Privacy Policy

1. Who this policy covers

This policy describes personal-information handling by the operator of WebCraw (“we,” “us”) for webcraw.ai, our applications, and related APIs and integrations. For privacy requests, contact contato@webcraw.ai.

We determine how account, billing, security, and service-usage information is used to operate WebCraw. For personal information an organization places in its workspace, that organization may determine the purposes of processing, and we process it to provide the Service on its behalf. If your account belongs to an organization, its administrators may control access and handle requests about that workspace.

2. Information we collect

• Account information: your name, email, workspace name, memberships, role, verification status, and account preferences.
• Authentication information: password hashes, session and API-token records, verification-code records, and, if you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes. Passwords are processed when you sign in or set them; stored account passwords are hashed.
• Workspace content: notes, nodes, relationships, files, properties, history, conversations, prompts, AI outputs, scripts, schedules, and configuration or credentials you choose to store.
• Billing information: customer and subscription identifiers, plan, billing status, and payment-related records from our payment processor. Payment-card details are handled by Stripe rather than stored as card numbers in WebCraw’s application database.
• Technical and security information: request times, errors, usage counts, browser or device information, and request metadata. Signup audit records may include the submitted email, account identifier, outcome, browser user agent, origin/referrer origin, and IP-related proxy headers. Those headers can be incomplete or inaccurate. Environment encryption and decryption audit records include timestamps, workspace and resource identifiers, variable names, recorded actors, and outcomes. Workspace owners and admins can view this metadata in Security; the view excludes secret values, encryption keys, and raw error details.
• Communications: information you provide when you contact us, request support, or exercise a privacy right.

Connected clients and services may supply information when you authorize an integration or run a workflow. Do not send us information you are not entitled to share.

3. How and why we use information

We use information to create and authenticate accounts, store and retrieve knowledge, operate AI and automation features, manage workspace permissions, process subscriptions, send account emails, provide support, measure service use, investigate abuse, and meet legal obligations.

Where data-protection law requires a legal basis, providing the Service and fulfilling your requests generally relies on performing our contract with you; billing and required records may also rely on legal obligations. Security, abuse prevention, service administration, and understanding service performance rely on legitimate interests where permitted, balanced against your rights. Where consent is legally required for a particular activity, that activity requires consent; acknowledging this policy is not blanket consent to optional processing.

Providing account and authentication information is necessary to create and use an account. You choose what workspace content to add and which optional integrations to enable.

4. Providers, AI processing, and other sharing

WebCraw uses service providers to run the product. Depending on the features you use, information is processed by:

• Convex: application backend, database, file storage, and background processing.
• Vercel: website hosting, operational infrastructure, Web Analytics, and code-execution sandbox infrastructure.
• OpenRouter and the AI model providers it routes requests to: prompts, selected conversation or workspace context, tool results, and generated responses needed for AI features. Automatic routing can select different model providers for different requests.
• Stripe: payment processing and subscription management.
• Resend: delivery of account verification and password-recovery emails.
• Slack: internal signup notifications containing the product name, customer name, and email when the signup-notification integration is enabled.

Using AI features sends the content needed for that request to the relevant AI services. For built-in chat, scheduled AI runs, and AI graph filters, we require OpenRouter to route inference only to endpoints classified as zero data retention (ZDR), with provider data collection denied. If no eligible endpoint is available, the request can fail. This is a provider-routing restriction, not a promise that WebCraw stores no data. Workspace content, conversations, and operational records still follow this policy. OpenRouter’s ZDR definition permits in-memory prompt caching; plugins, tools, scripts, and external AI clients are outside this routing guarantee. See OpenRouter’s ZDR documentation.

Workspace members can access information allowed by their permissions. Connected MCP clients and other integrations can receive or change information within the access you authorize. Scripts and scheduled jobs can transmit data to destinations you configure. Those services’ own privacy policies apply to their handling of information.

We may also disclose information when necessary to comply with law, protect rights or safety, investigate misuse, or in connection with a business transfer subject to applicable privacy obligations.

5. Browser and device storage

The website uses local storage for sign-in tokens, the selected workspace, and interface preferences. Clearing storage can sign you out or reset preferences.

We use Vercel Web Analytics to understand site traffic and use. Vercel describes this product as cookie-free analytics; it can process page, referrer, browser, device, and approximate-location information. Learn more in Vercel’s analytics privacy documentation. Necessary authentication and storage are separate from analytics. External billing and connected-service pages may use their own cookies or storage.

6. Retention and deletion

We keep account and workspace information while needed to provide the Service, maintain the records you use, resolve support or security issues, and meet applicable legal obligations. Retention depends on the information’s purpose, your account and workspace status, deletion requests, and legal or dispute-related requirements.

• Application signup-audit records are scheduled for cleanup after 30 days. Cleanup runs in batches, so removal is not instantaneous.
• Unverified non-admin accounts that remain unverified for more than three days are eligible for automated cleanup, including associated data and workspaces with no remaining members.
• Moving a node to Trash does not permanently erase it. History or snapshots can also contain earlier content. Some file deletions permanently remove the stored file.
• Infrastructure logs, provider records, backups, billing records, and internal notifications can follow separate retention schedules. Deleting an item from WebCraw does not automatically remove copies already sent to connected services or other recipients.

To request account closure or deletion beyond individual in-app controls, contact contato@webcraw.ai. We will assess the request, verify identity where needed, and explain any information we must retain. We do not promise immediate removal from all backups or external services.

7. Security and international processing

We use access controls, hashed passwords, encryption for stored secret values, and optional two-factor authentication. No system is completely secure. Protect your account and connected-service credentials and promptly report suspected unauthorized access.

Our infrastructure and service providers may process information in countries other than your own, including the United States. Those countries may have different data-protection laws. International processing is subject to applicable legal requirements and the relevant provider arrangements. Contact us for information about the arrangements applicable to your use; this policy is not a claim that your data stays in a particular country.

8. Your choices and privacy rights

Depending on where you live and the law that applies, you may have rights to confirm processing; access, correct, export, or delete your personal information; request restriction or object to processing; withdraw consent where it is the basis for processing; and complain to a data-protection authority. Withdrawing consent does not undo processing that was lawful before withdrawal. Some rights are subject to legal exceptions.

Send requests to contato@webcraw.ai from your account email where possible. Explain the request and relevant workspace without sending your password, authenticator secret, or recovery codes. We may ask for information necessary to verify your identity or authority and will respond within applicable legal time limits. For an organization’s workspace data, we may direct the request to its administrator or coordinate with it.

You can also control content through available editing and deletion tools, manage workspace permissions, revoke connected access or API keys, and stop future scheduled jobs. Revoking access does not retrieve information already shared. Cancelling a paid plan and deleting personal information are separate requests.

9. Children, policy updates, and contact

WebCraw is intended for adults aged 18 and over. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this policy as our practices or the Service change. We will update the date on this page and provide additional notice of material changes where required. Our Terms of Service govern use of WebCraw.

For privacy questions, requests, or complaints, contact contato@webcraw.ai.