Privacy policy

2. What data we process

We process personal data only to the extent necessary to provide our service and to operate your account. In particular:

• Account data: the email address used for sign-in, your plan and credit balance, and account metadata.

• API usage data: the endpoints you call, timestamps, request counts and credit consumption, associated with your API keys.

• Payment data: the data required to process payments, handled directly by our payment provider Stripe; full card details are not stored on our systems.

• Communication data: the content and metadata of your support requests.

• Server log data: technical access data such as IP address, time of access, requested resource and browser/OS information.

3. Purposes and legal bases

• To perform the contract and provide the API (Art. 6(1)(b) GDPR).

• To comply with legal obligations, e.g. retention under commercial and tax law (Art. 6(1)(c) GDPR).

• To safeguard our legitimate interests in secure, stable and abuse-free operation (Art. 6(1)(f) GDPR).

• On the basis of your consent where given (Art. 6(1)(a) GDPR).

4. Authentication (Auth0)

Sign-in is handled via Auth0 (Okta, Inc.). When you log in, your email address and authentication metadata are processed to establish and secure your session. The legal basis is performance of the contract and our legitimate interest in secure authentication (Art. 6(1)(b) and (f) GDPR).

5. Hosting (AWS)

Our services are operated on Amazon Web Services (AWS). Technically necessary data is processed in server log files to ensure delivery, stability and security. The legal basis is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place.

6. Payment processing (Stripe)

Payments are processed via Stripe (Stripe Payments Europe, Ltd. and affiliates). The required data, in particular name, email and payment/billing details, is transmitted to Stripe and processed under its own responsibility. Legal basis: performance of the contract and our legitimate interest in secure, fraud-free payment (Art. 6(1)(b) and (f) GDPR).

7. Email delivery (Amazon SES / Resend)

To send transactional emails (account, purchase confirmations, notifications) we use an email delivery provider (Amazon SES or Resend). Your email address and the associated message data are processed. Legal basis: performance of the contract and our legitimate interest in reliable communication (Art. 6(1)(b) and (f) GDPR).

8. Web analytics (Google Analytics)

With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It uses cookies (for example _ga, _ga_TWB068MPCG and _gid) to analyse how visitors use the website on an aggregated, pseudonymous basis; IP addresses are shortened within the EU beforehand. The service loads only after you accept the analytics category in our cookie banner, and no analytics cookie is set before that. Legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with effect for the future via the cookie settings link in the footer. Data may be transferred to Google LLC in the USA; see the section on transfers to third countries.

9. Spam protection on the contact form (Google reCAPTCHA)

Our contact form is protected by Google reCAPTCHA v3, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC. When you use the form, reCAPTCHA processes your IP address as well as interaction and device data (for example mouse movements, timing and browser characteristics) to score whether the request originates from a human, and thereby to prevent spam and automated abuse. This runs in the background and does not require a puzzle. Legal basis is our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR). The Google Privacy Policy and the Google Terms of Service apply, and data may be transferred to Google LLC in the USA; see the section on transfers to third countries.

10. Fraud prevention at registration (IPQualityScore)

When a new account is created, we check the IP address used for sign-up against the IP reputation and fraud-detection service of IPQualityScore LLC (USA). This check runs as part of an Auth0 pre-registration action and serves to block fraud, VPN/proxy abuse and automated bot sign-ups. Processed data is your IP address and the risk signals derived from it; we do not use the service to profile you beyond this security purpose. Legal basis is our legitimate interest in preventing fraud and abuse and in the security of our service (Art. 6(1)(f) GDPR). Data may be transferred to the USA; see the section on transfers to third countries.

11. Review portal (Trustportal)

In the footer we show a summary of the reviews of scraper-api.com from the review portal Trustportal (trustportal.biz). Trustportal is operated by B A Media Group FZE LLC, which also operates this website. To do so, your browser loads a script and the review summary from trustportal.biz, which technically involves transmitting your IP address. Trustportal sets no cookies and does not access your browser's local storage. The legal basis is our legitimate interest in presenting our reviews (Art. 6(1)(f) GDPR).

12. Live chat (fonella)

On our website we offer a live chat in which an AI assistant answers questions about our API, its endpoints and prices. The chat runs on fonella, a service of WBA Systems GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany, which operates it on our behalf as our processor (Art. 28 GDPR). So that the page loads quickly, your browser fetches the chat window from fonella.ai only after your first input on the page or a few seconds after it has loaded; fonella receives your IP address and the details your browser sends with every request. The chat sets no cookies. In your browser's storage it keeps a random id (fonella-chat-session) that links your chats across tabs and later visits and stays until you delete it; the id and history of the current conversation and whether you have opened the chat window it keeps only until you close the tab. The legal basis is our legitimate interest in answering your questions directly on the page and without waiting (Art. 6(1)(f) GDPR). You may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR); you can delete the entries at any time in your browser's settings.

