Privacy policy

What we collect about you

Account and billing data you give us directly, and operational data generated by your use of the API.

• Account: name, work email, organisation, and the API keys issued to you.
• Billing: handled by our payment processor. We store the last four digits of a card and an invoice history, never a full card number.
• Operational: request timestamps, actor called, row counts, response status, and the IP the request came from.

Website analytics

With your permission, we load Google Analytics on batscrape.com to understand visits and clicks to our Apify Actor listings. The actor_outbound_click event records the Actor identifier and the page path, not an Actor purchase or run. Analytics is not loaded before you allow it, or on local development and demo sites. Ad measurement is a separate choice that needs analytics: if you allow it, Google Ads can use ad storage and the ad user-data signal to count visits from our ads that reach an Apify listing. Ad personalization always stays disabled. If you arrive from one of our ads, links to Apify in that browser tab omit our affiliate referral code.

Data that passes through the platform

When an actor runs, it fetches content from a source you nominated and writes it to a destination you nominated. That content is yours.

• We retain raw payloads for 30 days so a normalisation bug can be re-derived without re-scraping, then delete them.
• Normalised rows are written to your destination and are not retained by us beyond the run.
• We do not read, index, or train on the content of your runs.
• If a run targets a source that returns personal data, you are the controller of that data and we are the processor. Our data processing terms cover that relationship.

Why we hold what we hold

• To authenticate you and enforce the quota on your plan.
• To meter usage accurately, which is also what your invoice is derived from.
• To keep an audit trail — who called what, when — because you will eventually need it and so will we.
• To investigate abuse and to keep the platform available.

Retention

• Raw run payloads: 30 days.
• Operational and audit logs: 13 months.
• Account and billing records: for as long as the account exists, then 7 years where tax law requires it.
• Deleted accounts: purged within 30 days, except records we are legally required to keep.

Processors we rely on

We use a small number of third parties to run the service. Each is bound by a data processing agreement and none of them receives your data for their own purposes.

• [Cloud provider] — compute and storage, hosted in [region].
• [Payment processor] — billing and invoicing.
• [Transactional email provider] — account and run notifications.

Your rights

If you are in the UK, EU, or another jurisdiction with equivalent law, you can ask us to give you a copy of your data, correct it, delete it, or stop processing it. Write to [email protected] and we will answer within 30 days.

Security

• Payloads are encrypted in transit and at rest.
• API keys are stored hashed; the full key is shown once, at creation.
• Access to production data is limited to the engineers who need it, and every access is logged.
• We do not use customer data in development or staging environments.

Cookies

If you allow analytics, Google Analytics can use first-party cookies such as _ga and _ga_<container-id>; if you also allow ad measurement, Google can add _gcl_ cookies that hold the ad click. We store your choices in local storage for up to 180 days. A visit from one of our ads sets a session-storage flag, with no identifier, that ends when you close the tab. Use Cookie settings in the footer to change your choices at any time. Rejecting a choice removes its cookies and stops further collection; it does not remove information already sent to Google. You can also manage website storage through your browser settings.

Changes

If this policy changes materially we will email account holders before the change takes effect. The date at the top is the last revision.

Contact

[email protected], or [postal address]. Our data protection contact is [name].