Privacy Policy
Last updated: 2026-10-16
This policy explains what personal data Crawlwise Data (operated by Crawlwise; contact Crawlwise Data support — crawlwise.support@gmail.com) processes when you use this website and API. We collect as little as possible. We don't sell or share personal data (as defined by the CCPA) and don't use it for targeted advertising. We don't use advertising or third-party analytics trackers, and set no cookies except the short-lived one used during key recovery.
Service providers
- Stripe processes payments, subscriptions, invoices, receipts and the Customer Portal. When you pay, Stripe collects your email, payment details and billing information under its own privacy policy. We never receive or store your full card details.
- Google (Gmail) delivers the emails we send: sign-up verification codes and, for accounts created at checkout, single-use key-recovery links. Google processes the recipient address and message under its own privacy policy.
- Netlify hosts the website, runs the API and stores our data (Netlify Blobs). Netlify may process technical data such as IP addresses in request logs under its own privacy policy.
- GitHub (Actions) runs our scheduled jobs (monitor checks and the daily data cleanup). It receives no personal data beyond what those requests carry.
What we store, why, and for how long
| Data | Why | How long |
|---|---|---|
| Account record: random account ID, credit balance and grants, totals (purchased, used, refunded), monthly call counts per endpoint (12 months), your last 25 calls (time, endpoint, credits, result code, but not the URL), plan, limits and status | Provide the service, bill fairly, show your dashboard, prevent abuse | While your account exists; deleted on account deletion |
| API keys: a SHA-256 hash, a short prefix and created/revoked dates (never the key itself) | Authenticate requests | Until the account is deleted |
| Stripe identifiers linked to your account: customer ID, subscription ID and status, and payment references (payment/invoice IDs, amounts, refunded/disputed amounts) | Apply purchases to the right account, handle renewals, refunds and disputes, and key recovery | While the account exists. After deletion, a minimal record (account ID, Stripe IDs, payment amounts; no usage data) is kept for up to 7 years for accounting and dispute handling, then deleted automatically |
| Monitor data: monitor names, target URL, optional webhook URL, schedule settings, and the item IDs/URLs/tech fingerprints seen | Run scheduled checks and deliver change alerts | Until you delete the monitor or your account |
| Webhook delivery logs (status codes, timestamps; not full payloads long-term) | Debug deliveries and retries | The most recent 10 attempts per delivery; deleted with the account |
| Newly issued key before it's shown (encrypted, for the one-time welcome page) | Show you your key once after payment | Removed when shown; any leftovers after 30 days |
| Free trial requests: a salted hash of your normalized email address and of your IP address and network (never the raw email or IP), with the date | Enforce "one trial key per email every 30 days" and the per-network hourly/daily limits and stop abuse | 30 days, then deleted by our routine cleanup |
| Email sign-up: your email address (kept only until you verify or the code expires, so we can email the 6-digit code), then a salted hash of it, the code hash and the date | Send the verification code and enforce one account per email | Plain email deleted when you verify; if you don't verify, the code expires after 10 minutes and the address is deleted by our daily cleanup (within about 2 days). While pending it is stored encrypted. The hash is kept with the account |
| Checkout email for accounts created at checkout without a prior sign-up (stored on the account) | Send you a single-use key-recovery link | Until the account is deleted |
| Salted hashes of IP addresses (never raw IPs) | Enforce free-demo limits, rate limits and brute-force protection | Up to 2 days |
| Key-recovery challenge: a hash of the email you enter, the code hash, and a random session value (also in an HttpOnly cookie) | Verify you control the checkout email through Stripe | 30 minutes; records deleted within about 2 days |
| Contact-form messages: what you write, your email if given, account ID if given | Answer you and handle abuse/opt-out reports | Up to 180 days, then deleted automatically (longer only if needed for a legal claim or an ongoing abuse case) |
| Stripe webhook processing markers (event IDs) | Make sure each payment is applied exactly once | 30 days |
| Aggregate daily metrics (counts of calls, errors, sales; no personal data) | Operate and monitor the service | About 13 months |
Apart from the two cases above (a pending email sign-up, and the checkout email of an account created at checkout), we don't store your email address in our own database. For free trial requests we keep only a salted hash for 30 days and the trial flow never emails you. Stripe holds your checkout email. Data returned by the API comes from public websites your requests target. We don't intentionally collect personal data from those sites and don't keep results after returning them (except monitor state as described above).
Legal bases (where applicable)
We process account and payment data to perform our contract with you, security and abuse-prevention data (hashed IPs) for our legitimate interest in keeping the service safe, and records required for accounting to meet legal obligations.
Deleting your data
Delete your account yourself in the dashboard or with POST /v1/account/delete and {"confirm":"DELETE"} (authenticated with your key or dashboard session). This immediately:
- cancels any active subscription (no further charges),
- revokes and deletes all API keys and sessions,
- deletes your monitors and monitor data, usage history, balance and account details,
- keeps only the minimal accounting record described above.
Remaining credits are forfeited. Payment records remain at Stripe, which keeps them for accounting and legal purposes under its own policy. If you can't access your account, contact us and we'll verify ownership before deleting.
Your rights
You can see the data we hold about your account in the dashboard or via GET /v1/account. Depending on where you live, you may have rights to access, correct, delete, export or object to processing of your personal data, and to complain to a data-protection authority. To exercise them, email Crawlwise Data support — crawlwise.support@gmail.com or use the contact form. We respond within 30 days.
Security
Keys are stored only as hashes. Pending keys are encrypted. Traffic uses HTTPS. Payment webhooks are verified with Stripe signatures. Admin access requires a long secret token. No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as required by law.
Children
The service is for developers and businesses and is not directed at children under 16. We don't knowingly collect their personal data; contact us and we'll delete it.
Changes
We'll update the "last updated" date when this policy changes and post a notice on this site for material changes.
When you create a free account we email a one-time verification code from Crawlwise Data (<crawlwise.support@gmail.com>) so only you can activate the API key. We do not send marketing email.