Privacy Policy

DRAFT for legal review. This is a working draft written from the product plan. It is not legal advice and has not been reviewed by a lawyer. Text in square brackets is for the owner to fill in.

This policy explains how The Casey Company LLC, doing business as SocialScrape ("SocialScrape", "we") handles personal data. It covers two different groups of people, and the difference matters:

1. Customers: people who sign up, buy credits and use the API.
2. People in public social data: people whose public posts, profiles or comments appear in the data the API retrieves for our customers.

1. Customers#

What we collect

• Account data: name, email address and sign-in method (provided through our sign-in provider, Clerk), team membership and role.
• Billing data: handled by Stripe. We receive the plan or pack bought, the amount, the country and the last digits and brand of a card, not the full card number.
• Usage data: for every API request, the endpoint, the parameters you sent, the time, the status, the credits charged and the request id. We keep this so you can see your usage, so we can bill correctly, investigate problems and detect abuse.
• Technical data: IP address, browser and device information, and a device fingerprint hash used to stop the free credits being claimed repeatedly.
• Website analytics: first-party page statistics about how socialscrape.io is used.
• Messages you send to support.

Why we use it: to provide and bill for the service, to secure it and prevent abuse, to communicate with you about your account, to meet legal obligations, and to improve the product. Our legal bases are performing our contract with you, our legitimate interests in running and protecting the service, legal obligation, and your consent where we ask for it (for example, optional marketing email, which you can leave at any time).

Who receives it: service providers that run the product for us, under contracts: payments (Stripe), sign-in (Clerk), email delivery, hosting and error monitoring. [Owner to list the final providers and where they process data.] We do not sell customer data.

How long: account and billing records for as long as the account exists and as the law requires afterwards; request logs for [retention period to be decided by the owner]; deleted accounts are removed from active systems within [period to be decided].

2. People in public social data#

Our service retrieves content that anyone can see without logging in, such as a public profile, a public post, a public comment or a public video's captions, and returns it to the customer who asked. That content can contain personal data about the people who posted it or who are named in it.

• Our role. We retrieve data on a customer's request and return it. Customers decide why they ask for it and what they do with it; they are responsible for their own use and must follow our acceptable use policy. For the temporary copy we keep, we act as the party that decides how it is stored and deleted.
• Why we process it. To provide the service our customers pay for, on the basis of our legitimate interests and those of our customers in access to public information, balanced against the interests of the people concerned. Because the data is public and we use it only to retrieve and cache it, not to profile people, we believe the balance is reasonable.
• What we keep. Results are cached for a short time so repeated requests can be fast and cheap. Cached results are kept for at most 30 days and then deleted automatically.
• What we do not do. We do not log in to any platform, we do not access private accounts, and we do not infer sensitive characteristics from images. We do not sell the data, and we do not build our own profiles of individuals.
• Your rights. You can ask us to delete data about you from our cache and to stop serving it, whether or not you are our customer. See takedown and opt-out. Doing so does not remove the content from the platform where you published it; that is controlled there.

3. Your rights#

Depending on where you live (for example the EU, the UK or California) you may have the right to access, correct, delete or export personal data we hold about you, to object to or restrict some processing, to withdraw consent, and to complain to a data protection authority. We do not discriminate against you for using these rights. To use them write to [email protected]; we answer within 30 days. We may need to verify who you are first.

4. International transfers#

We are based in the United States and our providers may process data there and elsewhere. Where the law requires, we rely on approved transfer mechanisms such as standard contractual clauses. [Lawyer to confirm.]

5. Security#

We hash API keys and store only the hash, sign webhooks, restrict who can reach our systems, and use encryption in transit. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

6. Children#

The service is for developers and businesses and is not directed at children. We do not knowingly collect data from children through sign-up, and we do not offer any product built on data about minors.

7. Cookies#

We use the cookies needed to sign you in and keep you signed in. [Owner to confirm analytics and any other cookies, and whether a consent banner is needed.]

8. Changes and contact#

We will post changes here and tell account owners about material ones. Contact: [email protected]. Controller: The Casey Company LLC, doing business as SocialScrape, [postal address to be added by the owner].