Skip to content
CrawlForge MCP

Legal

Your privacy is important to us. This policy explains how CrawlForge collects, uses, and protects your personal information.

Last Updated: September 2026

1. Information We Collect

Account Information

  • Email address (required for account creation and authentication)
  • Name (optional, for personalization)
  • Password (encrypted using industry-standard bcrypt hashing)
  • Account preferences and settings

Usage Data

  • API requests and responses (tool usage, endpoints called, parameters)
  • Credit consumption and balance history
  • Authentication logs (login times, IP addresses, device information)
  • Performance metrics (response times, error rates, success rates)
  • Browser and device information (user agent, screen resolution, OS)
  • Session data (duration, pages visited, features used)

Payment Information

  • Payment processing is handled exclusively by Stripe, our PCI-DSS compliant payment processor
  • We store only the last 4 digits of your card number and card brand for display purposes
  • Full payment details (card number, CVV, expiration date) are never stored on our servers
  • Stripe Customer ID and Subscription ID for billing management
  • Purchase history and invoice records

Automatically Collected Information

  • Cookies and similar tracking technologies (see our Cookie Policy for details)
  • Log data (IP address, browser type, referring/exit pages, timestamps)
  • Fraud prevention data (device fingerprinting, risk scoring, rate limiting metadata)
  • Error and diagnostic information for debugging and service improvement

2. How We Use Your Information

Service Delivery

  • Authenticate your account and maintain secure sessions
  • Process API requests and return scraping results
  • Manage your credit balance, subscriptions, and billing
  • Send service-related emails (account verification, password resets, billing notifications)
  • Provide customer support and respond to your inquiries

Service Improvement

  • Analyze usage patterns to optimize tool performance and reliability
  • Identify and fix bugs, errors, and performance bottlenecks
  • Develop new features and tools based on user needs
  • Conduct A/B testing and experimentation to improve user experience
  • Monitor service health and uptime

Security and Fraud Prevention

  • Detect and prevent fraudulent activity, abuse, and unauthorized access
  • Implement rate limiting and usage quotas to ensure fair use
  • Protect against DDoS attacks, credential stuffing, and other security threats
  • Comply with legal obligations and enforce our Terms of Service

Communications

  • Send transactional emails (purchase confirmations, credit balance alerts, API key generation)
  • Notify you of significant service updates, new features, or breaking changes
  • Respond to support requests and provide technical assistance
  • Send marketing communications (only with your explicit consent, opt-out available)

3. How We Share Your Information

We Do Not Sell Your Data

  • CrawlForge never sells, rents, or trades your personal information to third parties for marketing purposes
  • Your data is yours, and we respect your privacy

Third-Party Service Providers

  • Stripe (payment processing, PCI-DSS Level 1 certified) - processes payments and manages subscriptions
  • Neon Database (PostgreSQL hosting) - stores user data, API keys, and usage logs in encrypted databases
  • Upstash Redis (caching and session management) - stores temporary session data and rate limiting metadata
  • Vercel (hosting and infrastructure) - hosts our application with enterprise-grade security
  • Sentry (error monitoring) - collects anonymized error reports for debugging (personal data is scrubbed)

Legal Requirements

  • We may disclose your information if required by law, court order, or government regulation
  • To protect our rights, property, or safety, or that of our users or the public
  • In connection with a merger, acquisition, or sale of assets (users will be notified in advance)

With Your Consent

  • We may share information with third parties when you explicitly authorize us to do so
  • For example, integrating with third-party tools or services you choose to connect

4. Data Retention

We keep personal data only as long as the purpose it was collected for requires. The schedule below is the same table published on our Security and Data Handling page; every period comes from the code path that enforces it.

Data
Tool results on the MCP path (page content, extracted data, screenshots)
Where it is held
Your machine only
Kept for
Never sent to CrawlForge
Notes
The MCP server fetches sites directly and reports only usage metadata to our API.
Data
Tool results on the REST path
Where it is held
Returned in the HTTP response
Kept for
Not stored
Notes
The three time-limited stores below are the only exceptions.
Data
Batch results (asynchronous batch_scrape jobs, read back with get_batch_results)
Where it is held
Redis (Upstash)
Kept for
24 hours
Notes
Expire on their own. The job id is the only way to read them.
Data
Change-tracking baselines (the page text captured by track_changes)
Where it is held
Redis (Upstash)
Kept for
90 days
Notes
Creating a new baseline for the same URL and selector replaces the old one and restarts the period.
Data
Hosted monitor baselines (the last captured text of each monitored page)
Where it is held
PostgreSQL (Neon)
Kept for
Until the monitor is deleted
Notes
Every check replaces the previous capture, so only the latest text of each target is held. Deleting the monitor deletes its baselines.
Data
Hosted monitor checks (per-check status, counts, credits and the added and removed lines of each target)
Where it is held
PostgreSQL (Neon)
Kept for
30 days by default, 1 to 365 days set per monitor
Notes
The scheduled run deletes older checks; deleting the monitor deletes its history.
Data
Oversized results held for read_result (a result too large to return inline)
Where it is held
Redis (Upstash)
Kept for
1 hour
Notes
Stored under your account. The result handle is the only way to read it.
Data
Usage logs: tool name, masked parameters (including the target URL or query), status, duration, credits, API key id and client version
Where it is held
PostgreSQL (Neon)
Kept for
12 months
Notes
A daily job deletes older rows. Secrets are masked before a row is written and again before it is shown in the dashboard.
Data
Account data: email, name, password hash, sign-in provider ids, settings, credit balance and feedback-survey answers
Where it is held
PostgreSQL (Neon)
Kept for
While your account exists
Notes
Deleted with the account. See Account Deletion below.
Data
API keys
Where it is held
PostgreSQL (Neon), as a salted SHA-256 hash plus the key prefix
Kept for
Until you revoke them
Notes
The full key is shown once, when it is created. It is not stored and cannot be shown again.
Data
Sign-in sessions
Where it is held
httpOnly cookies, with a verification cache in Redis (Upstash)
Kept for
Access token 15 minutes, refresh token 7 days
Notes
Signing out clears both. The verification cache expires after 5 minutes.
Data
Password-reset and email-verification tokens
Where it is held
PostgreSQL (Neon), hashed
Kept for
Reset links 1 hour, verification links 24 hours
Notes
Single use. The link in the email is the only copy of the token.
Data
Fraud-prevention data: device fingerprint, risk score and sign-up rate-limit counters
Where it is held
PostgreSQL (Neon) and Redis (Upstash)
Kept for
Fingerprints and risk scores until account deletion, after which only the fingerprint hash is kept, unlinked (see Deleted accounts); rate-limit counters 1 hour to 30 days
Notes
Used only to block abusive sign-ups and key creation. Never used for profiling or advertising.
Data
Payment records
Where it is held
Stripe
Kept for
As long as tax and accounting law requires
Notes
We store the Stripe customer and subscription ids, the plan and the billing period. Card numbers never reach our servers.
Data
Newsletter subscription (email address)
Where it is held
PostgreSQL (Neon)
Kept for
Until you unsubscribe
Notes
Every newsletter carries an unsubscribe link.
Data
Deleted accounts
Where it is held
PostgreSQL (Neon)
Kept for
Deleted at once from Settings (within 30 days of an emailed request); one-way hashes kept indefinitely
Notes
Account, keys, usage logs, subscriptions, monitors, fingerprints, risk scores and tokens are deleted together. One-way hashes of the email address and device fingerprints stay, linked to nothing else, so a new account that matches one gets no free credits. Redis entries expire on the periods above. Stripe keeps payment records as the law requires.

