Privacy Policy

PointScrape (“we”, “us”, “our”) is operated from Bali, Indonesia, and is the controller of the personal data you provide through the Service. We aim to handle your data in line with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and, where it applies to you, other data-protection laws such as the EU GDPR.

For anything in this policy, or to exercise your rights, contact us at support@pointscrape.com.

Account details

• Your name and email address.
• Your password, stored only in hashed form — never the password itself.
• If you sign in with Google: your Google account identifier, name, email address and profile picture. We never receive your Google password, and we ask Google for nothing beyond your basic profile and email.

Billing

• Your PayPal payer identifier, subscription records, and a history of credit purchases.
• We never see or store your card details. PayPal handles payment instruments under its own policy.

What you create in the Service

• Project names and descriptions, the URLs you target, and the extraction flows you build.
• Records of each run: status, pages visited, rows extracted, credits used, timings, and any error message.
• A sample of extracted rows, the full result file, and any export file you generate.

Usage and technical data

• Credits consumed and the actions that consumed them.
• Notifications we have sent you and whether they were read.
• Server logs containing IP address, browser and device type, and request time, kept for security and fault diagnosis.

Extracted data may itself contain personal data about other people, depending on what you target. Where that happens you are the controller of that data and we process it on your behalf — see section 6.

• To provide the Service you signed up for — running jobs, storing results, delivering exports. Basis: performance of our contract with you.
• To take payment and manage subscriptions. Basis: performance of our contract.
• To send service messages, such as a job finishing or an export being ready. Basis: performance of our contract. You can turn these off in settings.
• To keep the Service secure, prevent abuse, and enforce the acceptable-use rules in our Terms. Basis: our legitimate interest in a service that is not used to harm others.
• To meet legal and accounting obligations. Basis: legal obligation.

We do not sell personal data, we do not share it for advertising, and we do not use your data or your extracted results to train machine-learning models.

We use a small number of providers, each limited to a specific job:

• PayPal — payment processing and subscription billing. Receives what it needs to take payment.
• Google — in two separate roles: sign-in, if you choose to use it, and Google Analytics on every visit. See section 10.
• 2Captcha — where your plan includes CAPTCHA solving and a target page presents a challenge, that challenge is sent to 2Captcha to be solved. This happens only on plans with the feature, and only when a challenge is encountered.
• Our email provider — delivers account and notification email. Receives your email address and the message.

Application data is stored on servers we operate, not on a third-party managed database. We may also disclose data where the law requires it, or to establish or defend a legal claim.

• Scraped results and export files are deleted after your plan's retention window — 7 days on Free, 30 on Starter, 90 on Business — counted from when the run finished. The record that a run or export happened stays in your history.
• Projects and their configuration are kept while your account is open, so you can return to them.
• Account and billing records are kept while your account is open, and afterwards for as long as tax and accounting law requires.
• Server logs are rotated and overwritten on a rolling basis.

When you close your account we delete your projects, runs, results and exports, keeping only what we must for legal and accounting purposes.

If the pages you target contain personal data about other people, you decide to collect it and you decide what it is for. That makes you the controller of that data and us your processor.

You are responsible for having a lawful basis to collect it, for telling those people where the law requires, and for answering their requests. Our Terms require this. We process such data only to run the job you asked for and to deliver the result to you.

Depending on where you live, you may have the right to:

• Get a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted.
• Receive your data in a portable format.
• Object to, or ask us to restrict, processing based on legitimate interests.
• Withdraw consent where we relied on it, without affecting processing already carried out.

Write to support@pointscrape.com and we will respond within the period the applicable law allows. You can also complain to your local data-protection authority.

• Traffic between you and the Service is encrypted in transit.
• Passwords are stored only as hashes, and sign-in sessions use revocable tokens.
• Access to production systems is limited to the people who need it to operate the Service.

No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant authority as the law requires.

Our providers may process data outside Indonesia and outside the country you live in. Where data-protection law requires a safeguard for that transfer, we rely on the mechanisms that law provides, such as standard contractual clauses.

Your signed-in session is kept in your browser’s local storage so you stay logged in. That is required for the Service to work and cannot be turned off while you are using it.

We also use Google Analytics to understand how the Service is used — which pages are visited, and how people move through it. It sets cookies in your browser and shares your IP address and a randomly generated identifier with Google, who acts as our processor for this. Basis: our legitimate interest in knowing which parts of the product are used.

We do not run advertising trackers, we do not use analytics to build a profile of you, and we do not sell what it collects. You can opt out with Google’s browser add-on, or by using your browser’s Do Not Track or cookie-blocking settings.

The Service is not intended for children, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

We may update this policy. For a material change we will give notice by email or in the application before it takes effect. The date at the top shows when the wording last changed.

Privacy enquiries: support@pointscrape.com. See also our Terms of Service.