Skip to content

To be reviewed by legal counsel. This page is a draft and will be finalized before the service is live.

Privacy Policy

webskts is operated by Bhespoke L.L.C.

Effective 29 October 2026.

This Privacy Policy explains how Bhespoke L.L.C. collects, uses, discloses, retains, and protects personal information when you use webskts.com.

It also explains the choices and rights available to you. This Policy applies to website visitors, Customers, End Users, and persons who communicate with us. Words such as "Customer," "Project," "Channel," "Message," and "End User" have the meanings given in the Terms of Service.

1. Who We Are and Scope

Bhespoke L.L.C. ("Bhespoke," "we," "us," or "our") operates webskts.com and the related real-time messaging service. This Policy applies to information we process through the Service. It does not govern third-party services, including Stripe, whose own privacy policies control their processing.

When a Customer sends information about its own End Users through the Service, the Customer decides what is sent and why, and we process it on the Customer's behalf, as its service provider. The Customer's own privacy policy governs that information, and End Users should direct requests about it to the Customer. Section 2.3 describes what we do with it.

2. Personal Information We Collect

2.1 Information You Provide

  • Account information, including username, email address, hashed password, the secret for two-factor sign-in if you turn it on, which invitation code you used (while invitations are required during the beta), your choice of language and time zone, and the usage level at which you want a warning email.
  • Project information, including each Project's name, its Credentials (the API key is stored encrypted), its connection domain, its allowed websites and allowed API addresses, and, while you set up your own domain, the DNS record we ask you to add.
  • A record of your agreement: the version of the Terms you accepted when you signed up, with the time, your IP address, and your browser; and the terms of any Enterprise offer you accepted, with the time and your IP address.
  • Support, contact, copyright, moderation, and other communications, including information submitted through the Contact us page, the beta waiting list, or correspondence.
  • Transaction-related information, including your Stripe customer identifier, plan, billing interval, subscription status, billing dates, and the amounts and tax on your invoices. We do not store card numbers. Stripe collects your card details, billing address, and any tax ID you give, and keeps them under its own privacy policy; we receive your billing address and tax ID from Stripe to show them on your receipts.

2.2 Information Collected Through Use

  • Usage information for each Project, including counts of Messages sent and refused, connections, and Channels, recorded every hour (and every five minutes for our own monitoring) and totaled each day.
  • Operational and security logs, including IP address, device and browser information, requested URL, timestamps, response codes, sign-in events, and a record of changes to accounts, Projects, and plans.
  • Region and preference information, including language, locale, time zone, and display preferences.
  • Browser storage information described in Section 8.

2.3 Messages and End Users

Messages pass through our servers on their way to the End Users connected to a Channel. Each Message is kept, in memory or in our servers' shared data store, for up to sixty (60) seconds so that a client that reconnects can catch up on what it missed, and is then deleted; it is deleted sooner once one thousand (1,000) newer Messages exist on the same Channel, and a server restart can delete it sooner. We do not keep a copy after that. We do not read, analyze, or use the content of Messages except to deliver them, to enforce size and usage limits, or where it is needed for security or to comply with law.

When an End User's browser, app, or device connects to the Service, our servers process its IP address, the website it says it is on, and the connection domain it uses, in order to enforce the Customer's allowed websites, the limit on connections from one address, and our security. Channel names are seen by our servers while the Channel is in use; we record only how many Channels each Project has, not their names. Refused connections may be logged with their IP address, and those logs are kept as described in Section 6.

If a Customer's pages load our browser client from webskts.com, End Users' browsers fetch it from us, through Cloudflare, like any other web file. We set no cookies when they do.

