Privacy Policy.

We collect information in the following categories:

Account Information

• Email address (required for account creation)
• Name or organization name (optional)
• Billing information (processed by our payment provider)

Usage Data

• API request metadata (endpoint, timestamp, response code, latency)
• Page credit consumption and billing events
• Feature usage patterns (formats requested, extraction options)

Technical Data

• IP address and approximate geolocation
• User-Agent string and client SDK version
• Error logs and stack traces (for debugging)

We use your information to:

• Provide, maintain, and improve the webclaw service
• Authenticate API requests and enforce rate limits
• Process payments and manage subscriptions
• Send service-critical communications (outages, security alerts, billing)
• Detect and prevent abuse, fraud, and security incidents
• Generate aggregate, anonymized usage analytics

We do not use your data for advertising. We do not sell, rent, or trade your personal information to third parties. Ever.

This is important, so we're explicit: when you use the webclaw API to extract content from a URL, here is exactly what happens:

• We fetch the target URL, process the HTML, and return the extraction result to you
• Extracted content may be cached for up to 1 hour to improve performance for repeated requests
• We log the target URL, response status, and processing time for billing and debugging
• We do NOT persistently store the full content of extracted pages beyond the cache window
• We do NOT analyze, index, or use extracted content for any purpose other than serving your request

If you use LLM features (summarization, JSON extraction), your content is sent to the configured LLM provider (Ollama, OpenAI, or Anthropic) subject to their respective privacy policies. When self-hosting, you control which providers are used.

Our website (webclaw.io) uses two kinds of cookies / local storage:

• Essential (always active) — authentication session, CSRF protection, consent preference itself. Required for the dashboard to function. No consent required under ePrivacy Directive Art. 5(3).
• Analytics (no cookies, tab-scoped storage) — DataFast runs in cookieless mode. It sets no cookies at all, but "cookieless" does not mean "no storage": it keeps a handful of values in your browser's sessionStorage, which your browser discards when the tab closes. Section 05 lists every key. Because that is still terminal-equipment storage, we do not claim an ePrivacy Art. 5(3) exemption for it; we run it ungated as a disclosed position and you can switch it off yourself (below). Ahrefs remains consent-gated: it loads only after you click "Accept" in the banner, and never if you click "Reject" or send Do-Not-Track.

Analytics processors used (cookieless or consent-gated, see section 05 for details):

• DataFast — privacy-first web analytics, cookieless
• Ahrefs Web Analytics — aggregate referrer-only

We do not use advertising trackers, retargeting pixels, social media pixels, or cross-site tracking cookies. DataFast runs in cookieless mode: it sets no cookies, does not record sessions, and never links you across sites. It does write tab-scoped identifiers — itemised in section 05 — which your browser discards when the tab closes. The API itself uses no cookies — authentication is via API key in the request header.

You can change your consent preference at any time by clearing your browser storage for webclaw.io (which re-opens the banner) or by emailing privacy@webclaw.io.

We use a limited set of sub-processors. Analytics processors only receive data from webclaw.io (the website) — they never see API traffic. DataFast runs cookieless and ungated; Ahrefs loads only after you grant consent.

What DataFast stores in your browser

Verified against the served script (script.cookieless.js), last checked 2026-07-30. It never touches document.cookie.

• datafast_visitor_id, datafast_session_id — random ids, sessionStorage. Dropped when you close the tab, so you are a new visitor on every fresh session. DataFast additionally derives a pseudonymous id server-side from your IP, user-agent and our domain, salted with a value that rotates roughly every 24 hours — so visits on different days are not joined into one profile.
• datafast_pageview_state — sessionStorage, stops one page from being counted twice.
• datafast_stripe_payment_sent_* (and the Lemon Squeezy / Polar equivalents) — sessionStorage, stops one payment from being counted twice.
• datafast_ignore — the only localStorage key, and the script only ever reads it. Set it to "true" in your browser console and DataFast stops collecting anything from you, permanently, with no account or banner involved.

Service operations

• Stripe — payment processing. Handles all payment card data. We never see or store your full card number.
• Infrastructure providers — Hetzner (EU) for API servers and database; Cloudflare and Vercel for edge/static delivery.
• LLM providers — when using LLM features, requests are sent to OpenAI or Anthropic APIs (or your self-hosted Ollama instance).
• Transactional email — for account verification and billing notifications.

Analytics

• DataFast — privacy-first web analytics, run in cookieless mode: no cookies, no cross-site identifiers, no fingerprinting, no session recording. It does keep tab-scoped ids in sessionStorage — listed above. Captures page views and explicit conversion events (CTA clicks, navigation milestones) in aggregate. It runs ungated; you can opt out yourself with the datafast_ignore flag above. Processor: DataFast.
• Ahrefs Web Analytics — aggregate referrer and ranking analysis. No user-level tracking. Processor: Ahrefs Pte. Ltd.

Each sub-processor is bound by its own privacy policy and, where required, a data-processing agreement. None of them receive data from the webclaw API — their scope is strictly the public marketing site.

• Account data — retained while your account is active, deleted within 30 days of account closure
• API request logs — retained for 90 days, then automatically purged
• Extraction cache — maximum 1 hour, automatically evicted
• Error logs — retained for 30 days
• Billing records — retained for 7 years as required by tax law

You can request early deletion of your data at any time (see Your Rights below).

We implement industry-standard security measures including:

• TLS 1.3 encryption for all API traffic
• API keys hashed at rest (bcrypt)
• Infrastructure-level firewalls and intrusion detection
• Regular security audits and dependency scanning
• Principle of least privilege for internal access
• Encrypted backups with restricted access

No system is 100% secure. If we discover a data breach affecting your personal information, we will notify you and any applicable regulatory authorities within 72 hours.

Depending on your jurisdiction, you may have the following rights:

GDPR (EU/EEA)

• Right of access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to portability — receive your data in a structured format
• Right to restrict or object to processing
• Right to withdraw consent at any time

CCPA (California)

• Right to know what personal information we collect
• Right to delete your personal information
• Right to opt-out of the sale of personal information (we don't sell data)
• Right to non-discrimination for exercising your rights

To exercise any of these rights, email privacy@webclaw.io. We will respond within 30 days.

Our servers are located in the United States. If you are accessing webclaw from outside the US, your data may be transferred to and processed in the US.

For EU/EEA users, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission for lawful data transfers.

webclaw is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

The self-hosted version of webclaw runs entirely on your infrastructure. When self-hosting:

• We collect no data from your self-hosted instance
• No telemetry, no phone-home, no usage reporting
• You are the data controller for all data processed by your instance
• LLM provider connections are configured and controlled by you

This privacy policy applies only to our hosted services at api.webclaw.io and webclaw.io.

We may update this privacy policy from time to time. Material changes will be communicated via email to registered users at least 30 days before they take effect.

Non-material changes (clarifications, formatting) may be made without notice. The "Effective" date at the top always reflects the latest version.

For privacy-related questions or data requests:

• Email: privacy@webclaw.io
• General: admin@webclaw.io

We aim to respond to all privacy inquiries within 30 days.