When you write, we process your messages with everything you state in them, for example your name, email address or details of your project, together with the id, the language, the address and title of the page you write on, your IP address, information about your browser and the time, in order to answer your question (Art. 6(1)(b) and (f) GDPR). To answer questions about endpoints, the chat looks up our public API reference on our own server; our server receives only the search terms and an id of the conversation, not your messages. The answers are generated automatically by a language model, as is a short summary of the chat that we receive by email and push notification together with any contact details you give. For this, your messages and the previous course of the conversation are sent to OpenRouter, Inc. in the USA, which forwards them, depending on availability, to a language model of OpenAI, Anthropic, Google or Meta. We base the transfer to the USA on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). fonella stores the chat on servers of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in the Frankfurt region; it is deleted as soon as your request has been dealt with and no retention obligation applies. To prevent abuse, messages are counted per IP address and minute and the count is deleted after about one day (Art. 6(1)(f) GDPR). Please do not enter API keys, passwords or payment data in the chat. Privacy information of OpenRouter: openrouter.ai/privacy.

13. Telephone enquiries

Calls to the phone number shown on this website are answered by an AI-powered phone assistant. At the start of the call you are told that you are speaking with an AI-powered phone assistant.

The controller is B A Media Group FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates (see imprint). The telephony platform is operated as a technical service provider by WBA Systems GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany, with its service fonella.

We process your phone number, if it is transmitted, the number you called, the date, time and duration of the call, the content of the conversation as speech and as text (transcript), an automatically generated summary, and any details you give during the call, for example your name, email address or a callback number.

During the call your speech is converted into text. An AI language model generates a reply, which is read out by speech synthesis. After the call a summary is created, the transcript and summary are translated, and contact details you mentioned are identified. We are notified of the call by email and, where enabled, by push notification. The call is not recorded as audio.

The following service providers are used:

sipgate GmbH, Düsseldorf, Germany: phone number and call routing.

Vapi Inc., 150 Spear Street, Suite 1000, San Francisco, CA 94105, USA: handling of the conversation and the summary. For this Vapi uses Deepgram, Inc., San Francisco, USA (speech recognition), Google LLC, Mountain View, USA (Gemini language model) and ElevenLabs, Inc., New York, USA (speech synthesis).

OpenRouter, Inc., USA: translation of transcript and summary and identification of contact details, using models from Google, with OpenAI or Meta as fallback.

Amazon Web Services EMEA SARL, Luxembourg: storage in data centres in Frankfurt am Main.

Mailgun Technologies, Inc. (Sinch), USA: sending the notification email via its EU region.

The legal basis is Art. 6(1)(b) GDPR where your call relates to entering into or performing a contract, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is to receive and answer enquiries at any time, including outside business hours.

Data is transferred to the USA in the process. Vapi bases transfers from the EU on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We delete the data as soon as it is no longer needed for the purpose described, or at your request, unless statutory retention obligations apply. Vapi also stores the transcript, the course of the conversation, the summary and technical logs and deletes them on request. According to WBA Systems GmbH, the call data is not used to train AI models. Under its terms of service Vapi does not pass it on to third parties for their model training, but may use it, without reference to us or to you, to improve its own service, for example speech recognition.

If you prefer not to speak with the AI assistant, you can also reach us by email at the address given in the imprint. Your rights of access, rectification, erasure, restriction of processing, data portability and objection, and your right to lodge a complaint with a supervisory authority (Art. 15 to 21 and 77 GDPR), also apply to this data.

14. Recipients and processors

Your data is only transmitted where necessary to perform the contract, where legally required, or with your consent. Processors include: the hosting provider (AWS), the authentication provider (Auth0), the payment provider (Stripe), the email provider (Amazon SES or Resend), Google reCAPTCHA on the contact form to prevent spam and abuse (Google processes usage and device data such as the IP address for this; legal basis our legitimate interest under Art. 6(1)(f) GDPR, and the Google Privacy Policy and Terms of Service apply), IPQualityScore for fraud and abuse prevention at registration (processing the IP address on the basis of our legitimate interest under Art. 6(1)(f) GDPR), the review portal Trustportal of B A Media Group FZE LLC, the live chat fonella of WBA Systems GmbH with OpenRouter and the providers of the language models for its answers and, subject to your consent, the web analytics provider (Google). We conclude agreements pursuant to Art. 28 GDPR.

15. Transfers to third countries

The controller (B A Media Group FZE LLC) is based in the United Arab Emirates (a third country). Some providers may process data in third countries, in particular the USA. Any transfer takes place only under Art. 44 et seq. GDPR, e.g. on the basis of an adequacy decision, standard contractual clauses, or your consent.

16. Retention period

We store personal data only for as long as necessary for the stated purposes. Account and billing data is retained for the duration of the relationship and, beyond that, within statutory retention periods (generally up to 10 years). Server log data is stored only briefly and then deleted or anonymised.

17. Your rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)).

To exercise your rights, an informal message to the contact details above is sufficient.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe the processing of your data infringes the GDPR (Art. 77 GDPR).