Privacy Policy
A developer-facing API. We collect what we need to bill you, secure the platform, and serve your requests. We don't sell data, we don't run advertising trackers, and we don't train models on your traffic. The detail below is the contract; this paragraph is the spirit.
1. Who we are
ScrapeNest is a developer-facing scraping, search, and audio-transcription API operated from the State of Missouri, U.S.A. ("ScrapeNest", "we", "our"). This Privacy Policy describes how we collect, use, share, and protect information when you visit scrapenest.dev, create an account, or call our API.
This Policy applies to the Service as defined in our Terms of Service. It does not apply to third-party websites or services we link to or that you instruct our API to retrieve content from.
2. What we collect
2.1 Information you give us
- Account data: email address, display name, optional avatar URL, and the credentials used to sign in (a password hash if you sign up with email/password, or the public identifier and provider name if you sign up with Google or GitHub OAuth).
- Billing data: when you start a paid plan or pay-as-you-go top-up, our payment processor collects your card or other payment-method details directly. We receive only the processor's customer ID, the payment-method type (e.g. "card"), the last four digits of your card, and the subscription/charge metadata necessary to bill you. We do not store full card numbers, expiry dates, or CVVs.
- Team data: if you invite a teammate, we store the invitee's email, the inviter's ID, and the invitation token until the invite is accepted or expires.
- Support data: the contents of emails you send us.
2.2 Information we collect automatically
- Signup and login forensics: the IP address, country (derived from IP), and User-Agent string used at signup and at each login attempt. We use this to detect account compromise, spam signups, and abuse.
- API request metadata: for every API call, we record the endpoint, response time, response size, HTTP status code, whether the response was a cache hit, which proxy tier was used (datacenter, residential, or none), the hostname of the target you scraped, the credits charged, and an error code if the call failed. We do not record the URL path you scraped, the request body, the response body, your IP, or your User-Agent in this usage log.
- Async-job records: for endpoints that submit a background job (e.g.
/v1/scrape/google-maps/reviews/async,/v1/audio/transcript/async), we store the request payload and the resulting response body so you can poll for the result. Any optional cookies field used to authenticate to a third-party site is redacted from this stored payload; the cookies are used only by the worker that performs the fetch on your behalf, and they are deleted from temporary storage before the response is returned to you. - Cache: we cache responses for short windows (15 minutes for generic scrapes by default, longer for audio transcripts) keyed by a one-way hash of your normalized input. The cache key is a hash, not the raw input. Responses produced with cookies are never cached.
- Audit log: security-relevant events (login successes and failures, password changes, API-key creation and revocation, payment events, account suspension) are written to an audit table with the actor's account ID, IP, User-Agent, and a short message. Sensitive values (passwords, tokens, cookies, secrets) are redacted before write.
- Affiliate-program click data: when you click an affiliate referral link of the form
scrapenest.dev/r/<slug>, we set a signed first-party cookie namedsn_ref(and a companionsn_ref_attimestamp) that records which affiliate's slug to credit if you later sign up. We also record an aggregate per-day click count keyed by a one-way SHA-256 hash of(your IP + User-Agent + the day), used only to dedupe clicks and to surface a click chart in the affiliate's dashboard. On signup, if a referral cookie was present, we attribute your account to that affiliate and store your signup IP on an attribution record so we can detect self-referral fraud. None of this data is shared with the affiliate or any third party — they see only aggregated counts.
2.3 Information from third parties
- OAuth sign-in: if you choose to sign in with Google or GitHub, the provider gives us your verified email, your provider account ID, and (in some cases) your display name and avatar URL. We do not receive your password or any other content from your provider account.
- Stripe: our payment processor sends webhook notifications when your subscription status changes or a charge succeeds or fails. We receive the subscription ID, price ID, status, period dates, and decline reason if applicable.
- Bot-defense signals: the human-verification challenge shown on signup, login, and password-reset pages returns a verdict (pass or fail) that we use to decide whether to accept the form submission. We do not receive a per-user behavioral profile.
2.4 What we do not collect
We do not run advertising trackers, fingerprinting scripts, or third-party analytics on scrapenest.dev. We do not collect biometric data, government-issued ID numbers, financial account numbers beyond what is necessary for billing, or precise GPS location. We do not maintain a user-level behavioral profile and we do not sell any data we collect.
3. How we use it
- To provide the Service: route your API calls, return responses, count credits, enforce rate limits, deliver verification and notification emails, and operate the dashboard.
- To bill you: calculate charges, process payments, send receipts, and reconcile usage with our processor.
- To secure the Service: detect and respond to abuse, fraud, credential stuffing, account takeover, and traffic that threatens platform stability. Signup/login forensics and audit logs exist specifically for this purpose.
- To support you: respond to your emails, debug issues you report, and reach you about service incidents or account events.
- To improve the Service: aggregate, anonymized metrics (e.g. "how often does the residential proxy tier return a 200") are used to size capacity and prioritize work. We do not use your specific inputs or outputs to improve the Service.
- To comply with law: respond to subpoenas, court orders, and regulatory inquiries; defend or assert legal claims; and meet tax, accounting, and audit obligations.
We do not train AI or machine-learning models on your inputs or on the data the API returns to you. When the Service uses a model (for example, to produce an answer summary), the request to the model provider is made on your behalf and is not retained by us for training.
