ScrapeOpsScrapeOps Ltd · Registered in Ireland, company number 723170 Contact: info@scrapeops.io
About this list
ScrapeOps uses third-party companies to provide its services. This list names them, what each one does, the data it receives and where it processes that data.
The list has two parts:
- Part A lists the subprocessors that process Customer Personal Data on ScrapeOps' behalf when you use the services. This is the data in your API requests and in the pages fetched for you. These subprocessors are covered by the ScrapeOps Data Processing Agreement (DPA).
- Part B lists the vendors that process account, billing, support and website data. ScrapeOps acts as an independent controller for this data, under its Privacy Policy. We list these vendors so you can see everyone who handles data about you and your team.
Part A: Subprocessors of Customer Personal Data
| Subprocessor | Purpose | Customer Personal Data processed | Location |
|---|---|---|---|
| DigitalOcean, LLC | Cloud hosting: application and proxy servers, managed databases and caches, object storage | Request parameters while requests are handled. Failed-request copies, kept for 30 minutes. Large response files, which expire after 30 days. | Netherlands (Amsterdam): application servers. United Kingdom (London): database, proxy caches and file storage. United States (New York): Parser API cache. |
| Datadog, Inc. | Application and request logging, monitoring | Request logs: account email, target URL, request method, request body or form fields, custom headers, JavaScript options, response size and content type. Deleted after 14 days. | Germany (Datadog EU1) |
| Upstream proxy providers (category; see note 1) | Fetching target web pages | The target URL, any request body and custom headers you supply, and the page the provider returns | Varies by provider and by the country you target |
| OpenRouter, Inc. | LLM extraction; routes requests to Google Gemini models (see note 2) | Page URL and page content, only for requests where you ask for LLM extraction | United States |
Note 1: Upstream proxy providers. ScrapeOps is a proxy aggregator. Each request goes to the proxy provider best suited to the target site and the options on the request, so the set of providers in use changes as we optimise the service. These providers are authorised as a category. You can get a named list of current providers under NDA by contacting info@scrapeops.io.
Note 2: Model provider. OpenRouter passes LLM extraction requests to Google, which runs the Gemini models. OpenRouter is responsible for its own subprocessors.
Part B: Vendors for account, billing, support and website data
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| DigitalOcean, LLC | Hosting of the ScrapeOps dashboard, API and database | Account, team and usage data | Netherlands, United Kingdom |
| Datadog, Inc. | Logging and monitoring | Account email and account ID in logs | Germany |
| Stripe (Stripe Payments Europe, Limited and Stripe, Inc.) | Payment processing and subscriptions | Name, email, billing address, VAT number, payment card details (held by Stripe only) | Ireland, United States |
| Mailgun Technologies, Inc. | Transactional and service email | Email address, name, email content | United States |
| Twilio Inc. | SMS phone verification for sign-ups flagged as higher risk | Phone number, verification code | United States |
| Groove Networks, LLC (GrooveHQ) | Customer support helpdesk | Name, email address, and the content of support conversations | United States |
| Slack Technologies, LLC | Internal operational alerts for ScrapeOps staff | Account ID, account email, sign-up details (IP address, risk score), operational details | United States |
| Intuition Machines, Inc. (hCaptcha) | Bot protection on sign-up | IP address, browser and device signals | United States |
| OpenRouter, Inc. | Sign-up fraud risk scoring | Name, email, sign-up IP address, referrer, timezone | United States |
| Google LLC (Google Analytics, Google Tag Manager) | Website analytics | Pseudonymous usage data, device data, cookies | United States |
| beehiiv, Inc. | Product newsletter | Email address, subscription status | United States |
| Igil Webs SRL (FirstPromoter) | Affiliate programme tracking | Referral cookie, email of referred sign-ups, payment amounts on referred accounts | Romania |
| OpenAI (ChatGPT Ads) | Advertising conversion measurement | Hashed email address, IP address, browser user agent, for sign-up and purchase events | United States |
International transfers
ScrapeOps is established in Ireland. Where a subprocessor processes Customer Personal Data outside the European Economic Area, the United Kingdom, Switzerland or another country with an EU adequacy decision, the transfer relies on one of these:
- The subprocessor's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions)
- The EU Standard Contractual Clauses, plus the UK Addendum where UK data is involved
Section 8 of the DPA sets out the details.
Changes to this list
We will give at least 30 days' notice before a new subprocessor in Part A begins processing Customer Personal Data. Notice is given by updating this page and by emailing the account owner and any notification contacts named in a signed DPA. Customers can object as set out in section 5 of the DPA.
If we must replace a subprocessor urgently to protect the security or continuity of the service, we will update the list and notify you as soon as possible.
To get change notices at a different address, email info@scrapeops.io with the subject line "Subprocessor updates".
Change log
| Date | Change |
|---|---|
| 8 Jan 2025 | First published version |