Privacy notice

Last updated 10 October 2026

This notice explains what personal data Webhooks Ltd collects when you use How’s that?, visit howsthat.design or contact us, why we use it, who we share it with, how long we keep it and what rights you have. It is written for UK data protection law: the UK GDPR and the Data Protection Act 2018.

1. Who we are

How’s that? is a trading name of Webhooks Ltd, a company registered in England and Wales with company number 16791194. Our registered office is:

Webhooks Ltd
8 Cedar Way
Tonyrefail, Porth
CF39 8JN
Wales

We are registered with the Information Commissioner’s Office (ICO), registration number ZC146591.

Our director is Mark Rawson. We don’t have a data protection officer, because the law doesn’t require one for a business like ours. Questions about privacy go to [email protected], or you can write to the address above.

2. Our two roles

Data protection law treats us differently depending on whose data it is and who decides what happens to it.

• We are the controller for data about our customers and their team members as account holders, billing, support, people who visit howsthat.design and our marketing. We decide how that data is used, and this notice describes it in full.
• We are a processor for the content our customers put into How’s that?: comments and replies, screenshots, journeys, page addresses, browser details and the names of guests they invite. We call this customer content. The customer who owns the project is the controller. We only use customer content to provide the service, under the data processing terms in our terms of service.

If you commented on a site because someone invited you, that person’s organisation decides how your comments are used. Questions about them are best sent to that organisation. If you contact us instead, we’ll pass your request on.

3. What we collect and why

The table lists each purpose, the data we use for it and our lawful basis under Article 6 of the UK GDPR. Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object.

We send occasional emails about How’s that?, such as new features and tips, through Loops. We only send them to people who have agreed to receive them, or where the law allows us to contact a business customer about our own similar services. Every email has an unsubscribe link, and unsubscribing doesn’t stop the service emails your account needs. Loops records whether each email was opened and which links were clicked, so we can tell which emails are useful.

We don’t sell personal data, and we don’t use it for automated decisions that have legal or similarly significant effects on you.

4. Customer content we process for customers

When someone leaves a comment in How’s that?, we store what they wrote and the details that make the comment useful. On the customer’s behalf, we process:

• comments, replies and resolve or reopen events, with the author’s name;
• the page address, and how the comment is attached to the page: the element’s selectors, its tag and attributes, and a short quote of nearby text;
• a screenshot of what the reviewer saw. Password fields, and any part of the page the site owner marks with data-annotate-mask, are blacked out before upload;
• browser details: the browser’s user agent, operating system, window size, pixel ratio, scroll position and whether the comment came from the extension, web mode or a journey;
• journeys, if the feature is switched on for an account. A journey is a recorded walkthrough of a site, made of page snapshots, the files those pages use, such as images and stylesheets, and a screenshot of each step. Password fields and hidden form fields are never captured, and the person recording chooses which other form values to hide before publishing;
• project settings, such as the project name and the site addresses it covers;
• guests’ names and comments;
• data exchanged with integrations the customer connects, such as issue references, and comments and author names synced from Linear.

Screenshots, snapshots and page addresses can contain personal data that was on the page being reviewed, such as names or order details on a staging site. The customer decides what is reviewed and is responsible for having a lawful basis to do it. Our acceptable use rules say which sites may be reviewed.

If you want to access, correct or delete customer content about you, please contact the organisation that runs the project. We will help them respond, and we will forward any request we receive.

5. Guests

A guest is someone who comments through a review link without creating an account. When you comment as a guest, we store the name you type, your comments, a screenshot of the page and your browser details, as described in section 4. The customer who sent you the link is the controller for that data, and we process it for them. We may also process your IP address for security, as described in section 3.

6. The browser extension

The How’s that? extension runs in Chrome and Edge. It only switches on for sites whose address belongs to one of your projects. It downloads the list of those addresses and checks each page against it inside your browser, so it doesn’t send us the addresses of other sites you visit.

On project sites, the extension reads the page so it can place pins and, when you leave a comment, take a screenshot. It uploads only what you submit: the comment, the screenshot with masked areas blacked out, the page address, and the browser details listed in section 4.

It keeps a few things in the browser’s extension storage, not in cookies: your sign-in token, the server it talks to, the list of project addresses, your theme, and unsent drafts. When journeys are switched on, it can record a journey on any page you choose to record, and the steps stay in your browser until you publish or discard them. Short-lived access tokens are kept only in memory.

