Privacy Policy
Last updated November 5, 2026 · Version 2026-11-05
This Privacy Policy explains how Cwiz LLC, a Wyoming limited liability company doing business as Scrape AI ("Scrape AI," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you visit getscrape.ai or use the Scrape AI web application and related services (the "Services"). It also explains the choices and rights you have. Capitalized terms not defined here have the meaning given in our Terms of Service.
The short version
- We use your documents only to provide Scrape AI to you. We do not sell or share your personal information for advertising, we do not show ads, and we do not use your documents to train AI models.
- Your documents are processed by a small set of service providers listed on our Subprocessors page, including AI and text-recognition providers that do not train their models on your documents.
- Your files and results stay in your account until you delete them. Deleting a document, a run, or your account is immediate and permanent.
- We use only the cookies and browser storage needed to run the Services. We do not use analytics, advertising, or cross-site tracking cookies.
- You can access, export, correct, or delete your information. Email privacy@getscrape.ai.
1. Who is responsible for your information
1.1 Account Information. For information about you as our customer or visitor, such as your name, email address, sign-in method, plan, billing status, usage records, and agreement records ("Account Information"), Cwiz LLC is responsible. Under the EU and UK General Data Protection Regulation ("GDPR"), we are the controller of Account Information.
1.2 Customer Content. The documents you upload and the data extracted from them ("Customer Content") may contain personal information about other people, such as names, addresses, and contact details printed on invoices, contracts, or resumes. We process Customer Content on behalf of and under the instructions of the customer who uploaded it. Under the GDPR, the customer is the controller and we are a processor; under U.S. state privacy laws, we act as a service provider or processor. Our processing of Customer Content for business customers is governed by our Data Processing Addendum. If you are an individual whose information appears in a document a customer uploaded, please contact that customer; if you contact us, we will refer your request to them where the law allows and assist them as required.
2. Information we collect
2.1 Information you provide
- Account details: your email address, your name, and your password. Passwords are stored by our authentication provider only as a secure one-way hash; we never see them. If you sign in with Google, we receive your name, email address, Google account identifier, and the basic profile information Google shares, such as a profile photo link.
- Agreement records: when you accept our Terms of Service and acknowledge this Privacy Policy, we record which versions you accepted, when, how (for example, at email sign-up or Google sign-up), and, where available, the IP address and browser information of the device you used.
- Customer Content: files you upload (PDF and Word documents), page images we render from them for display and text recognition, the text recognized in them, extracted values and where they appear on each page, field names and definitions you create, your edits, and your run names.
- Billing information: when you subscribe, our payment processor, Stripe, collects your payment card details and billing address directly. We receive and store your Stripe customer identifier, subscription identifier, plan, subscription status, and billing-period dates, but never your full card number.
- Communications: messages you send to support@getscrape.ai, privacy@getscrape.ai, or legal@getscrape.ai, or through our live chat (provided by Crisp, and loaded only when you open it), and our replies. When you open the chat while signed in, we share your account email, account ID, and plan with Crisp so we know who is asking, and your chat history stays with your account.
2.2 Information collected automatically
- Usage records: the number of documents processed, runs, and automatic field-suggestion scans, with timestamps, and counts of values extracted. We use these to apply plan limits, bill, prevent abuse, and show you your own statistics.
- Technical and log data: IP address, browser type and version, device and operating system information, pages and features used, request timestamps, error messages, and diagnostic data, collected by our hosting, error-monitoring, and rate-limiting providers. Our error monitoring is configured not to collect personal identifiers by default, and we do not record your screen or sessions.
- Cookies and browser storage: an authentication cookie that keeps you signed in, a short-lived cookie that records your agreement to our terms while you sign up with Google, and browser storage that remembers preferences such as your theme, sidebar state, table layout, and dashboard and library views. See our Cookie Policy. We do not use analytics, advertising, or cross-site tracking cookies. We count visits with Vercel Web Analytics, which sets no cookies and keeps only anonymous, aggregated statistics.
2.3 Information from third parties
- Google, if you choose Google sign-in (basic profile) or Google Sheets export (permission to create the spreadsheet you export to).
- Stripe, about the status of your payments and subscription.
2.4 Information derived to prevent free-plan abuse. To stop people from obtaining the free plan more than once (see Section 4.3 of our Terms), we compute a "canonical" form of your email address (for Gmail addresses, without dots or "+" tags), and when an account that used any free allowance is deleted we keep a one-way, keyed hash of that canonical address (see Section 7). The hash cannot be reversed into your email address and is not linked to any other information about you.
