Privacy Policy

1. Who is responsible

The controller of account data is the operator of this Scrapely instance. There is no separate named legal entity in this document on purpose — fill that in with counsel before you process real customer data at scale.

Contact and deletion requests: the Contact page. We will not invent a Data Protection Officer name that does not exist.

2. What we collect

Account: email, display name, hashed password (if you use email sign-in), and identifiers from Google or X if you use those buttons.

Workspace: organization name, memberships, roles, plan, usage meters, saved searches, saved records, monitors, investigations, reports, API key prefixes (not the raw key after creation), and AI prompts/outputs you generate.

Technical: session cookies, timestamps, and coarse request metadata needed to run auth and rate limits. We do not run third-party advertising cookies.

Contact form: the name, email, and message you send.

Marketing opt-out list: email addresses that asked not to be mailed, so we can honor that.

3. What we do not collect on purpose

We do not ask for government ID, payment card numbers, or precise GPS. Because no processor is connected, we do not receive card PAN data.

Indexed social records are copies of publicly available posts retrieved at query time. They are not private profiles. Copyright stays with the original authors and platforms. See the Data source policy.

We do not sell personal data. We do not share it with data brokers for money.

4. Why we process it (legal bases)

Contract: to create your workspace, meter entitlements, and provide the features you asked for.

Legitimate interests: security, abuse prevention, product analytics we store ourselves (event names like search_completed), and improving the service — balanced against your rights.

Consent: optional emails, and non-essential cookies if we ever add them (today we do not).

Legal obligation: tax, accounting, and responding to lawful requests.

5. AI processing

If you click Analyze and an xAI key is present, evidence excerpts you already stored can be sent to xAI to produce a brief. That is user-initiated. Do not paste secrets. If the key is absent, analysis stays extractive and local to stored records.

6. Retention

Account and workspace data last until you delete the account, plus a short technical delay.

Billing and opt-out records may be kept longer where tax, fraud, or anti-spam rules require a suppression list.

Usage events are kept to enforce monthly caps and then as operational logs for a limited period.

7. Your rights

Depending on where you live (including the EEA, UK, and California), you may have rights to access, correct, delete, export, restrict, or object, and to appeal a denial. Use Contact or Settings → Delete account.

California: we do not sell or share personal information as those words are used in the CPRA for cross-context behavioral advertising. You can still send a request.

You may lodge a complaint with a supervisory authority. We would rather fix the issue if you contact us first, but that is your choice.

8. Children

The service is not directed at anyone under 18. We do not knowingly collect their data. If we learn we have, we will delete the account.

9. International transfers

Infrastructure may be in the United States or wherever the Operator hosts the app. If you use the service from elsewhere, you understand data may be processed in that host region. We do not pretend a specific SCC pack is executed in-app.

10. Security

We hash passwords, hash API keys, and scope workspace data to signed-in users. This is ordinary care, not a certification. No method of transmission is guaranteed secure. Report suspected incidents via Contact.

11. Changes

Updates will be posted on this page with a new effective date.