Contact

All legal documents

Download PDF

Standard contractual clauses

Last updated: 25 October 2026.

This page is the transfer tool WEBAPI GROUP SAS uses when personal data actually leaves the EEA. It is not a copy of the Commission text.

In this document

1. When these clauses apply

The clauses apply to a transfer of personal data outside the EEA for billing, email, website analytics, support, and internal tools.

The public websites use Cloudflare, Inc. for DNS, delivery, and security. Cloudflare's proxy is enabled on all of these sites, and Orange-to-Orange is enabled.

The safeguard is Commission Implementing Decision (EU) 2021/914 of 4 June 2021. We use Modules 2 and 3. Clause 17 is French law. The clause text is the text in the Official Journal. It is not copied on this page.

We do not rely on the EU-US Privacy Shield.

2. When they do not apply

The clauses are not the mechanism for customer API content, because that content stays in the EU/EEA. Where that content is processed is the EU processing statement.

Processing in Germany, Finland, and our datacenters in Toulouse stays inside the EU/EEA. It is not a transfer to a third country. Hetzner locations used for the service are in Germany and Finland. The Toulouse datacenters are in France. They are operated by WEBAPI GROUP SAS, and they are not a third-party subprocessor.

Mistral AI is established in France. Processing that stays in France is not a transfer under these clauses.

3. The clauses we use

We incorporate the standard contractual clauses by reference. The decision allows the parties to select a module and to complete the appendix. We do not modify the clause text.

Data exporter: WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France. Contact: the product contact address or the registered office. Role: controller for account, billing, website, support, and dashboard security data; processor for customer API content. Signature: Josselin Liebe, for WEBAPI GROUP SAS.

Data importers: the providers in section 4 that process personal data outside the EEA. Their activities and addresses are those stated in their own data-processing terms. Role: processor, or independent controller where the subprocessor page says so, in particular for Stripe's fraud and regulatory activities.

The transfer covers customers' account contacts, website visitors, and people mentioned in a support message. It does not cover people who appear only inside customer API content.

Categories: account and billing identifiers, the email content needed to deliver a message, website analytics events, support messages a person sends to a support tool, and source code. Special-category data is not intended to be transferred.

The transfer is continuous while the tool is used. Retention follows the privacy policy and the provider's terms.

Technical and organisational measures: TLS in transit, access limited to authorised staff, API-key authentication on the service, rate limits, logging, no storage of full payment-card numbers on our servers, and deletion or isolation when the retention period ends. A subprocessor must apply measures at least as protective as its published data-processing terms.

4. Modules, docking, and subprocessors

  • Module 2 (controller to processor) applies when we are the controller and the provider processes personal data outside the EEA.
  • Module 3 (processor to processor) applies when we are the processor and a subprocessor processes related personal data outside the EEA. Customer API content itself is not in that transfer.
  • Clause 7 (docking) applies.
  • Clause 9, Option 2 applies: general written authorisation, with at least 30 days' notice before a new subprocessor starts.

The providers that may process personal data outside the EEA are Stripe, Postmark, Google Analytics, Discord, Slack, Linear, GitHub, HubSpot, and Cloudflare for public-website DNS, delivery, and security. If a Mistral processing activity leaves the EEA, the same clauses apply to that activity.

The live list is the subprocessor page.

5. Governing law

Clause 17: the clauses are governed by French law.

Clause 18: the courts of Toulouse, except where a mandatory rule provides otherwise. A data subject keeps any right under the clauses to bring proceedings in the Member State of their habitual residence. The competent supervisory authority is the CNIL.

A mandatory consumer right is reserved where it applies.

6. How to get a copy

The binding text is the Official Journal publication of Decision (EU) 2021/914. These choices apply when you accept the terms. Ask us for a countersigned copy and we will send one. Josselin Liebe signs for WEBAPI GROUP SAS. The copy is available to any customer. It is not limited to a particular plan.

Write to the registered office, or use the contact address published on the product website you use. WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France.

7. Changes

We will update this page, and the date above, when the transfer described here changes. Before a new subprocessor processes personal data outside the EEA, we will give at least 30 days' notice, by updating the subprocessor page and by email to the account address. You may object during that period, as the data processing agreement describes.