3. How we use information
We use personal information for the following purposes:
- To provide the Services: create and secure your account; process your documents with AI and text recognition; check extracted values against your documents; show results, highlights, and statistics; save your edits; and export results when you ask.
- To process payments and manage subscriptions: charge your plan, apply allowances, handle upgrades, downgrades, cancellations, and failed payments, and keep accounting and tax records.
- To enforce our terms and prevent abuse: apply plan limits and rate limits, prevent people from obtaining the free plan more than once, detect and stop fraud and misuse, and keep records that you accepted our terms.
- To keep the Services secure and reliable: protect against attacks, investigate security incidents, and diagnose and fix errors, including, when a document fails to process, examining that document and its processing record to find and fix the cause.
- To communicate with you: send sign-up and password codes, receipts, billing and security notices, notices of changes to our terms or this Policy, and replies to your requests. We do not send marketing email. If we start, we will ask for any consent the law requires and include an easy way to opt out.
- To comply with law: respond to lawful requests, meet tax, accounting, and other legal obligations, and establish, exercise, or defend legal claims.
What we do not do. We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising. We do not use Customer Content to train or fine-tune AI models. Our personnel do not browse Customer Content; they access it only at your request, to investigate a processing failure, security incident, or abuse, or when required by law. We do not use personal information to make decisions about you that produce legal or similarly significant effects; the AI in our Services extracts data from documents at your direction and does not decide anything about you or the people in your documents.
4. Legal bases for processing (EU, UK, and similar laws)
Where the GDPR or a similar law applies, we rely on these legal bases for Account Information:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, providing the Services, processing payments | Performance of our contract with you |
| Agreement records, tax and accounting records | Compliance with legal obligations, and our legitimate interest in proving that our terms were accepted |
| Security, rate limiting, preventing free-plan abuse (including the keyed email hash), fraud prevention, diagnosing errors | Our legitimate interests in protecting the Services, our users, and our business, balanced against your rights |
| Service and security communications | Performance of our contract and our legitimate interests |
| Responding to legal requests and defending claims | Compliance with legal obligations and our legitimate interests |
| Any processing based on consent | Your consent, which you can withdraw at any time |
For Customer Content, we process personal data on the instructions of the customer, who is responsible for having a legal basis.
5. How we disclose information
We disclose personal information only as follows:
- Service providers (subprocessors). We use the providers listed on our Subprocessors page to host, store, and process data, run AI and text recognition, run background jobs, send account emails, process payments, monitor errors, and enforce rate limits. They may use personal information only to provide services to us and are bound by contracts or terms that restrict other uses. We update that page before a new provider begins processing Customer Content.
- AI and text-recognition providers. Anthropic, PBC processes the page images and text of your documents to suggest fields and extract values; under its commercial terms it does not use this data to train its models and deletes it within 30 days, except where retained for safety or legal reasons. Amazon Web Services processes page images for text recognition (Amazon Textract); we have opted our AWS organization out of Amazon's use of AI-service content to improve its services.
- Services you choose to connect. If you export to Google Sheets, the data you export goes to your Google account.
- Legal and safety reasons. We may disclose information if we believe in good faith that it is required by law, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of our users, the public, or us, or to investigate fraud or security issues.
- Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our business, information may be transferred as part of that transaction, subject to this Policy, and we will notify you of any change in who controls your information.
- With your permission. In other cases, with your consent or at your direction.
6. Google user data
If you connect your Google account, we access only the Google data needed for the feature you use: your basic profile for Google sign-in, and, when you export, permission to create and write the Google Sheets spreadsheet you export to (the "drive.file" scope, which gives access only to files the export creates). The export permission is granted in your browser for each export; our servers use it once to create and fill that spreadsheet and do not store it. We use Google user data only to provide these user-facing features. We do not use it for advertising, do not sell it, do not use it to train or improve AI models, and do not allow humans to read it except with your permission, for security purposes, or as required by law.
