Privacy Policy

We collect only what's necessary to provide and improve the ScrapingIsNotACrime API service. Here is a precise breakdown:

• Account data — your email address and, if you choose, a display name. If you sign in with Google, we also store your profile picture URL from your Google account. This is used to identify your account, send invoices, and communicate service updates.
• API usage data — every API call logs a timestamp, endpoint called, credits consumed, response status code, and latency. No request body content or response payload is stored.
• Billing data — payment is processed via a third-party processor (Stripe). We store only a tokenized reference to your payment method — never a raw card number, CVV, or bank detail.
• IP address — collected at signup and on each API call for security, abuse detection, and rate-limit enforcement. Retained for 90 days.
• Support communication — if you contact us via email or a support channel, we retain those messages to provide follow-up assistance.

We use collected data only for the purposes listed below. We do not sell your data, and we do not build advertiser profiles from it — the sole exception, detailed in §5, is a single anonymous "signup happened" signal we send to Google Ads (no personal data included) so we can measure ad campaign performance.

• Authenticating your requests via your X-API-Key
• Deducting credits and managing your account balance
• Sending transactional emails (receipts, low-credit alerts, service notices)
• Detecting and blocking abusive usage patterns
• Generating aggregate, anonymized usage analytics to guide product development — including Google Analytics on our public pages (see §5)
• Complying with legal obligations

To be explicit about what we don't do:

• We do not store social media data retrieved through our API
• We do not sell, rent, or trade your personal data
• We do not use your data to train AI or machine learning models
• We do not track you across other websites for general profiling — Google Signals and ad personalization are disabled. The one exception is our Google Ads conversion tag (see §5), which — by design — links an ad click to a signup on our site so we can measure whether our ad spend is working; it does not build a broader cross-site profile beyond that single measurement
• We do not collect device fingerprints or session recordings, and we do not use behavioral analytics inside the authenticated dashboard
• We do not share identifiable data with advertisers

Your account data is stored in encrypted form on servers located in the United States and European Union. We use industry-standard AES-256 encryption at rest and TLS 1.3 in transit.

• Account data — retained for the lifetime of your account, plus 30 days after deletion
• API usage logs — retained for 90 days, then automatically purged
• Billing records — retained for 7 years to comply with financial regulations
• IP logs — retained for 90 days for security purposes
• Support messages — retained for 2 years after last contact

You may request deletion of your account and associated personal data at any time. See Your rights below.

We use a small number of third-party services to operate the product. Each is subject to their own privacy policy:

• Stripe — payment processing. stripe.com/privacy
• Postmark / Resend — transactional email delivery
• Cloudflare — DDoS protection and DNS. May log IP addresses per their policy. We also use Cloudflare Web Analytics, a cookieless, no-PII traffic-measurement tool, on all pages
• AWS / GCP — cloud infrastructure hosting

We offer Sign in with Google as an alternative to email/password — when you use it, we read only your email, name, and profile picture from your Google account, solely to create or link your account. We request no additional scopes, never post on your behalf, and don't use this for anything beyond authentication.

We do use Google Analytics (GA4) — but only on our public marketing and documentation pages, never inside the authenticated dashboard, and only after you explicitly accept via the cookie banner. Google Signals and ad personalization are disabled, and IP addresses are anonymized. See Google's privacy policy. You can withdraw consent anytime via "Cookie preferences" in the footer.

We also use a Google Ads conversion tag on the sign-up and sign-in pages, gated by the same cookie banner. It fires a single, anonymous "a signup happened" signal when your account is created — no personal data (name, email) is included — so we can measure whether our ad campaigns are working. It is not used for remarketing or ad personalization.

We use a minimal set of cookies in the authenticated dashboard — only what's necessary to keep you logged in.

• Session cookie — keeps you logged in to the dashboard. Expires on logout or after 30 days of inactivity.
• CSRF token — prevents cross-site request forgery attacks. Session-scoped.

On our public marketing and documentation pages only, we optionally set a Google Analytics cookie — but only after you explicitly accept it via the cookie banner. It is never active in the authenticated dashboard. You can accept, decline, or change your mind at any time via "Cookie preferences" in the footer.

On the sign-up and sign-in pages, we also use a Google Ads conversion cookie — again, only after you accept the cookie banner — to measure signup conversions from ad campaigns. It is not used for remarketing or ad personalization.

We do not use any other advertising cookies or tracking pixels. You can disable cookies in your browser, though this will prevent you from using the dashboard.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate personal data
• Deletion — request deletion of your account and personal data
• Portability — request your data in a machine-readable format
• Objection — object to processing in certain circumstances
• Restriction — request restriction of processing

To exercise any right, email us at [email protected]. We will respond within 30 days.

ScrapingIsNotACrime is a developer API service intended for adults and businesses. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected data from a minor, contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users by email at least 14 days before the change takes effect.

Continued use of the service after a policy change constitutes acceptance of the updated policy.

For privacy-related questions, data requests, or concerns:

• Email: [email protected]
• Response time: within 30 days