Privacy policy
This policy explains what personal data Eventeer collects when you visit our website or use the service, why we collect it, who else handles it and what you can do about it.
Last updated: November 1, 2026
Who we are
Eventeer is a hosted event hub: it receives events from webhooks, devices and WebSocket sources, stores them, and forwards them to your destinations and streams. Eventeer is the controller of the personal data described in this policy, except for the event data your systems send us (see below), where we act as a processor on your behalf. You can reach us at support@eventeer.io.
What we collect
Account data
- Your email address and, if you use a password, a salted bcrypt hash of it. We never store the password itself.
- When you confirmed your email and when you last signed in.
- Organization data: the organizations you belong to, your role (owner, admin or member), and invitations sent to email addresses.
- If you turn them on: a two-factor (TOTP) secret and recovery codes, and passkeys (a public key and a name you give it; the private key stays on your device).
- Session records: for each signed-in browser, a session token, the IP address and browser user agent it signed in from, and when. You can list and revoke them in your account settings.
- API keys you create, stored as hashes or encrypted, with their scope and name.
How you found us
If you click through to sign-up from our website, the website passes along the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term,utm_content), the external page you came from (address without query string), the first page you saw on our site, and the plan you picked. We store these on your account as its sign-up source. They hold no identifier and are kept in your browser only for the tab session before sign-up.
Billing data
Payments are handled by Stripe. We do not see or store card numbers. We store the Stripe customer and subscription identifiers, your plan, billing status, usage counters for the period (events ingested, connection minutes and similar quotas), your spend cap and the notices we sent you about quotas and payments.
Customer event data
Events, headers, device messages and destination settings that your systems send to Eventeer are customer data. They can contain personal data about your own users. We process them only to provide the service to you, as your processor, under your instructions. You decide what you send. Secrets such as signing secrets and WebSocket source headers are stored encrypted.
Technical data
Our servers see the IP address and user agent of every request, which we use to route traffic, apply rate limits and investigate abuse. Rate limits on log-in, email-link and registration requests count attempts per IP address and per email address in memory for short windows (15 minutes to one hour). Application errors can be reported to Sentry with request metadata; we configure it to strip request bodies, most headers, listener and stream keys, and process state, and to cut error messages to 200 characters, so customer event data stays out.
Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide the service: accounts, organizations, event processing, delivery, alerts | Account, event, billing | Performance of a contract (Art. 6(1)(b)) |
| Charge for subscriptions and usage, send quota and payment notices | Billing, account | Contract; legal obligations such as tax records (Art. 6(1)(b), (c)) |
| Sign-in security: sessions, two-factor, passkeys, rate limits, bot check on sign-in and registration | Account, session, IP address | Legitimate interests in securing the service (Art. 6(1)(f)) |
| Fix errors and keep the service reliable | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Understand which pages and campaigns bring sign-ups | Sign-up source, aggregate page statistics | Legitimate interests (Art. 6(1)(f)) |
| Reply to your messages | Email address, message | Legitimate interests; contract (Art. 6(1)(f), (b)) |
We do not sell personal data and we do not use it for advertising.
Who processes it with us
We use these providers. Each receives only what it needs for its purpose.
| Provider | Purpose | Data |
|---|---|---|
| Fly.io | Application hosting and managed Postgres database (primary region: US East, Virginia) | All data stored by the service, including event data |
| Stripe | Subscriptions, usage billing, payment processing | Organization ID, usage totals, and the billing email and payment details you enter in Stripe Checkout |
| Cloudflare Turnstile | Bot check on the sign-in and registration forms | A one-time token and your IP address |
| Cloudflare Web Analytics | Aggregate page statistics for this website | Page views and device and referrer summaries; cookieless |
| Sentry | Error reporting, when enabled | Scrubbed error and request metadata (see above) |
| Email delivery (SMTP provider) | Sign-in links, invitations, alerts, quota and billing notices, security notices | Recipient email address and message content |
If you configure destinations, alert webhooks or WebSocket sources, Eventeer sends data to the endpoints you specify. Those recipients are your choice and are not our subprocessors.
Cookies and analytics
The application sets only the cookies it needs to work: a session cookie that keeps you signed in, and, if you tick “remember me”, a signed remember-me cookie valid for 14 days. We do not use advertising or cross-site tracking cookies, so there is no cookie banner.
This website uses Cloudflare Web Analytics, which is cookieless and reports aggregate statistics. It does not follow you across sites. For attribution, our scripts keep campaign tags in your browser’s session storage, which is cleared when you close the tab. The sign-in and registration pages load Cloudflare Turnstile, which runs a bot check in your browser.
How long we keep it
- Events: kept for your plan’s retention (7 days on Starter, 30 on Growth, 90 on Scale), then deleted automatically.
- After cancellation or an unpaid subscription: ingestion and delivery stop, your data stays readable for 30 days, then the organization’s events are deleted.
- Sessions: expire after 14 days or when you revoke them or sign out.
- Account data: kept while your account exists. When you delete your account, your user record, sessions, passkeys and two-factor data are deleted.
- Billing records: invoices and payment records held by Stripe and us are kept as long as tax and accounting law requires.
- Backups and logs: deleted data can persist in database backups and server logs for a limited time before they roll off.
International transfers
Our infrastructure is hosted in the United States, and our providers operate globally. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside your region. Where required, we rely on safeguards such as the European Commission’s standard contractual clauses or an adequacy decision covering the recipient. Ask us at support@eventeer.io for details.
Security
- All traffic uses TLS; plain HTTP requests are redirected to HTTPS.
- Passwords are hashed with bcrypt and a per-password salt.
- Two-factor authentication (TOTP, with recovery codes) and passkeys are available for every account.
- Secrets that must be recoverable, such as destination signing secrets, WebSocket source headers and two-factor secrets, are encrypted with AES-256-GCM before they are written to the database.
- Rate limits and a bot check protect sign-in and registration. You can review and revoke active sessions.
- Access to production is limited to the people who operate the service.
No system is perfectly secure. If a breach affects your personal data, we will notify you as the law requires.
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or export your personal data, and to object to processing based on legitimate interests. You can also complain to your data protection authority.
- Change your email, password, two-factor and passkeys in your account settings.
- Delete your account yourself in the app under Settings, Account (
/users/settings/account). If you are the only owner of an organization, transfer ownership or delete the organization first. - For any other request, email support@eventeer.io. We reply within 30 days.
If your own users want to exercise rights over event data you sent us, direct the request to you, the controller of that data. We will help you fulfil it.
Children
Eventeer is a developer service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us data, contact us and we will delete it.
Changes
We may update this policy as the service changes. The date at the top shows the latest revision. For material changes we will email account owners before they take effect.
Contact
Questions about this policy or your data: support@eventeer.io. See also ourterms of service.
Build on a hub you can trust
Set up your organization and listeners now, choose a plan when you are ready to send traffic.