Read the full data-handling description, including subprocessors and account deletion, on the Security and Data Handling page. Security and Data Handling

5. Your Rights (GDPR & CCPA)

Access and Portability

  • Request a copy of all personal data we hold about you
  • Export your data in a machine-readable format (JSON or CSV)
  • Access your usage history, API logs, and billing records from the dashboard

Correction and Updates

  • Update your account information at any time from the settings page
  • Correct inaccurate or incomplete personal data
  • Modify your communication preferences and email settings

Deletion (Right to be Forgotten)

  • Delete your account and its personal data yourself, from Settings in the dashboard
  • Request deletion of specific data categories
  • Opt out of marketing communications while maintaining your account

Restriction and Objection

  • Restrict how we process your data (e.g., object to marketing emails)
  • Object to automated decision-making or profiling (we do not use these for critical decisions)
  • Withdraw consent at any time for data processing based on consent

How to Exercise Your Rights

  • Email us at simon@crawlforge.dev with your request
  • We will respond within 30 days (GDPR requirement)
  • California residents can request a copy of data shared with third parties (CCPA requirement)

6. Security Measures

Data Protection

  • All data in transit is encrypted using TLS 1.3 (HTTPS)
  • Passwords are hashed using bcrypt with industry-standard salt rounds
  • API keys are hashed using HMAC-SHA256 and never stored in plain text
  • Database connections are encrypted and access is restricted to authorized services only
  • Session tokens use JWT with short expiration times (15 minutes) and secure refresh tokens

Infrastructure Security

  • Hosted on Vercel with enterprise-grade DDoS protection and WAF (Web Application Firewall)
  • Database backups are encrypted and stored in multiple geographic regions
  • Regular security audits and penetration testing
  • Automated vulnerability scanning and dependency updates
  • Incident response plan with 24/7 monitoring via Sentry

Access Controls

  • Role-based access control (RBAC) for internal team members
  • Multi-factor authentication (MFA) available for user accounts
  • Principle of least privilege for all service accounts and integrations
  • Regular access reviews and permission audits

Data Breach Response

  • In the event of a data breach, we will notify affected users within 72 hours (GDPR requirement)
  • We will provide details on the nature of the breach, affected data, and remediation steps
  • We maintain a comprehensive incident response plan and regularly test it

7. International Data Transfers

Data Location

  • Our primary infrastructure is hosted in the United States (Vercel, Neon, Upstash)
  • Data may be transferred to and processed in countries outside your jurisdiction
  • We use Standard Contractual Clauses (SCCs) for GDPR-compliant international transfers
  • All third-party processors are vetted for GDPR and CCPA compliance

8. Children's Privacy

Age Restriction

  • CrawlForge is not intended for users under 18 years of age
  • We do not knowingly collect personal information from children
  • If we discover that a child has provided personal information, we will delete it immediately
  • Parents or guardians who believe their child has provided information should contact us

9. Changes to This Policy

Policy Updates

  • We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements
  • We will notify you of material changes via email or a prominent notice on our website
  • Continued use of CrawlForge after changes constitutes acceptance of the updated policy
  • Previous versions of this policy are available upon request

10. Contact Us

Privacy Questions

  • Email: simon@crawlforge.dev
  • Subject line: 'Privacy Policy Inquiry' for faster response
  • Response time: Within 48 hours for general questions, 30 days for GDPR/CCPA requests

Data Protection Officer (DPO)

  • For GDPR-related inquiries, you can contact our Data Protection Officer at simon@crawlforge.dev
  • Please include 'ATTN: DPO' in the subject line

Supervisory Authority

  • EU residents have the right to lodge a complaint with their local data protection authority
  • California residents can contact the California Attorney General's Office for CCPA complaints

Related Legal Documents

Questions About Your Privacy?

If you have any questions about this Privacy Policy or how we handle your data, please don't hesitate to contact us.
simon@crawlforge.dev