Legal
Privacy policy
Last updated Oct 28, 2026
This policy explains what personal data Scrape Engine processes, why, for how long, and the rights you have under the GDPR. The controller is [Company name], [Registered address]. Questions and requests: [privacy@yourdomain].
What we process and why
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Name, email and picture from your Google account | Creating and running your account | Contract | Until you delete your account |
| Sessions: IP address, browser, dates | Keeping you signed in, security | Contract, legitimate interest (security) | Until the session expires or is revoked |
| API keys (hashed) and secrets (encrypted) | Authenticating your requests, filling them in | Contract | Until you delete them or your account |
| Request logs: target URL, request body (secrets left as placeholders), trimmed response, cost | Your logs and usage, billing, abuse prevention | Contract, legitimate interest (abuse prevention) | 7 days (free), 30 days (Go and packs), 90 days (Pro), 1 year (Scale), then deleted automatically |
| Credit history, purchases, subscription | Billing, accounting | Contract, legal obligation | Account lifetime; invoices 10 years (legal obligation, kept by Stripe) |
| Templates you create | Running them, the marketplace when you publish | Contract | Until you delete them; published ones stay, unattributed, after you leave |
| Phone number | Unlocking the free credits once per person | Legitimate interest (abuse prevention) | Sent to Twilio for the SMS; we keep only a keyed hash, indefinitely, so a number can’t unlock credits twice |
| Support tickets | Answering you | Contract | Until you delete your account |
| Device fingerprint (a hash computed in your browser by FingerprintJS, on the dashboard only) | Keeping banned users from coming back on the same device | Legitimate interest (fraud prevention) | Account lifetime, or with a ban |
| Consents: terms version, commercial emails, notification settings | Proving what you accepted, sending only the emails you want | Legal obligation, consent | Account lifetime |
| Banned accounts: email, phone hash, device fingerprints | Keeping banned users off the platform | Legitimate interest (abuse prevention) | Until the ban is lifted, even after the account is deleted |
| Unused accounts | Storage limitation | Legal obligation | Erased after 3 years without any sign-in or request |
| Anonymous playground runs: IP address | Rate limiting | Legitimate interest (abuse prevention) | 1 minute (rate limit), 7 days (logs, without IP) |
We don’t sell your data, don’t use it for advertising, and don’t build profiles.
Data you scrape
Pages you scrape may contain personal data. For that data you are the controller and we act as your processor: we process it only to run your requests, keep it only in your request logs for the retention above, and never reuse it. You must have a legal basis for collecting it (see the acceptable use rules).
Who receives it
- Google: sign-in (oauth) (name, email, picture).
- Stripe: payments, invoices, affiliate payouts (connect) (email, payment details, invoices; affiliates' identity and bank details (collected by stripe)).
- Anthropic: ai features (page content and instructions of requests using ai).
- Resend: notification and marketing emails, marketing audience (email address, first name, consent to marketing, email content).
- Twilio: phone verification sms (phone number).
- [Hosting provider, address and phone]: hosting (servers, database, backups) (all platform data).
- Proxy providers: requests sent through a proxy (target urls and pages fetched, not the customer's identity).
Card details go to Stripe directly: we never see them. The full list, with safeguards, is in the data processing agreement.
Some of them are outside the EU (United States). Transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
Your rights
- Access and portability: download everything we hold about you as JSON from Settings → Your data.
- Erasure: delete your account from Settings: your data is erased at once, your payment customer deleted at Stripe and any subscription cancelled. Invoices are kept as accounting law requires.
- Rectification: edit your name in Settings; your email follows your Google account.
- Objection, restriction: write to [privacy@yourdomain]; we answer within one month.
You can also complain to your data protection authority, in France the CNIL (cnil.fr).
Security
Traffic is encrypted (HTTPS), API keys are stored hashed, secrets encrypted, and no password is ever stored: you sign in with Google.
Changes
We’ll tell you by email or in the dashboard before any significant change to this policy.