Privacy Policy
This policy explains what personal data Crawio ("we") collects when you use our website and API, why, and what rights you have. Questions or requests: contact us.
1. What we collect
- Account data: email address, optional company/project name, and a hashed password (we never store the password itself).
- Usage data: per-domain request, success, and failure counts, used for your dashboard and billing. Billing is based on successful requests, not bandwidth.
- Request log: for each API request, the URL, method, status and timing, and the headers and body you sent with passwords, cookies and keys masked. You can review it in your dashboard. The headers and body are deleted after 7 days and the rest of the entry after 30 days. Page content returned to you is not kept once it is delivered.
- Security logs: IP addresses and rate-limit counters for abuse prevention, kept short-term.
- Website analytics: Cloudflare Web Analytics counts page views and page load times on our website, without cookies and without tracking you across sites.
- Support data: tickets you open, including messages and images you attach.
- Billing data: handled by Paddle.com, our merchant of record, when you buy a paid plan; we never see or store full card numbers.
- Payment recovery: Paddle's script runs on our pages to open checkout and, for paying customers, to ask for a new card when a payment fails or a card is about to expire. It sets no cookies on crawio.com.
Cookies and browser storage: we set one essential, httpOnly session cookie to keep you signed in. Cloudflare, which protects our website, sets a security cookie (cf_clearance) once your browser passes its check. If you use Sign in with Google, Google's sign-in script keeps its state in a cookie (g_state). Your browser also stores your theme choice and the plan you picked on the pricing page (for that browser tab only); these stay on your device. No advertising or cross-site tracking cookies.
2. Why we process it (lawful bases)
- To provide the Service you signed up for: accounts, dashboards, quota, and support (contract).
- To secure the platform and prevent abuse (legitimate interest).
- To send transactional email: verification, password resets, quota alerts, ticket replies (contract). We do not send marketing email without your consent.
- To meet legal obligations, such as tax and accounting rules (legal obligation).
3. Content you scrape
Web content retrieved at your instruction passes through our infrastructure and is retained only briefly to deliver results and operate the Service. For any personal data contained in that content, you are the data controller and we act as your processor on your instructions, and your obligations for it are set out in the Terms of Service.
4. Who else processes data
We share personal data only with service providers needed to run Crawio: infrastructure hosting, Cloudflare (website security and analytics), email delivery, payment processing (Paddle, for paid plans), Google (only if you sign in with Google), and network/proxy carriers that transport API traffic. We do not sell personal data and we do not run ads.
5. Retention
- Account and usage data: for as long as your account exists. Deleting your account removes your workspace, logins, and usage history.
- Request log: 30 days (the headers and body you sent: 7 days).
- Security logs: short-term, rolling.
- Encrypted off-site backups: kept on a rolling window, then overwritten.
6. Your rights
You can access and export your usage data (CSV) and change your email or password in the dashboard, and delete your account from the Account tab. Under GDPR/UK GDPR you also have the rights to access, correct, delete, restrict, and port your personal data, to object to processing, and to complain to your supervisory authority. To exercise any of these, contact us.
7. Security
All traffic is TLS-encrypted, passwords are stored bcrypt-hashed, session cookies are httpOnly, and production data lives on access-controlled servers.
8. Children
The Service is not directed at children under 16 and we do not knowingly collect their data.
9. Changes
We may update this policy; material changes will be announced by email or in the dashboard. The date above always reflects the current version.