EU processing statement
Last updated: 25 October 2026.
This statement says where WebAPI Group processes customer API content, and what that content is. It is the hosting description for every customer and every plan.
In this document
- 1. What this statement covers
- 2. Customer API content
- 3. Where that content is processed
- 4. What stays outside this statement
- 5. Subprocessors that host it
- 6. How long the logs are kept
- 7. Changes
1. What this statement covers
This statement applies to customer API content submitted to WebAPI Group. The products are Autom, BrowserSolver, CaptureKit, ChartQuery, Flystack, HuntAPI, Piloterr, and Veille. Autom is a SERP scraping API. The contracting entity is WEBAPI GROUP SAS, SIREN 984 275 917, registered office ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France.
There is no separate region, plan, or enterprise agreement for the processing location in this statement. It is how the service is built, for every customer and every plan.
Earlier public pages that described United States servers for this processing, or the EU-US Privacy Shield, are withdrawn. We do not rely on the Privacy Shield.
2. Customer API content
Customer API content means API requests, URLs, search queries, video, capture options, chart data, monitoring settings, extracted or generated results, and request logs.
You keep your rights in that content. You are the controller of personal data in it, and you choose the purpose. We are the processor. We process it only to provide, secure, and bill the service, and as you instruct through the product, the API, and the terms.
The data processing agreement is the Article 28 contract. It applies to every customer and every plan through the terms.
3. Where that content is processed
Customer API content is processed only in the EU/EEA, on Hetzner infrastructure in Germany (Falkenstein and Nuremberg) and Finland (Helsinki), and in our own datacenters in Toulouse. This applies to every customer and every plan.
Our datacenters in Toulouse are operated by WEBAPI GROUP SAS. They are a processing location, not a third-party subprocessor. Hetzner Online GmbH hosts the cloud portion of the service in Falkenstein, Nuremberg, and Helsinki.
Processing in Germany, Finland, and France is processing inside the EU/EEA.
4. What stays outside this statement
Accounts, billing, the public websites, support, and dashboard security are controller activities. They are described in the GDPR statement.
The public websites use Cloudflare, Inc. for DNS, delivery, and security. Cloudflare's proxy is enabled on all of these sites, and Orange-to-Orange is enabled.
Mistral AI may process support tickets, documentation-assistant messages, and a limited dashboard security profile. Mistral does not receive the API request stream.
The standard contractual clauses are not the mechanism for customer API content, because that content stays in the EU/EEA.
5. Subprocessors that host it
The third party that hosts customer API content is Hetzner Online GmbH, in Germany and Finland, as section 3 describes. The Toulouse datacenters are our own infrastructure. They are not listed as a third-party subprocessor.
Other providers process account, billing, email, website, support, or engineering data. The live table is the subprocessor list.
6. How long the logs are kept
We keep the full API request log for 3 months. After 3 months we keep only the HTTP method, the URL, and the response time.
The service is not a permanent archive. Save the results you need in your own systems. When the service ends, we delete or return customer API content as the data processing agreement describes. Backups are overwritten on their normal cycle and are isolated until then.
7. Changes
If the place where customer API content is processed changes, we will update this page and the date above, and we will give notice as the terms and the data processing agreement describe. Until this page says otherwise, section 3 applies to every customer and every plan.
Write to the registered office, or use the contact address published on the product website you use. WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France.