5. How long we keep it
We delete personal information when it is no longer needed for the purposes set out in this Policy. Concretely:
| Category | Default retention |
|---|---|
| Account profile, password hash, OAuth identifiers | For the life of your account; deleted on account closure plus a 30-day grace window in which the account can be restored. |
| API keys | For the life of the key. Revoked keys are kept for 30 days for incident-response context, then deleted. |
| Async-job records (request payloads and result bodies) | Up to 7 days. After expiry, the row is deleted from the database by a background job. |
| Per-request usage records (billing meter) | 13 months, to support a full billing year plus a 30-day reconciliation window. |
| Cached responses | The cache TTL of the relevant endpoint (typically 15 minutes; up to 24 hours for opt-in caches). Responses produced with user-supplied cookies are never cached. |
| Login events (success and failure) | 90 days. |
| Audit events (security-relevant actions) | 2 years. |
| Billing records (Stripe customer ID, subscription history, invoices) | 7 years, to meet U.S. tax and accounting recordkeeping requirements. |
| Email logs (delivery status of transactional mail) | 30 days at the email-delivery provider. |
| Affiliate click counts (per-day, deduped by hashed visitor) | 180 days. Older rows are deleted by a background job. |
| Affiliate attribution records (link between referred customer and affiliate) | For the life of the referred account. The signup IP attached to an attribution record is nulled after 180 days; the link between the customer and affiliate remains so the affiliate continues to earn commissions if you stay subscribed. |
Where retention exceeds account life because of legal or accounting obligations, the records are retained only for that purpose and not used to provide you with the Service.
6. How we protect it
- The entire site and API are served over HTTPS with HSTS preloaded. HTTP requests are redirected to HTTPS.
- Passwords are stored only as hashes produced by an industry-standard, memory-hard password-hashing function with per-account random salt at parameters that meet OWASP's current guidance. We never see your password in plain text.
- API keys are stored only as hashes. The plain-text key is shown to you once on creation and is unrecoverable after that — if you lose it, generate a new one.
- The application enforces per-API-key sliding-window rate limits and per-IP limits on authentication endpoints. Auth pages are gated by a human-verification challenge.
- Audit logs are written for security-relevant events. Sensitive values (passwords, secrets, tokens, cookies) are redacted by an automated field-level redaction step before write.
- The database lives on the application host in the United States. Disk-level encryption depends on the underlying provider's controls; we do not currently add application-level column encryption on top.
- The application refuses to start in production with an unset or default session-signing secret.
- We publish a security.txt with a vulnerability-reporting address. We treat coordinated disclosure as a feature, not a threat.
No system is perfectly secure. If we learn of a breach affecting personal information, we will notify affected users and applicable regulators in accordance with the law.
8. International transfers
The application and database are hosted in the United States. Most of the processors listed in Section 4 are also US-based. Where personal information moves to a processor in another country, we rely on (a) standard contractual clauses or equivalent transfer mechanisms with the receiving processor where required, and (b) the data-minimization practices described in Section 2 (we send each processor only what it needs to do its job).
9. Your rights
Regardless of where you live, you can:
- Access the personal information we hold about you. Most of it is visible to you on the dashboard already.
- Correct inaccurate information on the dashboard, or by emailing us.
- Delete your account, which triggers the retention process described in Section 5.
- Export a copy of the personal information we hold about you. Email [email protected]; we will respond within 30 days.
- Object to processing where we rely on a legitimate-interest basis, or withdraw consent where we rely on consent.
- Complain to your local data-protection authority if you believe we have mishandled your personal information.
To exercise any of these rights, email [email protected] from the address on your account, or from another address with enough identifying information that we can verify you. We will not charge you for any reasonable request; we may decline obviously abusive or repetitive requests.
10. California rights
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the rights set out in Section 9, plus:
- The right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties to whom we disclose it. Sections 2 and 4 of this Policy cover that.
- The right to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA.
- The right to limit the use of "sensitive personal information." We do not collect sensitive personal information as defined under the CCPA.
- The right to non-discrimination for exercising your rights.
We do not knowingly direct the Service at California minors under 16, and we do not sell or share the personal information of anyone we know to be under 16.
11. EEA, UK, and Swiss rights
If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing your personal information are:
- Performance of a contract — to operate your account, route your API calls, and bill you.
- Legitimate interests — to secure the Service, prevent fraud and abuse, and improve the Service in aggregate.
- Legal obligations — to keep tax and accounting records and respond to lawful demands.
- Consent — for any processing that is not covered by the bases above, where you have given consent (which you can withdraw at any time).
You have the rights set out in Section 9, plus the right to lodge a complaint with the supervisory authority in your country. The data controller is ScrapeNest. For data-protection inquiries, contact [email protected].
12. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, contact [email protected] and we will delete it.
13. Changes
We will update this Policy when our practices change. Material changes will be announced by email to active users and via a notice on the dashboard at least 14 days before they take effect, unless an earlier change is required by law. The "Effective" date at the top of this page reflects the most recent revision. Earlier versions are available on request.
14. Contact
Privacy: [email protected]
Security: [email protected] (also at /.well-known/security.txt)
General: [email protected]