1. Introduction

"scrapedatshi" is a trade name (doing business as, or "DBA") of Primodox LLC. References to "scrapedatshi," "we," "us," or "our" in this Privacy Policy refer to Primodox LLC.

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and API services (collectively, the "Service").

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

Information You Provide Directly

When you register for an account, we collect:

Your name and email address
A hashed password (we never store your plaintext password)
OAuth profile data if you sign in via GitHub or Google (name, email, provider ID)

Information Collected Automatically

When you use the Service, we automatically collect:

API request logs (endpoint called, timestamp, HTTP status code)
Usage statistics (request counts, tokens processed, vectors synced)
Your IP address and browser user-agent for security and rate-limiting purposes

Third-Party Credentials (Credential Vault)

If you choose to save third-party API keys (e.g., OpenAI, Pinecone, Weaviate) in our encrypted credential vault, those keys are encrypted at rest using AES-256 symmetric encryption. We do not transmit or share your stored credentials with any party other than the intended third-party service when you initiate a request.

Billing Information

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your full payment card number, CVV, or bank account details. Stripe handles all payment data under their PCI-compliant infrastructure. We receive and store only a Stripe customer ID and subscription ID to manage your account status.

Usage Events (Billable Activity)

For paid and Enterprise accounts, we log billable usage events — including the number of chunks generated, pages crawled, and pipeline runs — to calculate metered billing and display usage statistics in your billing dashboard. These events are associated with your account and retained for billing reconciliation purposes.

Local Fetch Mode & Client-Side Credentials

By default, the scrapedatshi Python SDK and MCP server operate in local-fetch mode — the recommended path for maximum performance: outbound HTTP requests to target URLs are made directly from the user's pipeline, not from our servers. In this mode, we do not receive, log, or store the content of those outbound requests, the target URLs fetched locally, or any response data from those URLs before it is submitted to our API as processed HTML.

The SDK supports passing session cookies and custom HTTP headers to enable authenticated scraping of login-walled pages. These credentials are used exclusively on the user's local machine and are never transmitted to our servers. We do not receive, store, or have access to any cookies or headers supplied to the SDK's local-fetch methods.

When server-fetch mode is used (portal tools or SDK fetch_mode="server"), our server makes the outbound HTTP request. This mode is intended for restricted environments without direct outbound access. In this mode, we log the target URL and HTTP status code as part of standard API request logging, consistent with the "Information Collected Automatically" section above.

Session Capture (`capture_session()`) — Local Only

The optional capture_session() utility (available via pip install scrapedatshi[auth]) opens a real browser window on the user's local machine to capture browser session state (cookies and localStorage tokens) for use in authenticated scraping.

scrapedatshi does not receive, store, or process any data generated by capture_session(). Specifically:

Captured session state (cookies, localStorage tokens) is stored only on the user's local machine in a .auth.json file — we never receive or have access to this data
The browser opened by capture_session() runs entirely on the user's machine using the user's own IP address — we do not proxy, observe, or log this browser session
Authentication credentials entered during the capture session (passwords, MFA codes, etc.) are entered directly into the target website's login form — we never receive or process these credentials

Users are solely responsible for the security of their captured session files and for ensuring their use of session capture complies with the terms of service of any target system and all applicable laws. See our Terms of Service (Section 7) for the full user responsibility and risk acknowledgment applicable to authenticated scraping features.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service
Authenticate your identity and manage your account
Enforce API rate limits and usage quotas based on your subscription tier
Monitor for abuse, fraud, and security threats
Improve and develop new features for the Service
Communicate with you about your account or the Service (if you contact us)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Cookies and Session Data

We use a single HttpOnly session cookie (portal_key) to maintain your authenticated session in the developer portal. This cookie:

Is set only after a successful login
Is marked HttpOnly and Secure — it cannot be accessed by JavaScript
Expires after 30 days of inactivity
Is deleted immediately when you sign out

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

5. Data Sharing and Third-Party Services

We do not share your personal data with third parties except in the following limited circumstances:

OAuth Providers: If you sign in with GitHub or Google, those providers share your profile information with us under their respective privacy policies. We do not share data back to them beyond the standard OAuth flow.
Infrastructure Providers: We use cloud hosting and database services to operate the Service. These providers process data on our behalf and are bound by confidentiality obligations.
Stripe (Payment Processing): If you subscribe to a paid plan, your payment information is transmitted to and processed by Stripe, Inc. Stripe's privacy policy governs how they handle your payment data. We share only the minimum information necessary to process your subscription (email address, subscription tier).
Legal Requirements: We may disclose your information if required by law, court order, or governmental authority.

6. Data Retention

What We Retain

Account information (name, email, hashed password, API keys) — retained for as long as your account is active
Billing records (Stripe customer ID, transaction history) — retained as required for financial and legal compliance
Usage metrics (endpoint called, timestamp, HTTP status code, credits deducted, request counts) — retained for up to 90 days for debugging and billing reconciliation
Sync job history (job ID, status, vector count, timestamp) — retained for up to 12 months

What We Do NOT Retain

Content of URLs you scrape or files you process — we process this data to generate chunks and embeddings, then discard it. The raw content of your requests is never stored on our servers.
Session cookies, HTTP headers, or authentication credentials supplied to local-fetch mode — these are used exclusively on your local machine and never reach our servers.
Captured session state from capture_session() — stored only on your local machine in a .auth.json file. We have no access to this data.

Automated Deletion

A nightly automated process permanently deletes usage event records older than 90 days and sync job records older than 12 months. These retention windows are enforced automatically — no manual action is required. Retention windows are configurable and may be adjusted to comply with applicable law.

Account Deletion

You may request deletion of your account and all associated data at any time through the developer portal. Upon deletion, your account information, API keys, usage history, and stored credentials are permanently removed.

7. Security

We implement industry-standard security measures to protect your information:

Passwords are hashed using bcrypt with a cost factor of 12
Third-party credentials are encrypted using AES-256 (Fernet) before storage
All data in transit is protected by TLS/HTTPS
Session cookies are HttpOnly and Secure
API keys are generated using cryptographically secure random functions

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and data
Object to or restrict certain processing of your data
Data portability (receive your data in a machine-readable format)

To exercise any of these rights, please use the account management features in the developer portal or contact us directly.

9. Age Restrictions and Minors

The Service is strictly intended for adult developers and business entities. We do not knowingly collect personal information from individuals under the age of 13 (or under 16 in certain jurisdictions, including the EU and California). If we discover that an individual under these age thresholds has bypassed security gates and created an account, we will immediately delete their data and terminate the access token.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

🔒 Privacy Policy