Privacy Policy
Privacy Policy
Last updated: September 7, 2026
The English text of this document is the authoritative version. Any translation is provided for convenience only.
About this document: deepscrape is published under the deepscrape brand. The legal entity, registered address and any designated contact for privacy matters are shown as clearly marked placeholders below and must be completed by the operator before publication. This text is a starting point and should be reviewed by qualified legal counsel.
Cookie choices. Changing or withdrawing your consent removes the analytics identifiers stored in this browser and asks you again on the next page.
1. Who we are
deepscrape (the “Service”) is a web data collection and crawl orchestration platform. This Privacy Policy explains what information we process when you use the Service, why we process it, and the choices you have. We act as the data controller for the personal data described below.
Data controller identity: [Legal entity name and registered address — to be completed by the operator]. Contact: use our contact page.
2. What we collect
- Account data — email address and authentication identifiers when you register or sign in (including via supported social or GitHub sign-in).
- Payment data — billing details are processed by our payment provider; we store only the records needed to provide the Service.
- Usage data — how you use the platform, pages and features, and service diagnostics, to keep the Service secure and improve it.
- Crawl inputs and outputs — the URLs, configurations, and extracted data you provide or generate. Where that content contains personal data, you are the controller of it and direct our processing on your behalf.
3. How we use data
- To provide, operate and maintain the Service and your account.
- To process payments and prevent fraud or abuse.
- To secure the Service, including rate limiting and abuse detection.
- To respond to support requests and to communicate service updates.
- To improve the Service through analytics, where the legal basis applies.
Legal bases include performance of our contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where we ask for it.
4. Sharing and processors
We do not sell personal data. We share data only with service providers who help run the Service: cloud infrastructure and hosting (Google Cloud / Firebase), payment processing (Stripe), third-party AI and language-model providers you choose to route data to, and analytics services. Each processor acts under our instructions and is bound by appropriate data-protection terms.
5. Data you direct us to collect
When you use the Service to collect data from websites you point it at, you are responsible for ensuring that collection is lawful and complies with the target sites’ terms and applicable law. We process that data on your instructions as a processor.
6. Retention
We keep account and usage data only as long as needed for the purposes above or as required by law. You may delete your account and we will delete or anonymise associated data unless we must retain it for legal or security reasons.
7. Security
We apply appropriate technical and organisational measures — including encryption in transit, access controls and monitoring — to protect data. No method of transmission is completely secure, and we cannot guarantee absolute security.
8. International transfers
Data may be processed in regions outside your country of residence through the providers listed above. Where transfers occur, we rely on recognised safeguards such as adequacy decisions or standard contractual clauses.
9. Your rights
Where data-protection law applies to you (for example, under the GDPR), you may have rights to access, correct, delete, restrict or object to processing, and to data portability. You can exercise these by contacting us through the contact page. You may also lodge a complaint with your local supervisory authority.
10. Cookies
We set cookies that are strictly necessary to operate the Service: authentication cookies once you sign in, and a security cookie that protects forms against cross-site request forgery. These are required for the Service to work and are not used to track you.
Analytics cookies are set only with your consent, which we ask for in a banner on your first visit. If you accept, we set a cookie named gid for one year and store a record containing a one-way hash of your IP address, browser, operating system and device type. We use it to count unique visitors and to understand how the Service is used. If you decline, or do not answer, no analytics cookie is set and no such record is created. You can change your mind at any time below; a decline stops further analytics records from being created and clears the analytics cookies this browser already holds.
Cookies we set
Strictly necessary
| Cookie | Retention | Purpose |
|---|---|---|
| _csrf | Session | Double-submit value the browser sends back as the csrf-token header, so a request that changes something cannot be forged by another site. |
| _csrf_secret | Session | Signed secret the token above is validated against. HttpOnly, so no script on the page can read it. |
| consent | 365 days | Remembers the choice you made in the consent banner, so it is not asked again on every page visit. |
Analytics
| Cookie | Retention | Purpose |
|---|---|---|
| gid | 365 days | First-party guest identity: repeat visits from one browser count as one visitor in the analytics rollups instead of many. |
| guest_fp | 365 days | Deduplication key derived from device characteristics, so a visitor who clears cookies does not become a new guest record. |
| aid | 90 days | Attribution context kept by the app (first touch, campaign, referral) so it can be attributed when a guest later signs up. |
| _ga, _ga_<id> | 2 years | Google Analytics 4: distinguishes visitors and sessions, at Google's default retention. Set by Google, and only after you grant analytics consent. |
Functional
| Cookie | Retention | Purpose |
|---|---|---|
| device_id | 365 days | Trusted-device token: a device you already verified can skip the email verification code on later sign-ins. |
Why this list is short
A site like cloudflare.com publishes around a hundred and fifty cookies across those four categories, because it runs a marketing stack beside its product: OneTrust for consent, Adobe Experience Cloud and Amplitude for analytics, LogRocket for session replay, Bizible and Salesloft for lead tracking, and DoubleClick, Casale, Tremor, LiveRamp and the social networks for advertising. Every one of those is a separate processor, a separate retention rule, a separate disclosure and a separate thing to delete on request.
We hold none of them, and the reason is structural rather than cosmetic:
- Measurement is built in, not bought. Page views and unique visitors are counted from our own event stream into first-party rollups, so there is no third-party analytics vendor to disclose and nothing to send outside the EU/EEA hosting region we already use.
- No advertising stack. We do not run retargeting, cross-site profiling or ad exchanges, so there is no cookie whose purpose is to follow you to other websites. This is also why no cookie here falls into a “targeting” category.
- Every cookie has an owner and an exit. The banner lists each one with its retention, the categories that own it can be switched off, and switching them off deletes the cookies rather than merely stopping new writes.
The trade-off is honest: we know less about how visitors browse the marketing pages than those stacks would tell us. We accept that to keep the cookie list to eight entries and every one of them first-party.
11. Children
The Service is not directed at children under the applicable age of consent, and we do not knowingly collect their personal data.
12. Changes
We may update this policy from time to time. Material changes will be notified on the Service, and the “last updated” date above will be revised.
13. Language
The English text of this policy is the authoritative version. Any translation is provided for convenience only, and in the event of a conflict the English text prevails.