7. AI agents

You can connect an AI agent, such as Claude Code, to How’s that? through our MCP server. You sign in and approve which projects and permissions it gets. The agent can then read comments, threads and screenshots in those projects, and reply, resolve or reopen threads as you.

Anything an agent reads goes to the AI provider behind it, under your or your organisation’s own agreement with that provider. That provider is not our sub-processor, and we don’t control what it does with the data. Check its terms before connecting it. We don’t send customer content to any AI provider ourselves.

You can see each connected app’s recent actions and revoke it under Account, Connected apps.

8. Integrations

Linear is the only integration today. It only runs when a customer’s admin connects it. When someone creates or links a Linear issue from a comment, we send Linear the comment text, the author’s display name, the project name, a description of the element, the page address without its query string, the window size, browser and operating system, a link back to the comment, and the screenshot. If the customer turns on reply sync, replies are sent too, and comments added in Linear come back with their Linear author’s name.

Linear processes this data as a service chosen by the customer, under the customer’s own agreement with Linear. We keep the Linear connection’s access token encrypted and never show it in a browser.

9. Who we share data with

We use the providers below to run How’s that?. Each one processes personal data only on our instructions and under a contract that includes data protection terms.

We will also share personal data when we have to: with professional advisers such as lawyers and accountants under a duty of confidentiality, with authorities or courts where the law requires it, and with a buyer or investor if our business or its assets are sold, under terms that protect the data.

Services a customer connects themselves, such as Linear or an AI agent, receive data because the customer tells us to send it. They are not our sub-processors. We will give customers notice before adding or replacing a sub-processor, as set out in the data processing terms.

10. Transfers outside the UK

Some of our providers process personal data outside the UK, or may access it from outside the UK. Cloudflare runs a global network, Google and Microsoft process analytics and advertising data in the United States, Loops sends our marketing emails from the United States, and providers may use staff or systems in the European Economic Area or the United States for support and security.

Where personal data leaves the UK, we make sure it is protected by one of the safeguards UK law allows:

• UK adequacy regulations, which cover the EEA and, for US companies certified under it, the UK Extension to the EU-US Data Privacy Framework;
• the ICO’s International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with an assessment of the risks of the transfer.

Ask us at [email protected] if you would like details of the safeguard used for a particular provider.

11. How long we keep data

We keep personal data only as long as we need it for the purposes above.

12. How we protect data

We take appropriate technical and organisational measures to protect personal data. They include:

• encryption in transit: every connection to the app uses HTTPS, and browsers are told to use nothing else;
• passwords stored only as salted hashes, with a temporary lockout after 10 failed sign-ins and limits on sign-in attempts from each IP address;
• private file storage with no public links: screenshots and journey files are only served through the app after it checks who is asking. Microsoft encrypts stored files at rest;
• integration access tokens encrypted with the app’s own keys;
• short-lived access tokens that rotate, and a Connected apps page where you can revoke any sign-in or agent at once. Disabling a user or changing their password revokes all their sign-ins;
• AI agents limited to the projects and permissions you approve. They can’t edit or delete what people wrote or create comments, and their actions are rate-limited and recorded;
• screenshots that black out password fields and any areas the site owner marks.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires. For customer content, we will tell the customer without undue delay so they can do the same.

13. Your rights

Under UK data protection law you have the right to:

• be told how your data is used, which is what this notice is for;
• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted in some circumstances;
• restrict how we use your data in some circumstances;
• object to our use of your data where we rely on legitimate interests, and at any time to direct marketing;
• receive data you gave us in a portable format, where we rely on consent or contract and process it by automated means (for customer content, any project’s comments and threads can be exported as JSON from its settings);
• withdraw consent at any time, where we rely on it. This doesn’t affect anything we did before you withdrew it.

To use any of these rights, email [email protected]. We may need to confirm who you are first. We will reply within one month. If a request is complex, or you make several, we may extend that by up to two further months and will tell you why. We don’t charge, unless a request is clearly unfounded or excessive.

For customer content, such as comments you left on a client’s project, we will pass your request to the customer who controls it, as explained in section 2.

14. Complaints

If you are unhappy with how we have handled your data, please tell us first at [email protected] and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection: ico.org.uk/make-a-complaint, or 0303 123 1113.

15. Children

How’s that? is a service for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it.

16. Changes to this notice

We will update this notice when our services or the law change. The date at the top shows when it last changed. If a change significantly affects how we use your personal data, we will tell account holders by email or in the app before it takes effect.

See also our cookie notice and terms of service.