datacrawly.io

Privacy Policy

Last updated: October 6, 2026

At datacrawly.io ("DataCrawly", "we", "us", "our") we respect the privacy of the people who use our services and of the people whose businesses appear in our index. This Privacy Policy explains both. Part A is for you if you visit the website, create an account, install the extension or use the API. Part B is for you if your website, or contact details published on it, appear in the DataCrawly index. We process personal data in accordance with the General Data Protection Regulation (GDPR).

The controller of personal data described in this policy is Suprematic Technologies Lda, NIF PT518330150, Rua Raul Duarte Gomes, 2, Bloco A, RC Esq, 2655-320 Ericeira, Portugal.

Part A. If you use DataCrawly

1. What we collect

  • Account data. Name, email address, company, password hash, plan and credit balance, and what you configure in the product (watched domains, streams, criteria, exports).

  • Payment data. Billing address, VAT number and invoices. Orders are processed by our authorised reseller, the Merchant of Record named at checkout: card and other payment details are entered directly with the reseller or its payment providers, and we receive only the order, the billing country, the last digits of the card and the payment status.

  • Usage data. Pages viewed, searches, API calls, credits spent, IP address, browser and device information, and the time of each request. We use this to run, secure and improve the service and to meter credits.

  • Support. Emails and chat messages you send us, including through the website chat widget.

  • Extension observations. If you enable the optional background collector in Technology Inspector: the website domain, the page path, detected technology identifiers, the visit time and a random installation identifier. No page content, query strings, cookies, contacts or incognito visits. Observations are used only for the extension features you use and are never added to the DataCrawly index. They are deleted after 30 days; you can pause the collector, export or delete your data in the extension settings at any time.

  • Cookies and similar technologies. Session cookies to keep you signed in, attribution cookies that remember the campaign or referral that brought you here, and cookies set by the analytics and chat tools listed in Section 4.

2. Why we use it

  • To provide the service. Creating and securing your account, metering credits, delivering streams and reports, answering support requests, invoicing. Legal basis: performance of a contract.

  • To communicate. Transactional emails about your account and, unless you unsubscribe, product updates and educational content. Legal basis: contract for transactional emails; legitimate interest or consent for the rest, with an unsubscribe link in every non-transactional email.

  • To improve and protect. Analytics, abuse and fraud prevention, rate limiting, debugging. Legal basis: legitimate interest.

  • To comply with the law. Tax records, responding to lawful requests. Legal basis: legal obligation.

3. Who we share it with

  • Processors. Hosting and infrastructure providers, payment processing (our authorised reseller, the Merchant of Record named at checkout, which handles orders, invoices, taxes and refunds and is also an independent controller of the payment data it needs, under its own privacy notice), email delivery, analytics (Google Tag Manager and Google Analytics, Hotjar), the website chat provider (Tawk.to) and our own analytics endpoint. Each processor acts on our instructions under a data processing agreement.

  • No selling. We do not sell, rent or trade the personal data of our users. Your criteria, lists and exports are yours and are not shared with other customers.

  • Legal. We may disclose data where required by law, to protect our rights, or in a merger, acquisition or sale of assets, in which case this policy continues to apply.

4. Cookies

  • Types. Session cookies (expire when you close the browser) and persistent cookies (stay until they expire or you delete them). Attribution cookies keep campaign parameters for up to one year.

  • Consent. Hotjar and the chat widget (Tawk.to) are loaded only after you click Accept in the cookie banner. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google analytics (Google Tag Manager and Google Analytics) also runs without analytics or advertising cookies until you click Accept. Elsewhere Google analytics is on by default, and clicking Decline switches its cookies off.

  • Changing your choice. Your answer is stored in a cookie named cookieConsent: for one year after Accept, for the browser session after Decline. To change your choice, delete that cookie (or all cookies for datacrawly.io) in your browser; the banner will ask again on your next visit.

  • Control. You can block or delete cookies in your browser settings. Parts of the service that need a session will stop working without them.

