Privacy Policy

Last updated: 2026-10-06

This policy explains what personal data Crawlwise Data (operated by Crawlwise; contact Crawlwise Data support — crawlwise.support@gmail.com) processes when you use this website and API. We collect as little as possible. We don't sell personal data, don't use advertising or third-party analytics trackers, and set no cookies except the short-lived one used during key recovery.

Service providers

Stripe processes payments, subscriptions, invoices, receipts and the Customer Portal. When you pay, Stripe collects your email, payment details and billing information under its own privacy policy. We never receive or store your full card details.
Netlify hosts the website, runs the API and stores our data (Netlify Blobs). Netlify may process technical data such as IP addresses in request logs under its own privacy policy.
If we set up automated monitoring and backups on GitHub (Actions), backup files are encrypted before upload.

What we store, why, and for how long

Data	Why	How long
Account record: random account ID, credit balance and grants, totals (purchased, used, refunded), monthly call counts per endpoint (12 months), your last 25 calls (time, endpoint, credits, result code, but not the URL), plan, limits and status	Provide the service, bill fairly, show your dashboard, prevent abuse	While your account exists; deleted on account deletion
API keys: a SHA-256 hash, a short prefix and created/revoked dates (never the key itself)	Authenticate requests	Until the account is deleted
Stripe identifiers linked to your account: customer ID, subscription ID and status, and payment references (payment/invoice IDs, amounts, refunded/disputed amounts)	Apply purchases to the right account, handle renewals, refunds and disputes, and key recovery	While the account exists. After deletion, a minimal record (account ID, Stripe IDs, payment amounts; no usage data) is kept for up to 7 years for accounting and dispute handling, then deleted automatically
Monitor data: monitor names, target URL, optional webhook URL, schedule settings, and the item IDs/URLs/tech fingerprints seen	Run scheduled checks and deliver change alerts	Until you delete the monitor or your account
Webhook delivery logs (status codes, timestamps; not full payloads long-term)	Debug deliveries and retries	Recent attempts only; deleted with the account
Newly issued key before it's shown (encrypted, for the one-time welcome page)	Show you your key once after payment	Removed when shown; any leftovers after 30 days
Free trial requests: a salted hash of your normalized email address and of your IP address and network (never the raw email or IP), with the date	Enforce "one trial key per email every 30 days" and the per-network hourly/daily limits and stop abuse	30 days, then deleted by our routine cleanup
Salted hashes of IP addresses (never raw IPs)	Enforce free-demo limits, rate limits and brute-force protection	Up to 2 days
Key-recovery challenge: a hash of the email you enter, the code hash, and a random session value (also in an HttpOnly cookie)	Verify you control the checkout email through Stripe	30 minutes; records deleted within about 2 days
Contact-form messages: what you write, your email if given, account ID if given	Answer you and handle abuse/opt-out reports	Up to 180 days, then deleted automatically (longer only if needed for a legal claim or an ongoing abuse case)
Stripe webhook processing markers (event IDs)	Make sure each payment is applied exactly once	30 days
Aggregate daily metrics (counts of calls, errors, sales; no personal data)	Operate and monitor the service	About 13 months
Encrypted backups of the above	Recover from data loss	Kept for 30 days

We don't store your email address in our own database (for free trial requests we keep only a salted hash for 30 days, see above, and never email you). Stripe holds it. Data returned by the API comes from public websites your requests target. We don't intentionally collect personal data from those sites and don't keep results after returning them (except monitor state as described above).

Legal bases (where applicable)

We process account and payment data to perform our contract with you, security and abuse-prevention data (hashed IPs) for our legitimate interest in keeping the service safe, and records required for accounting to meet legal obligations.

Deleting your data

Delete your account yourself in the dashboard or with POST /v1/account/delete and {"confirm":"DELETE"} (authenticated with your key or dashboard session). This immediately:

cancels any active subscription (no further charges),
revokes and deletes all API keys and sessions,
deletes your monitors and monitor data, usage history, balance and account details,
keeps only the minimal accounting record described above.

Remaining credits are forfeited. Payment records remain at Stripe, which keeps them for accounting and legal purposes under its own policy. Backups containing your data expire within 30 days. If you can't access your account, contact us and we'll verify ownership before deleting.

Your rights

You can see the data we hold about your account in the dashboard or via GET /v1/account. Depending on where you live, you may have rights to access, correct, delete, export or object to processing of your personal data, and to complain to a data-protection authority. To exercise them, email Crawlwise Data support — crawlwise.support@gmail.com or use the contact form. We respond within 30 days.

Security

Keys are stored only as hashes. Pending keys are encrypted. Traffic uses HTTPS. Payment webhooks are verified with Stripe signatures. Admin access requires a long secret token. No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as required by law.

Children

The service is for developers and businesses and is not directed at children under 16.

Changes

We'll update the "last updated" date when this policy changes and post a notice on this site for material changes.