Privacy Policy

This policy covers two different kinds of data: the account data you give us when you use ScraperSocial, and the publicly available social media data the API retrieves on your behalf. We keep both sections short and honest.

1. Data we collect about you

• Account data: your email address, name if you provide one, and authentication identifiers (including from Google or GitHub sign-in if you use them).
• Billing data, handled by Stripe. We never see or store full card numbers; we keep subscription status, invoices and credit balances.
• Usage data: API request logs (endpoint called, parameters, timing, response status, credits charged, request IDs) and dashboard activity. We use these to run the service, meter billing, debug problems and prevent abuse.
• Support correspondence: emails you send us.

We don't run third-party advertising trackers, and we don't sell your personal data.

2. Data the API processes for you

When you call the API, we retrieve publicly available data from social platforms (post statistics, comments, public profile information, captions and media) and return it to you. Some of this data relates to identifiable people (a public profile's follower count, a public comment). For this data we act on your instructions: you choose what to request and what to do with the result, and you're responsible for your own legal basis to use it.

We cache responses to keep the API fast and affordable. Cache lifetimes are documented per endpoint and are bounded; cached content expires automatically. If you want specific cached content removed, email us the URLs (see contact) and we'll process the removal promptly. We only access data that is publicly reachable without logging in.

3. Who processes data for us

Our infrastructure providers, each processing data to run the service:

• Cloudflare: hosting, CDN and API edge (request logs).
• Supabase: database and authentication (account data, usage records).
• Stripe: payments (billing data).
• Resend: transactional email (your email address).
• Upstream data and AI providers: the scraping and speech-to-text/summarization infrastructure that fulfills API calls (content URLs and retrieved public content, not your account data).

4. Retention

Account data lives as long as your account does. Request logs are kept long enough for billing disputes, debugging and abuse prevention, then deleted or aggregated. Cached platform content expires on the documented cache schedule. When you delete your account we delete your personal data within 30 days, except records we must keep for tax and accounting.

5. Your rights

Depending on where you live (including under GDPR and CCPA) you may have rights to access, correct, export, delete or restrict the use of your personal data. Email us and we'll honor them; if you believe we've processed your data unlawfully you can also complain to your local supervisory authority. For data about you that appears on a social platform, the platform is the primary controller. But if our cache is serving it, we'll remove it on request as described above.

6. Security

API traffic is encrypted in transit. API keys are stored hashed; dashboard access requires authentication; production access is limited and logged. No system is perfectly secure. If we learn of a breach affecting your data we'll notify you without undue delay.

7. Changes and contact

Material changes to this policy get a new date above and an email to active customers. Privacy questions and data requests: support@scrapersocial.com.