1. Who we are
ScrapingBot (the website scraping-bot.io, the API api.scraping-bot.io and the MCP server mcp.scraping-bot.io) is published by SOSTAG, a company registered in France under number 880 323 324, whose registered office is at 55 rue de Béthencourt, 17000 La Rochelle, France. SOSTAG is the controller of the personal data described below.
For any question about your data, write to [email protected].
2. What we collect
- Account: username, email address, and the optional details you enter in your account settings (company, name, address). Your password and your API key are stored only as one-way hashes; the API key is shown once, when it is created.
- Billing: plan, credits and payment status. Card details are handled by Stripe and never reach our servers.
- Usage of the API: for each request, the URL scraped, the API and options used, the result status, the credits used, error messages and the data extracted from the page (for example a product's title and price). The full HTML of the pages is not kept. These records are deleted automatically after 60 days.
- Security: the IP address of requests, only to limit failed logins and abuse; these counters expire after a few hours at most.
- Messages you send us (support emails, contact form).
3. AI assistants and the MCP server
When you connect ScrapingBot to an AI assistant such as Claude, the assistant calls our tools on your behalf. Each call is an API request recorded as described above, and uses your credits.
- With "Sign in with ScrapingBot" (OAuth), the assistant never receives your API key or your password: it gets access tokens, stored on our side only as hashes, that expire after one hour and are renewed for up to 90 days. You can see the connected applications and disconnect them at any time in your account settings; logging out of all devices or changing your password disconnects them too.
- The hosted MCP server (mcp.scraping-bot.io) keeps nothing between requests. Its logs contain the method, path, status and duration of each request and a short pseudonymous identifier of the user, never your API key, tokens or the content of the requests.
- The MCP server only reads public web pages and your own account data; it does not modify anything in your account. We do not see your conversations with the assistant, only the tool calls it sends us.
4. How we use your data
- To provide the service: authenticate you, run your requests, count and bill your credits (performance of the contract).
- To support you: answer your questions and help you when your requests fail, using your usage history (performance of the contract).
- To keep the service secure and working: prevent abuse and fraud, monitor errors and performance (legitimate interest).
- To send you service emails (password reset, security alerts, changes to your account) and information about your usage and our offers, which you can unsubscribe from at any time (legitimate interest).
- To keep billing records, as required by law (legal obligation).
We do not sell your data and we do not use it to train AI models.
5. Who processes your data
We share your data only with the providers that run the service for us, under contracts that require them to protect it:
- DigitalOcean: hosting of the website, the API and the MCP server (Amsterdam, Netherlands).
- MongoDB Atlas: database of accounts and usage.
- Bright Data: proxy network used to reach the pages you scrape; it receives the URLs and options of your requests, not your account details.
- Stripe: payments and invoices.
- Brevo: customer emails and the follow-up of your usage.
- Our email delivery provider: service emails and messages to the support team.
Some of these providers may process data outside the European Union; in that case the transfer relies on the European Commission's standard contractual clauses or an equivalent safeguard.
6. How long we keep it
- Account data: as long as your account exists. When you delete your account in your account settings, we delete your account, API key, connected applications and email contact.
- Usage records: 60 days, then deleted automatically.
- Security counters: a few hours at most.
- Billing records: for the period required by French accounting law (10 years).
7. Cookies
The website only uses a session cookie, set when you log in, to keep you signed in. It is necessary for the service and expires after 7 days. We do not use advertising or analytics cookies.
8. Your rights
Under the GDPR you can access your data, correct it, have it deleted, receive it in a portable format, object to its use or ask us to restrict it. You can update or delete most of it yourself in your account settings; for anything else, write to [email protected]. We answer within one month.
If you think your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.
9. Content you scrape
You decide which pages are scraped. If those pages contain personal data, you are responsible for having a lawful basis to collect and use it, as set out in our terms and conditions; we process it only to return it to you.
10. Security
Data is encrypted in transit (HTTPS). Passwords, API keys, access tokens and authorization codes are stored only as hashes. Access to production systems is restricted to the team members who need it.
11. Changes
We will update this policy when the service changes, and tell you by email about any significant change.
See also our terms and conditions.
