Skip to main content

Data Protection Policy

General Data Protection Regulation​

The General Data Protection Regulation (GDPR) is European Union legislation to strengthen and unify data protection laws for all individuals within the European Union. The regulation came into effect on 25 May 2018.

ScrapeOps Ltd is an Irish company. We are committed to GDPR and to telling you plainly what we store.

This page is the operational description of the practices in our Privacy Policy.

Questions: info@scrapeops.io

What data do we collect?​

On our website​

Our website is hosted by DigitalOcean in Amsterdam.

We use Google Analytics to understand, in anonymized form, how the site is used.

When you register for a trial, you give us an email address. We email you a confirmation link. We need that address to tell you about changes to the service or to this policy. Those emails are sent through SendGrid, operated by Twilio. Twilio privacy policy.

We sometimes ask about upcoming features. We use Typeform to collect the answers. Typeform privacy policy.

Registering requires acceptance of our terms and conditions.

On our API​

Our API servers are hosted by DigitalOcean in Amsterdam.

When a monitoring SDK is installed and active, it sends us statistics about the scrape that is running. We use those statistics to show job health in the product.

When you use the Proxy API or Parser API, we send the result back to you and log the request. The log includes the account email, the target URL, and the request content you send (method, body or form fields, custom headers, and JavaScript options), plus the response size and content type. We do not keep the full response. If we cannot read a response, the error log may include a short excerpt of it.

Those request logs are sent to Datadog, in the EU, so we can see how the service is behaving and improve it. Logs are deleted after 14 days. Datadog privacy policy.

Failed requests are copied to Redis for 30 minutes so we can replay them while debugging. That copy includes the URL, request body, and headers. It does not include the response, and it is deleted when the 30 minutes end.

Very large files returned by a proxy provider may be stored in DigitalOcean Spaces so we can deliver them. Those objects are marked to expire after 30 days.

Proxy providers​

To fetch a page, we send the target URL to the proxy provider selected for that request. If you include a request body or custom headers, that provider receives those as well. The provider returns the page to us, and we return it to you. We do not keep a successful page body after the response is sent.

Which provider is used depends on the target site and the options on the request. We treat those providers as a class of processors. We do not list every provider on this page.

LLM extraction​

If you ask for LLM extraction, we send the page URL and the page content to our parser at parser.scrapeops.io. The parser sends that content to OpenRouter, which runs Gemini models and returns the extraction. OpenRouter privacy policy.

We store a usage record for the call: model, token counts, cost, and the account it belongs to. The usage record does not include the page HTML or the extracted result. The result is returned to you in the API response.

MCP and OAuth​

The MCP server is a way for an AI client to call the Proxy API. It does not keep its own copy of tool arguments or page results. Those requests are logged and retained under the API rules above.

OAuth sign-in checks your email and password with our login API. The MCP server stores:

  • The OAuth client registration (name and redirect URLs)
  • The email address from the sign-in step
  • An encrypted copy of the account API key, so the server can call the Proxy API for that account

The MCP server does not store your password.

Access tokens expire after 1 hour. Refresh tokens expire after 30 days. The sign-in step expires after 10 minutes, and an authorization code expires after 5 minutes. You can revoke every connection for your account at mcp.scrapeops.io/oauth/revoke-access.

A local MCP install that uses SCRAPEOPS_API_KEY in your own environment does not create this OAuth record. Requests from that install still go through the Proxy API.

Billing​

Paying customers provide billing details to us, to Stripe (card processing), and to Chargebee (invoicing and VAT). We can see your name, billing address, email address, and VAT number if you provided one. We cannot see your card number. Only Stripe has that.

We share transaction data with our accountants and with the tax authorities when we pay VAT and file our return.

Stripe privacy policy. Chargebee privacy policy.

Where data is processed​

ScrapeOps Ltd is in Ireland. Website and API servers are on DigitalOcean in Amsterdam. Request logs are in Datadog in the EU.

LLM extraction calls leave our parser and go to OpenRouter, which may process them outside the EU. A proxy provider processes the target URL, and any body or headers you supplied, in order to fetch the page.

Data Processing Agreement​

Becoming a customer implies acceptance of our Data Processing Agreement, unless we agree otherwise in writing.

Data deletion​

Any user, paid or on a trial, can ask us to delete their account by emailing info@scrapeops.io. We keep records of completed transactions for tax purposes.

For MCP connections, revoking access stops that client from calling the API with the issued tokens. Request logs from earlier calls still follow the 14-day log retention above.