Scrape AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. How long we keep information
| Information | How long we keep it |
|---|---|
| Customer Content (files, page images, recognized text, extracted values, edits) | Until you delete the document, the run, or your account. Deletion removes the files, page images, and extracted data from our storage immediately. |
| Account details and agreement records | For the life of your account; deleted when you delete your account. |
| Usage records (counts of documents, runs, and scans) | For the life of your account, including after you delete individual runs or documents; deleted when you delete your account. |
| Keyed hash of a deleted account's email address | 12 months after the account is deleted, then automatically deleted. Kept only if the account used any free allowance. |
| Billing records held by Stripe | As required by tax and accounting law, under Stripe's own retention policy. |
| Copies held by service providers | Anthropic: up to 30 days. Background-job records, server logs, and error reports: under each provider's standard retention period, generally no more than 90 days. Database backups: under our database provider's backup schedule, generally no more than 30 days. |
| Support and legal correspondence | As long as needed to resolve the matter and for the time limits that apply to legal claims. |
We may keep information longer where required by law or needed to establish, exercise, or defend legal claims.
8. Security
We use measures designed to protect personal information, including encryption in transit (HTTPS/TLS) for all connections, encryption at rest provided by our infrastructure providers, per-account isolation so that each user can access only their own records, server-side checks of account ownership before any data is read or changed, private file storage, rate limiting, and restricted, authenticated access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we confirm a security breach affecting your personal information, we will notify you and the relevant authorities as required by law.
9. International transfers
We are based in the United States, and we and our service providers process and store information in the United States. If you use the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. Where the GDPR or similar law applies, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), our service providers' certifications under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions where available, or another lawful transfer mechanism. Our Data Processing Addendum incorporates the Standard Contractual Clauses for Customer Content.
10. Your rights and choices
10.1 Your rights. Depending on where you live, you may have the right to: know or access the personal information we hold about you; receive a copy in a portable format; correct inaccurate information; delete your information; restrict or object to certain processing; withdraw consent where processing is based on consent; and not be subject to decisions based solely on automated processing that significantly affect you (we do not make such decisions).
10.2 How to exercise them. You can delete documents, runs, or your entire account yourself in the Services. Paid plans can export extracted data at any time. For any other request, email privacy@getscrape.ai from the email address on your account. We will verify your identity before acting, and may ask for information needed to do so. We will respond within the time required by law (generally within 30 days under the GDPR and 45 days under California law, extendable where permitted). You may use an authorized agent where the law allows; we may ask the agent for proof of authorization and ask you to verify your identity directly.
10.3 Non-discrimination. We will not discriminate against you for exercising your privacy rights.
10.4 Appeals and complaints. If we decline your request, you may appeal by replying to our decision within 45 days, and we will respond in writing within the time required by law. If you are not satisfied, you may contact your state attorney general. If you are in the EU, EEA, or UK, you may lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).
10.5 Account emails. You cannot opt out of account, billing, security, and legal emails while you have an account, because they are necessary to provide the Services.
11. U.S. state privacy disclosures (including California)
This section supplements this Policy for residents of California and other U.S. states with comprehensive privacy laws.
11.1 Categories collected in the last 12 months. Identifiers (name, email address, account and Stripe identifiers, IP address); customer records and commercial information (plan, subscription, billing status, and usage records); internet or other electronic network activity (log, device, and usage data); inferences (none); account log-in credentials (email and password, used only to authenticate you), which are "sensitive personal information" under California law; and the contents of documents you choose to upload. Sources, purposes, and recipients are described in Sections 2, 3, and 5, and retention in Section 7.
11.2 No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.
11.3 Sensitive personal information. We use sensitive personal information only to provide the Services and as otherwise permitted by law, and not to infer characteristics about you.
11.4 Global Privacy Control and Do Not Track. Because we do not sell or share personal information or use cross-site tracking, there is nothing for these signals to turn off; we honor Global Privacy Control as an opt-out of sale and sharing should our practices ever change.
11.5 Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
11.6 Notice at collection. This Policy is our notice at collection. It is linked on our sign-up page and on every page of our website.
12. Children
The Services are intended only for people who are 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@getscrape.ai and we will delete it. Customers may not upload personal data of children under 16 (see our Terms).
13. Changes to this Policy
We may update this Policy. We will post the new version here with a new "Last updated" date. If a change is material, we will notify you by email or in the Services before it takes effect, and where required by law we will ask for your consent or acceptance.
14. Contact us
Questions, requests, or complaints about privacy: privacy@getscrape.ai, or by mail to Cwiz LLC (d/b/a Scrape AI), Attn: Privacy, 30 N Gould St, Ste N, Sheridan, WY 82801, USA.