Legal
Data processing agreement
Last updated Oct 28, 2026
This agreement (“DPA”) applies whenever a customer (“Controller”) uses Scrape Engine to process personal data, for instance by scraping pages that contain some. [Company name] (“Processor”) then processes that data on the Controller”s behalf, as required by Article 28 of the GDPR. It is part of the terms of service and needs no signature: using the service means accepting it. A countersigned copy is available on request at [privacy@yourdomain].
1. Subject and duration
The Processor fetches the web pages the Controller asks for and returns their content. This DPA lasts as long as the Controller’s account.
2. Nature of the processing
| Purpose | Running the Controller’s requests: fetching, rendering and extracting web pages, returning the results, keeping request logs. |
|---|---|
| Data | Whatever personal data appears in the pages the Controller scrapes or the instructions it sends (names, contact details, public profiles…). The Controller decides what that is. |
| Data subjects | People whose data appears in those pages. |
| Retention | Results are returned, not stored. Request logs (trimmed responses) are kept 7 days to 1 year depending on the plan, then deleted automatically. Queued jobs leave our systems within minutes of completion. |
3. The Processor’s obligations
- Processes the data only on the Controller’s documented instructions (its requests and settings), and tells the Controller if an instruction seems to break the law.
- Never reuses the data for its own purposes, never sells it.
- Makes sure everyone with access is bound by confidentiality.
- Applies the security measures in section 5.
- Helps the Controller answer data subjects’ requests and meet its obligations (security, impact assessments, breach notification).
- Notifies the Controller of a personal data breach without undue delay, within 48 hours of becoming aware of it.
- At the end of the contract, deletes the data (deleting the account erases it at once), keeping only what the law requires.
- Makes available the information needed to show compliance, and allows audits by the Controller or its auditor, with reasonable notice, at most once a year.
4. Sub-processors
The Controller authorises the following sub-processors. The Processor binds each of them to obligations equivalent to this DPA, and announces any change 30 days ahead on this page; the Controller may object and close its account.
| Sub-processor | Purpose | Location and safeguards |
|---|---|---|
| Sign-in (OAuth) | United States (Data Privacy Framework) | |
| Stripe | Payments, invoices, affiliate payouts (Connect) | United States / EU (Data Privacy Framework, SCCs) |
| Anthropic | AI features | United States (SCCs) |
| Resend | Notification and marketing emails, marketing audience | United States (Data Privacy Framework) |
| Twilio | Phone verification SMS | United States (Data Privacy Framework) |
| [Hosting provider, address and phone] | Hosting (servers, database, backups) | [Country] |
| Proxy providers | Requests sent through a proxy | Various |
5. Security measures
- Encryption in transit (HTTPS) everywhere; secrets encrypted at rest; API keys stored hashed.
- Per-account isolation: each request runs in its own browser context, cache and sessions are scoped to the account.
- Access to production restricted to named administrators; no passwords (Google sign-in).
- Request logs trimmed (screenshots replaced by their size, long strings cut) and purged automatically.
- Private and internal addresses refused (SSRF protection); abusive requests blocked.
- Regular backups and dependency updates.
6. Transfers outside the EU
Transfers to sub-processors outside the European Economic Area rely on an adequacy decision (EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.
7. The Controller’s obligations
The Controller has a legal basis for what it scrapes, informs data subjects where required, and follows the acceptable use rules.