Privacy Policy · Pageteer

1. Who we are

Pageteer is operated by Juracich Holdings LLC, 1020 Kristi Lane, Tomah, WI 54660, USA ("we", "us"). This policy explains what personal data we handle when you use our website, dashboard and API, and the choices you have.

2. Account and billing data

Account data: your name, email address, whether you verified it, a password hash (we never store your password), team name, team members and roles, and the date and version of the Terms you accepted.
Invitations: the email address of anyone you invite to your team, and a hash of the invitation link.
API keys: a SHA-256 hash of each key, a short prefix for display, its name, its mode (live or test), the project label you give it, and who created it. We cannot show you a key again after creation.
Your team's proxy: if your team saves its own proxy (Settings → Proxy), we store its URL, including the username and password in it, encrypted with AES-256-GCM and bound to your team, together with the provider you picked, when it was last changed and the result of the last proxy test (time, exit IP and country, or the error). We decrypt the URL only to send your team's requests through it; it is never shown back in full, never logged, and deleted when you remove it or delete the team. If you enter the price you pay your provider per GB (on the Usage page), we store it to show you cost estimates.
Billing data: handled by Stripe. We give Stripe your team name, a billing email and our internal team id, and report your monthly usage to it. We receive your subscription status, plan and a customer reference, not your card details.
Security and audit data: counters of sign-in, sign-up, password-reset and email attempts, keyed by email address (hashed) and IP address, which expire automatically after their rate-limit window (at most one day); and a log of team actions (such as team creation, key creation, changes and revocation, billing changes and proxy changes, never the proxy URL itself), kept while the team exists.

3. Cookies

We use one strictly necessary cookie: an encrypted, HTTP-only session cookie that keeps you signed in to the dashboard for up to 14 days. We do not use analytics, advertising or other third-party tracking cookies on our website or dashboard.

4. API request logs

For each API request (and each page of a crawl or URL of a batch) we log: the endpoint, the target URL and host, the HTTP status we returned, the unblocking tier used, whether the target blocked us, the credits charged, the time taken, the bytes sent through a residential proxy and whose proxy it was, whether a test key was used, an error code if any, the API key and team used, a request id and the time. For search requests we log the query text instead of a target URL. We keep these logs for 30 days, after which the database deletes them automatically. We use them to bill you, show you your usage, debug problems and detect abuse.

We also keep daily usage totals for each API key: per UTC day and endpoint, the number of requests, credits charged, errors, blocked requests, proxy bytes, browser and HTTP fetches and the total time taken, and whether the key is a test key. These totals contain no URLs, search queries or page content. We keep them for 400 days, then the database deletes them automatically. They power the usage page and the usage API, so you can see usage per key and project beyond the 30-day request log.

We never store request or response bodies (the pages you fetch, extracted data, screenshots or PDFs) in these logs.

Our API servers also keep operational access logs (IP address, request path and query with API keys redacted, status and timing) for troubleshooting and security. They are rotated automatically by size and are not used for billing. Each service keeps at most about 50 MB of these logs, which typically covers days, not weeks.

5. Page content and results

Page content, extracted data, screenshots and PDFs are generated to answer your request and returned to you in the API response. In addition:

Crawls: the pages a crawl collects are stored with the crawl job so you can retrieve them, and deleted automatically 30 days after the job was created.
Batches and webhooks: batch jobs, each URL's result and the webhook deliveries we send to your endpoint are stored so you can retrieve them, and deleted automatically 30 days after creation.
Caches: if you ask for a cached result (max_age), the fetched page and the result built from it (such as extracted data, a screenshot or a PDF) are stored in server memory and, up to a size limit, in our database, so the copy survives restarts and can be reused by any of our API servers. Cached results are scoped to your team and never served to anyone else. They expire 24 hours after the page was fetched, however often they are reused, and are then deleted automatically. Requests without max_age are not cached. Search results are cached the same way for up to 24 hours (6 hours by default) and may be served to other customers who run the same search; they contain only public search results, not who searched.
Rendering diagnostics: our rendering engine keeps, in memory only, a screenshot of the most recent browser renders (at most 30) so our operators can diagnose rendering problems. They are never written to disk and are lost on restart.

