This Privacy Policy explains how CrawlSnap Limited ("CrawlSnap", "we", "our", or "us") collects, uses, shares, and protects personal data when you use the CrawlSnap platform, websites, dashboards, marketplace, APIs, and related services (together, the "Services"), available at crawlsnap.com.

This Policy should be read together with our Terms of Service and Refund Policy. By using the Services, you acknowledge the practices described here.

1. Who is responsible for your data (Controller)

For the personal data described in this Policy, the data controller is:

• CrawlSnap Limited, a company registered in England and Wales under company number 16099636
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Privacy contact: [email protected]
• General support: [email protected]

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, where it applies to our processing, the EU GDPR. Because CrawlSnap serves customers globally, we apply these standards as a baseline worldwide.

Note on payments. When you buy a paid plan, your purchase is processed by Polar as our reseller and Merchant of Record. Polar acts as an independent data controller for payment data, not as our processor. See Section 9.

2. The data we collect

We collect the following categories of personal data.

2.1 Information you give us

• Account data: first name, last name, email address, and a hashed password. If you sign up using Google or GitHub, we receive your basic profile and email from that provider instead of a password.
• Profile data: optional phone number and country.
• Communications: the content of messages you send us (for example support requests).
• Agreement records: the fact and time that you accepted our Terms of Service and this Policy.

2.2 Information generated through your use of the Services

• API query data: the parameters you submit to our APIs — for example a URL, file hash, IP address, or domain you ask us to analyse. These are recorded in our request logs together with the endpoint called, HTTP method, response code, processing duration, cache status, your client IP address, and timestamp.
• Usage and metering data: API keys (in identifiable form), credits consumed, request counts, rate-limit and quota usage, subscription and plan details.
• Security and audit data: sign-in events and activity logs, including IP address, user agent, device/browser information, last-login IP, and login count. We keep these to secure accounts and detect abuse.

2.3 Information collected automatically

• Cookies and similar technologies: strictly necessary authentication cookies and, where applicable, bot-protection technologies (see Section 10).
• Technical data: IP address, browser type, and device information derived from your interactions with the Services.

2.4 Data we derive from public sources

A core function of the Services is to analyse publicly available information from the internet and apply our own processing to produce derived intelligence (such as reputation signals and indicators). This analysis may, incidentally, include personal data that is already publicly available (for example data associated with a domain or IP address). We process such data to provide the Services as described in Sections 3 and 4.

2.5 What we do not collect

We do not collect or store your full payment card number, card security code, or bank details. Those are handled by Polar and its PCI-DSS-compliant payment processor (Section 9). We do not knowingly collect data from children (Section 11).

3. Why we use your data and our lawful bases

Under the UK GDPR we must have a lawful basis for each processing purpose. The table below sets these out.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You can object to such processing (see Section 7). Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

4. Your responsibilities for query data

When you submit parameters to our APIs (such as URLs, hashes, IPs, or domains), you are responsible for ensuring you have a lawful basis to do so and that your queries comply with applicable law and our Terms of Service. You must not submit special-category personal data or any data you are not authorised to process. In relation to data you submit and the queries you run, you act as a controller in your own right.

5. How we share your data

We do not sell your personal data. We share it only as described below.

• Service providers (processors) who process data on our behalf under contract and on our instructions — for example email delivery, hosting, and bot protection (see Section 9).
• Polar, our reseller and Merchant of Record, which acts as an independent controller for payments (Section 9).
• Authentication providers (Google, GitHub) when you choose to sign in with them.
• Legal and safety disclosures where we reasonably believe disclosure is necessary to comply with a legal obligation, enforce our Terms, prevent fraud or abuse, or protect the rights, property, or safety of CrawlSnap, our users, or others.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of that transaction, subject to this Policy.

6. International data transfers

CrawlSnap operates globally, and some of our service providers are located outside the United Kingdom and the European Economic Area (for example in the United States). Where we transfer personal data internationally, we put in place appropriate safeguards required by UK and EU data-protection law, such as the UK International Data Transfer Agreement (IDTA) / UK Addendum and the European Commission's Standard Contractual Clauses (SCCs), together with any additional measures needed to protect your data. You can ask us for more information about these safeguards using the contact details in Section 13.

7. Your rights

Subject to applicable law, you have the following rights over your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data ("right to be forgotten") in certain circumstances.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Portability — receive certain data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time.

You can exercise most of these rights directly in your account (for example updating your profile, or deleting your account) or by contacting [email protected]. We will respond within the timeframes required by law (generally one month under the UK GDPR). We may need to verify your identity first.

If you are unhappy with how we handle your data, you may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local supervisory authority if you are in the EEA. We would, however, appreciate the chance to address your concerns first.

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this Policy, after which it is deleted or anonymised. In general:

Where the law requires a minimum retention period (for example for tax records), we keep the relevant data for that period.

9. Service providers and sub-processors

We use carefully selected third parties to operate the Services. The main ones are:

We require our processors to protect personal data and to process it only on our instructions. We may update this list as our providers change.

10. Cookies and similar technologies

We use a small number of cookies and similar technologies, primarily to make the Services work:

• Strictly necessary cookies — for authentication and session management (for example tokens that keep you signed in and store your access permissions). The Services cannot function without these.
• Security technologies — such as Google reCAPTCHA on sign-up and authentication flows to protect against bots and abuse. This may involve Google processing technical data subject to Google's privacy terms.

We do not use cookies for cross-site advertising. Where we use any non-essential cookies or analytics, we will ask for your consent where required and provide controls. You can also control cookies through your browser settings, though blocking strictly necessary cookies may prevent you from signing in.

11. Children

The Services are not directed to, and are not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will take appropriate steps to delete it.

12. Security

We implement appropriate technical and organisational measures to protect personal data, including password hashing, encryption in transit (HTTPS/TLS), access controls, rate limiting, audit logging, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials and API keys confidential (see our Terms of Service). If we become aware of a personal-data breach that is likely to affect your rights, we will notify you and the relevant authority as required by law.

13. Contact us

For any privacy question or to exercise your rights:

• Privacy contact: [email protected]
• General support: [email protected]
• Postal address: CrawlSnap Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

For payment- and billing-related data handled by our Merchant of Record, see Polar's Privacy Policy.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date above shows the latest version. If we make a material change, we will provide reasonable notice through the Services or by email before it takes effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.