Privacy

Who is responsible

OpenWings Automação Comercial Ltda. (CNPJ 63.852.648/0001-06), Rua Padre João Wislinski, 441, Santa Cândida, Curitiba – PR, CEP 82630-494, Brazil, is the controller for the data described here. Its data protection officer, the encarregado the LGPD requires, is Gustavo Salomé Silva. For questions, access requests or deletion, write to privacy@scrapa.app. We answer within fifteen days.

When you use the API to fetch pages, we are your processor for whatever those pages contain. What you collect and whether you are allowed to collect it is your call and your responsibility.

What we store about you

Your account: the email address you signed up with, and the identifier from Google or GitHub if you signed in that way. We never see or store a password when you use those.

Your keys: a SHA-256 hash of each key and its first characters, so a key can be recognised and revoked but never re-read, not even by us.

Your usage: per request, the timestamp, which operation ran, which engine answered, the credits charged and the target's hostname. Billing records and invoices come from Stripe, who hold your card details; we never receive a card number.

The pages we read for you

A page we read for you is kept only when you ask for it, and only for your account. A call with maxAge can be answered from a copy read up to an hour before it, and a batch's results stay readable for 24 hours after you send the batch. A page is never shared with another account, never sold and never used to train anything. How long each copy lasts, backups included, is under How long we keep it, below.

Screenshots and PDFs we make of a page are never kept, and neither is a file you ask for raw. They come back inside the response and are dropped.

What lives inside a browser session is never kept either. Cookies, form input and everything else in it die with the browser process when the session closes or expires.

Signing in with Google or GitHub

You sign in with Google or with GitHub. All we receive from them is what their consent screen shows: your name, your email address and your profile picture. We use them to create your account, to recognise you when you come back, and to reach you about your keys and your bill.

We ask them for nothing else. Not your Gmail, your Drive, your calendar, your contacts or your repositories. We do not sell what they give us, we do not use it for advertising, and we do not train anything on it.

To disconnect Google or GitHub, remove scrapa at myaccount.google.com/permissions or github.com/settings/applications. This stops that sign-in method; it does not delete your scrapa account. To request deletion, write to privacy@scrapa.app.

scrapa’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Emails we send

About your account: confirming your address, signing you in, setting a new password, confirming a new address, and a code when we have to check it is still you. We also write about your keys, your bill, and a material change to these documents. They are part of the service, so they cannot be turned off while the account exists.

News and tips: we send none today. If we start, only the people who left the box ticked at sign-up will get them, and every one will carry a link to unsubscribe.

Why we are allowed to

To run the service you asked for and to bill you for it, which is the performance of our contract. To keep the service safe and to enforce the acceptable-use policy, which is our legitimate interest and the reason the network log below exists. And to meet accounting and tax obligations, which is a legal duty.

We do not sell personal data, we do not share it for advertising, and we do not make automated decisions with legal effects about you.

How long we keep it

Pages we read for you: a copy kept for maxAge lasts one hour at most. A batch's results stay readable for 24 hours after you send the batch and are deleted within the next 15 minutes. A batch still running at 24 hours stops there, and a page it was already reading is deleted within 15 minutes.

Search results: 10 minutes. They are shared between accounts that ask the same question, and hold only the links and snippets the search engine answered, nothing about who asked.

Nightly backups of the database and the queue: 30 days, and then they are deleted. Until then, a backup still holds the batch results and search results that were there the night it was made.

Daily per-key usage totals: 400 days. These record counts and credits, not page contents. The per-request proxy ledger keeps destination hosts and byte counts for 30 days. Nightly cleanup removes rows past each window.

API access logs may include request paths and query strings. We keep them for 180 days, then delete them. Application logs rotate daily or at 50 MB, with 30 rolled files kept; their current file has no fixed expiry.

Your account and API key records: kept while the account exists. Revoking a key disables access but keeps its record. Account deletion is handled on request at privacy@scrapa.app, not by an automatic grace-period timer. Invoices are kept for the period tax law requires.

Who else touches it

Stripe processes payments and holds your card details. Cloudflare serves this website, terminates TLS and stores our nightly backups. Amazon SES, the email service of Amazon Web Services, delivers the emails described above from the United States (AWS's us-east-1 region) and sees your address and what each one says. AWS may keep and scan each email to block spam and viruses. If an email to you bounces for good, or you mark one as spam, Amazon SES stops sending to your address until we take it off its list. Our residential proxy provider carries the requests you make through the managed pool and sees the destination hosts, not your identity.

Some requests leave through someone else's machines. When a site blocks our own browser, a third-party rendering provider may fetch that page for us; a web search goes to an index we do not run; and a written answer is composed by a model provider from those results. Each of them sees the address or the query and nothing about you: no account, no key, no card. Ask us and we will name them.

Everything else (the database, the queue, the browsers) runs on hardware we operate in São Paulo, Brazil. If you are in the European Union, that is a transfer outside it, covered by the standard contractual clauses.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to a use of it, or take it elsewhere in a portable form. Most of it is already downloadable from the console; for the rest, write to privacy@scrapa.app.

If you think we have got this wrong you can complain to Brazil's ANPD, or to your own supervisory authority in the European Union or the United Kingdom. We would rather you told us first.

This website

The marketing site sets no advertising or analytics cookies. Your language choice is kept in your browser's local storage so the site opens in it next time; the console additionally holds a session token there, which is what keeps you signed in. The console also keeps the email you type on a sign-in screen, in this browser only and for up to 30 minutes, so the next sign-in screen can fill it in. Signing in clears it.

We may update this notice. A material change is announced by email to the address on your account before it takes effect.

Connecting an AI app

When you connect an AI app through MCP, the protocol that lets an agent call scrapa tools, scrapa receives the tool names and arguments the app sends. These may include URLs, search queries, page-reading instructions, headers and request bodies. We return the requested results and usage to that app. We do not receive your whole conversation unless the app includes it in a tool argument.

Connecting creates a named API key for the account you approve. The app can use that account's credits and manage its batches and browser sessions. It cannot buy credits or change the plan. Revoke the key on the console's Keys page to stop future calls. Disconnecting inside the AI app does not necessarily revoke that key.

We store only hashes of authorization codes, device codes and API keys. An authorization code expires after 5 minutes; a device code expires after 10 minutes. A nightly task deletes sign-in records that expired more than a day earlier. API key hashes and records remain with the account, including after revocation. A client registration is signed, not stored as a separate database record.

The retention periods above also apply to requests made by an AI app, including logs and backups. Revoking a key does not remove results already returned to the app. The AI app keeps and uses those results under its own privacy policy. scrapa does not use your tool inputs or results to train AI models. For access or deletion requests, write to privacy@scrapa.app.