Pages you fetch may contain personal data about third parties. You decide what to fetch and are responsible for your use of it under the Acceptable Use Policy and applicable law.

6. How we use data

To provide the Service: authenticate you, run your requests, meter credits and bill you.
To secure the Service: rate limiting, abuse detection and enforcing the Acceptable Use Policy.
To communicate with you: email verification, password reset, invitations, spend and billing alerts, and important service notices.
To improve the Service using aggregated, non-identifying statistics.

7. Service providers

We use these providers to run the Service. They process data on our behalf:

Vercel: hosting for the website and dashboard.
DigitalOcean: cloud servers in New York, USA that run the API gateway, the rendering engine and the search service.
DigitalOcean Managed MongoDB: the database (in New York, USA) for accounts, keys, credits, request logs, crawl and batch results, including its backups.
Stripe: payments, invoicing and usage-based billing.
Resend: transactional email (verification, password reset, invitations and billing notices).
Anthropic: only when you use schema-based (LLM) extraction, the page's URL, its text and your schema are sent to Anthropic's API to produce the extracted data.

Your proxy provider. We do not run a residential proxy network of our own. When your team saves its own proxy, requests that use the residential tier are sent through it, so that provider sees the target URL and your request's traffic to the site. You choose and contract with that provider: it acts for you (it is your service provider or processor, not ours), and its own terms and privacy policy apply.

Search engines. To answer search requests, our servers send your query text (and any language, country or location you set) to third-party search engines such as Bing, Yandex, DuckDuckGo, Google, Brave and Wikipedia, through our self-hosted SearXNG service. We do not send them your identity, your API key or your IP address; those engines receive the query from our servers and apply their own privacy policies. Do not put personal data in search queries.

Target websites you ask us to fetch see a request from our servers (or from your proxy), not from you, and receive only what the request needs (the URL and, if you set them, your headers and cookies).

We do not sell personal data and do not use it for advertising.

8. Retention and deletion

API request logs: 30 days, then deleted automatically.
Daily usage totals per key (counts, credits, bytes and durations; no URLs or content): 400 days, then deleted automatically.
Crawl results: 30 days after the crawl was created.
Batch jobs, results and webhook deliveries: 30 days after creation.
Cached results you ask for with max_age, and cached search results: they expire at most 24 hours after the page or search was fetched, then are deleted automatically.
Rate-limit counters: until their window ends (at most one day).
Your team's proxy URL and credentials: until you replace or remove them in Settings → Proxy, or delete the team. Our servers may keep using a removed proxy for up to a minute while cached settings expire.
Account and team data: for as long as your account or team exists. A team owner can delete the team from the dashboard settings: its API keys are revoked at once, any open subscription is canceled with a final invoice, and its keys, usage and credit records, request logs, crawl and batch results, invitations, audit log, saved proxy and membership are deleted immediately. You can delete your own account from the account page once you no longer own a team; this deletes your profile, memberships and pending email tokens and revokes the keys you created. Entries in another team's audit log that refer to your user id stay with that team.
Backups: deleted data may remain in encrypted database backups until they expire, 7 days at most.
Billing records: kept by Stripe for as long as tax and accounting law requires.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data and to object to or restrict some processing. You can delete your account and team yourself from the dashboard; for anything else contact privacy@pageteer.dev. You can also complain to your local data-protection authority.

If you are in the EEA or the UK: we process account, billing and usage data to perform our contract with you, request logs and security data for our legitimate interests in running, securing and preventing abuse of the Service, billing records to meet legal obligations, and anything optional only with your consent. Data is processed in the United States; where required we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) for these transfers.

If you are in California: we do not sell or share your personal information, or use it for cross-context behavioral advertising. You may ask to know, correct or delete the personal information we hold about you, and we will not discriminate against you for using these rights. Contact privacy@pageteer.dev.

10. Security

See our Security page for how we protect data. No system is perfectly secure; tell us at security@pageteer.dev if you find a problem.

11. Changes and contact

We will post changes here and, for material changes, notify account owners by email. Questions: privacy@pageteer.dev.