# Privacy policy

> What personal data Grabber collects, why, how long it is kept, who processes it, and the rights you have over it. No analytics, no ad trackers.

[Company legal name], [registered address], runs Grabber and is responsible for your personal data. This policy covers the website, the API, the MCP server and the dashboard.

## What we collect

- **Your account**: your email address, a hash of your password (never the password itself) and whether you have verified your email.
- **Your requests**: for each API or MCP request, the address you fetched, whether it was rendered, the result, the cost, how long it took, which key made it and when. This is what the Activity page of the dashboard shows you.
- **Your billing**: your top-ups, your balance and your auto top-up settings. Stripe keeps your card; we only see its brand and last four digits.
- **The pages you fetch**: we send the content to you and do not keep it.

## The website

This website has no analytics and no advertising trackers. Your light or dark theme is saved in your own browser. Our server logs record requests for the files written for AI agents (llms.txt, skill.md and the .md versions of pages), with the path, the user agent, the referring page and the time, so we can see how agents use them. [These logs are kept for 30 days.]

## Cookies

The dashboard sets one cookie, `grabber_session`, which keeps you signed in for up to 30 days. Cloudflare, which protects our sites, may set cookies it needs to tell people from bots, and its Turnstile check runs on the signup and sign-in forms. We set no other cookies.

## Why we use your data

To run your account and the API (our contract with you), to bill you and keep tax records (a legal obligation), and to prevent abuse and fix errors (our legitimate interest in a secure, working service). We send you emails about your account, such as verification, password resets and low-balance alerts. We do not sell your data.

## Who processes it for us

- DigitalOcean, which hosts our servers.
- [Database provider], which hosts our database.
- Stripe, which handles payments.
- Mailchimp Transactional (Mandrill), which sends our emails.
- Cloudflare, which protects our sites and runs Turnstile.
- Sentry, which receives error reports. Before a report leaves our servers, we remove cookies, API keys, request bodies, IP addresses and the query string of every address.

[Where these providers process data outside your country, describe the safeguards here, such as the EU Standard Contractual Clauses.]

## How long we keep it

- Your request log: 90 days, then it is deleted automatically.
- Your account: until you ask us to delete it.
- Billing records: as long as tax law requires, [for example 10 years].

## Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a portable format. To use these rights, write to [privacy contact address]. You can also complain to your data protection authority.

## Changes

We will post changes here and update the date at the top. For important changes, we will email you first.