correct or delete your personal information, ask us to stop or limit using it, or ask for a copy to take elsewhere. You can delete endpoints and request history in the dashboard yourself; for anything else, email support@example.com from your account address and we will reply within 30 days.
If you are unhappy with how we handle your information, please tell us first. You can also complain to South Africa’s Information Regulator, or to the data protection authority where you live.
Security
All traffic is encrypted with HTTPS. Passwords are hashed, API tokens are stored only as hashes, endpoint signing secrets are encrypted at rest, and sign-in attempts are rate limited. No system is perfectly secure; if we learn of a breach that affects your information we will tell you and the regulator as the law requires.
Children
SlingHook is for developers and businesses and is not meant for anyone under 18. We do not knowingly collect information about children.
Changes to this policy
When we change this policy we update the date at the top, and for significant changes we email account holders before they apply. Questions: support@example.com.