Standard contractual clauses

Last updated: 24 October 2026.

This addendum incorporates the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The full clause text is the text published in the Official Journal. It is not copied here.

The clauses apply only to the transfers described below. Customer API content is processed only in the EU/EEA, on Hetzner infrastructure in Germany (Falkenstein and Nuremberg) and Finland (Helsinki), and in our own datacenters in Toulouse. This applies to every customer and every plan. The clauses are not used to move customer API content outside the EU/EEA, because that processing stays in the EU/EEA.

Clause choices

Module 2 (controller to processor) applies when WEBAPI GROUP SAS is the controller and the provider processes personal data outside the EEA.
Module 3 (processor to processor) applies when WEBAPI GROUP SAS is the processor of customer API content and a subprocessor processes related personal data outside the EEA. Customer API content itself is not in that transfer.
Clause 7 (docking) applies.
Clause 9, Option 2 applies: general written authorisation, with at least 30 days' notice of a new subprocessor.
Clause 17: the clauses are governed by French law.
Clause 18: the courts of France. The competent supervisory authority is the CNIL.

We do not rely on the EU-US Privacy Shield.

Annex I. List of parties

Data exporter: WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France. Contact: the product contact address or the registered office. Role: controller for account, billing, website, and support data; processor for customer API content. Signature: Josselin Liebe, for WEBAPI GROUP SAS.

Data importers: the providers in Annex III that process personal data outside the EEA. Their activities and addresses are those stated in their own data-processing terms. Role: processor, or independent controller where the subprocessor page says so, in particular for Stripe's fraud and regulatory activities.

Annex I. Description of transfer

Data subjects: customers' account contacts, website visitors, and people mentioned in a support message. Not the people who happen to appear only inside customer API content, because that content stays in the EU/EEA.

Categories: account and billing identifiers, email content needed to deliver a message, website analytics events, support messages a person sends to a support tool, and source code. Special-category data is not intended to be transferred.

Frequency: continuous as the tool is used. Retention: as stated in the privacy policy and the provider's terms.

Annex II. Technical and organisational measures

TLS in transit, access limited to authorised staff, API-key authentication on the service, rate limits, logging, no storage of full payment-card numbers on our servers, and deletion or isolation when the retention period ends. Subprocessors must apply measures at least as protective as their published data-processing terms.

Annex III. Subprocessors that may process personal data outside the EEA

Stripe, Postmark, Google (website analytics), Discord, Slack, Linear, GitHub, HubSpot, and Cloudflare for website and DNS traffic. Mistral AI is established in France. If a Mistral processing activity leaves the EEA, the same clauses apply to that activity. Hetzner locations used for the service are in Germany and Finland. The Toulouse datacenters are in France.

The live list, including what each provider does not receive, is the subprocessor page.

Write to the registered office, or use the contact address published on the product website you use. WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France. Publication director: Josselin Liebe.