Privacy Policy

We collect only what's necessary to provide and improve the ScrapingIsNotACrime API service. Here is a precise breakdown:

• Account data — your email address and, if you choose, a display name. If you sign in with Google, we also store your profile picture URL from your Google account. This is used to identify your account, send invoices, and communicate service updates.
• API usage data — every API call logs a timestamp, endpoint called, credits consumed, response status code, and latency. No request body content or response payload is stored.
• Billing data — payment is processed via a third-party processor (Stripe). We store only a tokenized reference to your payment method — never a raw card number, CVV, or bank detail.
• IP address — collected at signup and on each API call for security, abuse detection, and rate-limit enforcement. Retained for 90 days.
• Support communication — if you contact us via email or a support channel, we retain those messages to provide follow-up assistance.

We use collected data only for the purposes listed below. We do not sell your data, and we do not build advertiser profiles from it — see §5 for the non-personalized measurement signals we send to Google Ads so we can gauge ad campaign performance.

• Authenticating your requests via your X-API-Key
• Deducting credits and managing your account balance
• Sending transactional emails (receipts, low-credit alerts, service notices)
• Detecting and blocking abusive usage patterns
• Generating aggregate usage analytics to guide product development — including Google Analytics on our site and inside the dashboard, only with your consent and without your name, email, account identifiers or API keys (see §5)
• Complying with legal obligations

To be explicit about what we don't do:

• We do not store social media data retrieved through our API
• We do not sell, rent, or trade your personal data
• We do not use your data to train AI or machine learning models
• We do not track you across other websites for general profiling — Google Signals and ad personalization are disabled. Our Google Ads measurement (see §5) sends non-personalized page-view, product-action and signup signals so we can gauge whether our ad spend is working; it does not build cross-site advertising profiles
• We do not collect device fingerprints or session recordings
• We do not send Google your name, email, account or workspace identifier, API keys, the content of your API requests, error messages, or invoice and payment identifiers
• We do not share identifiable data with advertisers

Your account data is stored in encrypted form on servers located in the United States and European Union. We use industry-standard AES-256 encryption at rest and TLS 1.3 in transit.

• Account data — retained for the lifetime of your account, plus 30 days after deletion
• API usage logs — retained for 90 days, then automatically purged
• Billing records — retained for 7 years to comply with financial regulations
• IP logs — retained for 90 days for security purposes
• Support messages — retained for 2 years after last contact

You may request deletion of your account and associated personal data at any time. See Your rights below.

We use a small number of third-party services to operate the product. Each is subject to their own privacy policy:

• Stripe — payment processing. stripe.com/privacy
• Postmark / Resend — transactional email delivery
• Cloudflare — DDoS protection and DNS. May log IP addresses per their policy. We also use Cloudflare Web Analytics, a cookieless, no-PII traffic-measurement tool, on all pages
• AWS / GCP — cloud infrastructure hosting

We offer Sign in with Google as an alternative to email/password — when you use it, we read only your email, name, and profile picture from your Google account, solely to create or link your account. We request no additional scopes, never post on your behalf, and don't use this for anything beyond authentication.

We use Google Analytics (GA4) on our site and inside the authenticated dashboard — but only after you explicitly accept via the cookie banner. It records the pages you visit and product actions such as creating an API key, sending a Playground request or starting a checkout. Page addresses are sent without query strings or fragments, and the referring page is reduced to its domain.

It never receives your name, email, account or workspace identifier, API keys, the content of your requests, error messages, or invoice and payment identifiers. Google Signals and ad personalization are disabled, and IP addresses are anonymized. See Google's privacy policy. You can withdraw consent anytime via "Cookie preferences" in the footer.

With your consent, our Google tag also sends Google Ads non-personalized measurement signals: page views from the site and the dashboard, and a "signup happened" conversion when an account is created — so we can measure whether our ad campaigns are working. Because the tag is linked, Google Ads also receives the product actions described above. These signals carry the same sanitized page addresses and none of the personal data listed in this policy; outside the sign-up and sign-in pages, they are sent without advertising cookies.

They are not used for remarketing or ad personalization. We don't build advertiser profiles from them, and Google Signals stays off.

Without your consent, we only use the cookies strictly necessary to keep you logged in to the dashboard:

• Session cookie — keeps you logged in to the dashboard. Expires on logout or after 30 days of inactivity.
• CSRF token — prevents cross-site request forgery attacks. Session-scoped.

If you accept via the cookie banner, we also set Google Analytics cookies, on our public pages and inside the dashboard, to measure page visits and product usage as described in §5. You can accept, decline, or change your mind at any time via "Cookie preferences" in the footer.

On the sign-up and sign-in pages, we also use a Google Ads conversion cookie — again, only after you accept the cookie banner — to measure signup conversions from ad campaigns. It is not used for remarketing or ad personalization.

Beyond the Google tag described in §5, we do not use any other advertising cookies, and no tracking pixels. You can disable cookies in your browser, though this will prevent you from using the dashboard.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate personal data
• Deletion — request deletion of your account and personal data
• Portability — request your data in a machine-readable format
• Objection — object to processing in certain circumstances
• Restriction — request restriction of processing

To exercise any right, email us at [email protected]. We will respond within 30 days.

ScrapingIsNotACrime is a developer API service intended for adults and businesses. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected data from a minor, contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users by email at least 14 days before the change takes effect.

Continued use of the service after a policy change constitutes acceptance of the updated policy.

For privacy-related questions, data requests, or concerns:

• Email: [email protected]
• Response time: within 30 days