3. How We Use Personal Information

  • Provide, personalize, maintain, and secure accounts, Projects, Message delivery, plans, and payments.
  • Process transactions, administer plans and plan changes, and prevent fraud and abuse.
  • Show Customers their usage, and enforce and warn about the limits of their plans.
  • Communicate about account verification, password resets, your account being ready, usage warnings, billing, plan changes and offers, changes to your Credentials, service changes, security, support, moderation, and copyright claims. We do not send marketing email unless you ask for it.
  • Monitor, troubleshoot, test, analyze, and improve the Service, including through aggregated or de-identified statistics.
  • Comply with law, enforce agreements, protect rights and safety, preserve evidence, and respond to lawful requests.

We do not sell personal information, use personal information for cross-context behavioral advertising, share identifiable information with data brokers, or train general-purpose artificial-intelligence models on user Content.

4. Legal Basis for Processing

Where applicable law requires a legal basis, we process information as necessary to perform our contract with you, comply with legal obligations, protect legitimate interests such as security and service improvement, and act on consent where consent is required. You may withdraw consent for future processing, but withdrawal does not affect prior lawful processing.

5. How We Disclose Personal Information

We disclose only information reasonably necessary for the purpose described:

  • Stripe, for payment processing, recurring billing, tax calculation, and fraud prevention.
  • Hetzner and other hosting or infrastructure providers, for servers, networking, backups, maintenance, security, and the servers that deliver Messages.
  • Cloudflare, for network delivery and security, and Turnstile bot detection on forms such as sign-up, sign-in, the waiting list, and the Contact us page.
  • Transactional email providers, for account verification, password resets, usage warnings, billing and plan notices, security notices, and service communications.
  • Certificate authorities, only when you set up your own connection domain: we ask one to issue a certificate for the domain, and the domain name is then published in public certificate-transparency logs, as it is for every website certificate.
  • Professional advisers, auditors, insurers, and vendors working under appropriate confidentiality and data-protection obligations.
  • The Customer whose application an End User uses, which can see its Projects' usage counts but not End Users' IP addresses.
  • Government authorities, courts, counterparties, or other persons when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or establish, exercise, or defend legal claims.
  • A buyer, successor, lender, or adviser in connection with a merger, financing, reorganization, sale, or similar transaction, subject to appropriate safeguards.

Anyone who has a Project's connection ID can subscribe to its Channels and receive the Messages sent on them, unless the Customer limits that with the Project's allowed websites. Customers should treat every Channel as readable by anyone who has the connection ID (Section 4.1 of the Terms of Service).

6. Retention and Deletion

We retain personal information only as long as reasonably necessary for the purposes described, including account administration, contractual obligations, dispute resolution, fraud prevention, legal compliance, security, and backups. Standard server logs are ordinarily retained for ninety (90) days. Aggregated or de-identified information may be retained without a fixed period.

Messages are kept for sixty (60) seconds at most, as described in Section 2.3. A Project's hourly usage counts are kept for ninety (90) days and its daily totals for as long as the Project exists. Five-minute counts, used only for our own monitoring, are kept for about a day.

When a Project is deleted, or an account is closed, its Credentials stop working and its connections are closed at once. The Project is kept switched off on our servers for up to ninety (90) days, so that a mistake can be investigated, and is then deleted together with its usage counts. Totals across all Customers that no longer identify the closed account may be kept.

Copies of the emails we send you, and messages sent through the Contact us page, are kept as a record of our communications with you for as long as your account exists and as reasonably necessary afterwards. An address on the beta waiting list is kept to tell you when the Service opens and, if we choose, to send you an invitation. It is confirmed by a link we email you, and one not confirmed within seven (7) days is deleted. Every email about the list has a link that deletes your address, and it is also deleted when you close an account made with it, or when you ask us to.

Closing an account deletes it at once, subject to the Project handling above, backup cycles, the record of your agreement to the Terms, and information Stripe retains for tax, accounting, transaction, anti-fraud, or other legal obligations. Backups are kept for a limited period and then overwritten.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including password hashing, encryption of API keys at rest, two-factor sign-in, access controls, encrypted transmission for the website and for every connection to the Service, monitoring, vendor controls, and data minimization. No security measure or method of transmission is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and of your Projects' API keys.