5. Retention

Account data is kept while your account is active and for as long as needed afterwards to resolve disputes and meet legal obligations; invoices are kept for the period tax law requires. Usage logs are kept for a limited period for security and debugging. Extension observations are kept for 30 days. You can ask us to delete your account at any time.

Part B. If your website is in our index

6. What we collect about websites

Our crawler visits publicly accessible pages the same way a search engine does, without logging in, and identifies itself as DataCrawlyBot (see datacrawly.io/bot). From those pages we record:

  • Technical facts. Domain, response headers (without cookies), technologies and versions, hosting, DNS and CDN, page title, language, meta tags, structured data, links, and the parts of the page that evidence a technology.

  • Business facts. The business name, category, addresses and the contact channels the site publishes for the business: role mailboxes (such as info@ or sales@), company phone numbers and company social profiles. We record only role mailboxes and company channels the business publishes; we do not record named individuals.

  • What we do not collect. Content behind logins, form submissions, cookies, contact details a site hides or has removed, personal profiles of individual people, special categories of data, anything a site excludes with robots.txt, and anything observed by our browser extension: extension data never enters the index.

7. Why, and on what legal basis

We process these facts on the basis of our legitimate interests and those of our customers (GDPR Art. 6(1)(f)): mapping which technologies the web runs, and helping businesses find other businesses that match their criteria and reach them through the channels those businesses publish for that purpose. We have weighed this against the interests of the people concerned: the data is already published by the business for the purpose of being contacted, it concerns business roles rather than private life, we collect no personal profiles, and you can object with one email.

8. Where the data comes from

From the public pages of the website itself, crawled by DataCrawlyBot, and from public DNS and certificate records. We do not use data from our browser extension, from logged-in areas or from purchased contact databases.

9. Who receives it

Our customers, under a licence that limits use to their own lawful business purposes, prohibits resale and spam, and makes them responsible for the legality of any messages they send. Public pages of datacrawly.io show technology profiles and aggregate statistics; contact details are shown only to account holders. Our processors (Section 3) host and deliver the data on our instructions.

10. Retention

Technology observations are kept as history so that changes over time can be shown. Published contact details are refreshed on each crawl and removed when the site no longer publishes them or when you ask. Raw page snapshots are kept for up to 90 days so that we can re-parse them, and are then deleted; we never publish them. Contact details whose owners have objected are kept on a suppression list so that they are not collected or shown again, including in customer exports.

11. Site check for verified owners

If you use Site check for your own website (Terms of Service, Section 8), we keep the domain, how and when you verified its ownership, the account that verified it, and the results of each check. The results are visible only to that account and to the staff who need them to run and support the service. We do not publish them, sell them or show them to other customers. You can remove a verified domain and its results at any time.

12. Your rights and how to object

  • Object or erase. Write to us at the address below with the domain or the contact detail concerned. We will stop processing it, remove it from customer-facing results and, if you ask, hide the domain profile from the public site. We answer within 30 days, usually much sooner.

  • Block the crawler. Add a robots.txt rule for DataCrawlyBot as shown at datacrawly.io/bot. We honour it on the next visit and stop collecting from that site.

  • Access and rectification. You can ask what we hold about your domain or your contact detail and ask us to correct it.

  • Complain. You can lodge a complaint with your national data protection authority. Our lead authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD).

Part C. Common provisions

13. Security

We use reasonable technical and organisational measures to protect data against unauthorised access, alteration and loss: encrypted transport, access controls, isolated crawler infrastructure and audit logs. No system is perfectly secure and we cannot guarantee absolute security.

14. International transfers

Our servers are in the European Union. Some processors may process data outside the European Economic Area; where they do, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

15. Children

The service is for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children.

16. Changes to this policy

We may update this policy. The current version, with its date, is always at datacrawly.io/privacy. Material changes are announced by email to account holders or by a notice on the website before they take effect.

17. Contact

Questions, objections and data subject requests, including for the data protection officer: