GDPR statement

Last updated: 24 October 2026.

This statement summarises how WEBAPI GROUP SAS meets the GDPR for WebAPI Group. The binding processor terms are the data processing agreement.

Controller and processor

We are the controller for accounts, billing, the public website, support, and dashboard security. We are the processor for customer API content (API requests, URLs, search queries, video, capture options, chart data, monitoring settings, extracted or generated results, and request logs). You remain the controller of that content and you are responsible for the lawful basis, the notice to your users, and the instructions you give us.

Processing location

Customer API content is processed only in the EU/EEA, on Hetzner infrastructure in Germany (Falkenstein and Nuremberg) and Finland (Helsinki), and in our own datacenters in Toulouse. This applies to every customer and every plan.

This commitment is the default for every customer and every plan. It is not an enterprise add-on.

Transfers

Customer API content is not sent outside the EU/EEA to provide the API. Cloudflare does not proxy the API. Mistral AI does not receive the API request stream.

Account, billing, email, website analytics, support messages, and engineering tools may involve providers outside the EEA. Those transfers use the 2021 Standard Contractual Clauses. See the SCC addendum and the subprocessor list. We do not rely on the EU-US Privacy Shield.

Rights and contact

People whose data we process as processor should contact the customer first. People whose data we process as controller can write to us. Complaints can go to the CNIL.

Write to the registered office, or use the contact address published on the product website you use. WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France. Publication director: Josselin Liebe.