8. Cookies, Browser Storage, and Analytics

We do not use advertising cookies, third-party cross-site tracking cookies, or third-party analytics. Our website uses cookies only to keep you signed in and to protect forms from forgery. It keeps a few things in your browser's local storage: your display preferences (such as light or dark), which sections of a page you collapsed, and forms you have started but not sent. Clearing your browser storage removes them, but may sign you out.

While a page of our website is open, your browser holds a connection to our own messaging service so the page updates when something changes, such as your usage or your plan. The messages on that connection only say that something changed; the page then fetches the details from us. Cloudflare Turnstile may load when you sign up, sign in, join the waiting list, or send us a message, to distinguish legitimate requests from automated abuse. It looks at technical signals such as your browser and connection, not at what you typed.

9. International Data Transfers

Bhespoke L.L.C. and some service providers process information in the United States and the European Economic Area. If information is transferred from a jurisdiction that restricts international transfers, we use an available lawful mechanism appropriate to the transfer, which may include contractual safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate.

10. Your Privacy Rights and Choices

Subject to applicable law and verification, you may request access to, correction of, deletion of, or a portable copy of your personal information; object to or restrict certain processing; withdraw consent; and opt out of a sale, targeted advertising, or qualifying profiling. Because we do not sell personal information or use it for targeted advertising, those opt-out requests ordinarily confirm that no such activity occurs. We extend access, correction, deletion, and portability requests to users regardless of residence where reasonably practicable.

Much of this you can do yourself. You can see and change your account details from your account page, and delete your account there. You can delete a Project, change its settings, and replace its Credentials from your dashboard. If you are an End User of a Customer's application, please direct requests about information in that application's Messages to the Customer; if you contact us, we will refer you to the Customer and help it respond where only we can act.

Submit any other request through the Contact us page on webskts.com, or by email to [email protected]. We may request information reasonably necessary to verify identity and authority. We aim to respond within thirty (30) days, or within another period permitted by applicable law, and will explain any lawful extension or denial. You may appeal a denied request by replying to the decision or submitting a new request marked "Privacy Appeal." You may use an authorized agent where applicable law permits, subject to verification.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides covered California consumers with rights including the right to know, access, correction, deletion, and opt-outs for the sale or sharing of personal information, and the right not to be discriminated against for exercising them. Whether a particular provision applies depends on statutory scope, thresholds, and exemptions; this Policy is intended to support compliant handling if and when the law applies.

11. Account Closure and Project Data

A user may close an account using the controls on the account page or by contacting us. Closing an account stops any paid plan, refunds the unused part of the current period as described in the Terms of Service, and deletes every Project the account created, as described in Section 6. Deleted Projects and their settings cannot be recovered. We may retain transaction, tax, fraud-prevention, copyright, and legal records as described in Section 6.

12. Children

The Service is not directed to children under thirteen (13), and we do not knowingly collect personal information from a child under thirteen. Users must be at least eighteen (18) to create accounts, create Projects, or enter paid transactions. A Customer whose application is used by children is responsible for obtaining any consent the law requires before sending their personal information through the Service. If you believe a child provided personal information, contact us through the Contact us page so we can investigate and delete it where appropriate.

13. Do Not Track and Global Privacy Controls

Because we do not engage in targeted advertising or sell personal information, the Service does not use browser "Do Not Track" signals to alter advertising practices. Where legally required and technically feasible, we will treat a recognized universal opt-out mechanism, such as a Global Privacy Control signal, as a request to opt out of sale or targeted advertising.

14. Changes to This Policy

We may update this Policy to reflect changes in the Service, law, or our practices. We will post the revised Policy with a new effective date. For a material change, we will provide advance notice by email, in-product notice, or another reasonable method when required by law. We will request consent if a new use requires consent.

15. Contact Us

Submit privacy questions or requests through the Contact us page on webskts.com, or by email to [email protected].