What we hold, and why.

Scraply decides how the personal data described on this page is used. Scraply is an independent project run by an individual developer. It is not yet operated by a registered company.

Privacy questions, access requests and complaints go to support@scraply.net. There is no data protection officer; the operator answers these messages directly.

• Account details: your name, email address, account role, status, credit balance and timestamps for creation and changes. Your password is stored as a bcrypt hash and cannot be read back by anyone, including the operator.
• API keys: only a SHA-256 hash and the first 18 characters, which are shown as a label. The full key is displayed once, when it is created, and is never stored.
• Sessions: a SHA-256 hash of the session token, the account it belongs to, and an expiry 24 hours after sign-in. The token itself lives in an HttpOnly cookie in your browser.
• Request history: for every scrape job, the target URL, whether it succeeded, the upstream HTTP status, the number of attempts, the credits charged and the result that was returned to you.
• Billing records: the plan bought, credits added, amount in cents, currency, order status, provider reference and timestamps. Card or wallet credentials never reach Scraply; the payment provider handles them.
• Messages and audit trail: support email you send us, and a log of administrative actions with the acting account.

A scrape request is carried out on your instruction. The page content that comes back is stored with the request so you can read it later in the dashboard and in /v1 history. That content may contain personal data about third parties, and you are responsible for having a lawful basis to collect it. Do not send us credentials, cookies or session tokens for a target site unless you accept that they are processed to complete your request.

• No advertising, analytics or cross-site tracking scripts. The site loads no third-party JavaScript for measurement.
• No device fingerprinting and no profile built across other websites.
• No card numbers, bank details or wallet keys. Payment details are entered on the payment provider's page, not ours.
• No location data and no contact list. There is no mobile app and no address book permission to grant.

• To run your account and the API — sign-in, verification, key management, running requests and returning results. This is performance of the agreement in the Terms of Service.
• To bill correctly — calculating credits, recording orders and keeping the accounting records the law requires.
• To keep the service safe — detecting abuse, credential stuffing, scraping of prohibited material and attempts to reach internal systems. This is a legitimate interest of the operator, limited to what the security controls need.
• To answer you — support email and security reports, handled because you asked for a reply.

Scraply sends transactional email only: verification, password reset, security notices and receipts. There is no marketing list to join and no newsletter consent to withdraw.

Four providers are involved in delivering the service. Each receives only the part it needs.

Data may also be disclosed where a lawful request requires it, or to establish or defend a legal claim. It is not sold, and it is not shared with advertisers or data brokers.

• Verification and password-reset links expire after 15 minutes and are single-use.
• Sessions stop working 24 hours after sign-in. The expired session row stays in the database until the account is deleted.
• Unpaid checkout orders expire after 30 minutes.
• Request logs and the returned content are kept while your account is active. There is no automatic deletion job or self-service history deletion yet. Contact support to request removal.
• Local daily database backups are retained for 14 days. An off-host backup, if configured, has its own retention settings. Removed data may remain in a backup until that copy expires; access is restricted and restored data must be checked against outstanding deletion requests.
• Billing records are kept for as long as accounting and tax rules require, even after an account is closed.

The application and database run on a Hetzner server in the European Union. Cloudflare terminates TLS at an edge close to you and forwards requests to that server. Email is handed to Google for delivery. These transfers rely on the providers' standard contractual terms for international data transfers.

You can ask for a copy of your data, correct it, delete it, restrict or object to its processing, or receive it in a portable format. Write to support@scraply.net from the address on the account. We answer within 30 days and may ask you to confirm control of the account first.

Some records cannot be deleted on request: an invoice that tax law requires us to keep, or data needed to resolve an open dispute. If you believe a request was handled wrongly, you may complain to the data protection authority in your country of residence.

Passwords are bcrypt hashes. Session tokens and API keys are stored only as hashes. The session cookie is HttpOnly, Secure and SameSite=Lax, so page scripts cannot read it. Traffic is served over TLS with HSTS enabled, every state-changing browser request is checked against the site origin, and permissions are enforced on the server rather than by hiding menu entries.

No system is perfect, and this page is not a certification. If you find a weakness, report it privately to support@scraply.net. Please do not include live keys, passwords or customer data in the report.

The service is for people aged 16 and over. An account for a younger person is not permitted, and data found to belong to one is deleted.

The date at the top of this page changes whenever the text does. Material changes are announced by email to the account address or in the dashboard before they take effect.

This policy is governed by the laws of the Republic of Azerbaijan. It sits alongside the Terms of Service and the Cookie Policy.