crawlbrulee for your DPO

this is general information, not legal advice. each answer links to the live clause, so a newer version of a document always wins.

these are the questions DPOs and procurement teams ask us most. each answer is short and links to the clause in our public legal documents that backs it, so you can check every line yourself.

the documents are the binding text; this page is a summary of them.

crawlbrulee is a web scraping api run by SC YLEMBYTES SRL, a company registered in Romania, in the EU. no vendor can make you compliant, so we don't print a badge that says so. what we can do is make our half easy to check.

is crawlbrulee my processor or a controller for the pages I scrape?

crawlbrulee is your processor. for personal data in the pages you scrape, you are the controller (or a processor, if you work for your own customers), we are your processor (or subprocessor), and each api request is your documented instruction. we are a separate controller for our own records: your account, billing and usage, security and abuse logs, service performance and capacity planning, statistics and product-improvement data that cannot identify you, a person or a target, and our own legal duties.

source: DPA §1 roles · DPA §2 instructions · terms §8

is the DPA public? can I sign it without talking to sales?

yes. the DPA is public, is part of our terms, and applies to every customer from signup with nothing to sign. if your procurement process needs a countersigned copy, write to contact@crawlbrulee.com and we sign the same version as a pdf.

source: DPA, opening paragraph

where do fetching, rendering, caching and results run?

on crawlbrulee's core infrastructure at Scaleway in 🇫🇷 France, in the 🇪🇺 EU: the fetch, the render, the cache and the stored results.

three things reach outside it. our subprocessors page lists each one:

• screenshots (if requested) are delivered through Bunny.net's content delivery network. Bunny.net is an EU company, but its edge locations are worldwide.
• diagnostic logs are held by Grafana Labs in the EU. Grafana Labs is a US company, so any access from the US is a transfer. it is covered by the European Commission's standard contractual clauses (SCCs, module three).
• proxy exits. when you don't pick a country, the request exits from an EU member state. if your request asks for an exit outside the EU, the target site is reached from there, and that exit counts as a processing location.

source: privacy §8 international transfers · DPA §11 international transfers · subprocessors table · docs: location

how long does crawlbrulee keep results, including backups?

crawlbrulee keeps results for 90 days at most, and they may be deleted sooner. that limit covers every copy we hold: stored results, the cache, backups and copies on the content delivery network. when you close your account, you can first download any results we still hold through the api, or ask us to delete them right away. if you don't tell us, we delete them.

source: DPA §9 deletion and return · privacy §9 how long we keep data · terms §6 caching

what do crawlbrulee's logs hold? does crawlbrulee log page content?

crawlbrulee never logs the page content it fetches. our logs do hold the target urls you send, in full, with their query strings. we say so plainly because a url can itself contain personal data.

here is exactly what is in our logs, and what is out:

• in: ip addresses, timestamps, endpoints, request options, response codes and diagnostic ids.
• out: page content. it never reaches our logs, whatever your settings.
• out: the headers and cookies you send to the target.
• out: marketing tags such as utm_* and gclid. we remove them from urls before logging.
• shortened: webhook urls, logged as the host name only.
• with zero data retention on, the full url stays out of our logs too; we keep only the target's domain name, for abuse prevention.

logs are kept for up to 90 days. our performance monitoring (AppSignal, in the EU) can also see a requested url when zero data retention is off. it never sees request bodies, cookies, credentials or page content.

source: DPA annex 2 (zero data retention) · privacy §4.3 request metadata and logs · subprocessors table

does crawlbrulee send scraped content to an AI provider, or train on it?

no.

crawlbrulee does not send scraped content, results, your account data or your support chats to any provider for AI processing or model training, and we do not train anything on your content or sell personal data. if we ever add a feature that uses an AI provider, we list that provider as a subprocessor before it can touch your data, and your content is not used for training without your explicit agreement.

source: privacy §3 the short version · privacy §5 · terms §11 AI features

is the subprocessor list public?

yes.

for each subprocessor it shows where the company is based, where the data sits, what we send and how long it is kept. we email account owners at least 14 days before a new subprocessor or a material change takes effect (shorter only when security, law or keeping the service running needs it, and always before it first touches your data). you can object, and if we can't resolve it, you can end the affected subscription with a refund for the unused part.

source: subprocessors · DPA §6 subprocessors

how does a person get their data removed?

anyone who finds themselves in a page scraped through us can write to contact@crawlbrulee.com with the exact urls and any result or job ids.

we make reasonable efforts to remove the cached copies of those urls as soon as possible, pass the request on to the customers concerned where we can tell who they are, and anything not removed expires under the 90-day limit.

what you do with results you already received is your decision, as controller; you can also ask us to remove the cached copies your own organization's requests produced.

source: privacy §5 · DPA §7 assistance

which uses does crawlbrulee ban?

the acceptable use policy is part of the terms every customer accepts. among other things it bans:

• people-search, surveillance or dossier services that profile, locate or monitor people;
• making special categories of data (health, political opinions, religion, biometric data and the like) a systematic target;
• consumer credit, tenant, job or insurance screening, and deciding eligibility for government licenses or benefits;
• law-enforcement or intelligence use;
• automated decisions with legal or similarly significant effects without the safeguards the law requires;
• unlawful use, including spam, and getting past logins or paywalls without the account owner's permission.

this is not a complete list of our banned use-cases. for the complete list, please consult the links below.

source: acceptable use §1 · §2 · §3 personal data · §4 prohibited purposes · DPA §3

can my results stay out of any shared cache?

yes, with zero data retention.

send zero_data_retention: true and the new result stays out of the shared cache. anything we have to store in order to deliver it, such as an async result or a screenshot, is kept for 24 hours, then deleted. with zero data retention, your url stays out of our logs too; we keep only the target's domain name, for abuse prevention.

it comes with our enterprise plan. on certain occasions, we may consider enabling it for an organization on another plan: write to sales@crawlbrulee.com. we can also force it "on" for every request in your organization, so a request that leaves the field out is still covered.

it adds 1 credit to each billed result that did not come from the cache. reading from the cache is still allowed, so for a fresh result every time also set cache.max_age to 0.

source: DPA annex 2, shared content cache · terms §6 caching · privacy §5 · docs: zero data retention

also asked

a full review often goes further. these are the next questions we hear.

does crawlbrulee have a data protection officer?

no, crawlbrulee has not appointed one. privacy questions go to contact@crawlbrulee.com and reach the people who run the service; we answer within one month (the GDPR allows up to two more months for complex requests, and we tell you if we need them). our lead supervisory authority is the Romanian ANSPDCP.

source: privacy §11 your rights · imprint

who at crawlbrulee can see my results?

at crawlbrulee, only people bound by confidentiality, and only as far as running the service and resolving issues you raise needs.

if we have reasonable grounds to believe specific requests break the terms or the acceptable use policy, we may look at the content of those requests, only as far as the investigation needs. separately, we may review your target urls, request metadata and usage patterns at any time, to run, secure and protect the service.

source: DPA §4 confidentiality · DPA §2 instructions · terms §8

how does crawlbrulee tell me about a breach?

crawlbrulee notifies you as soon as possible after it becomes aware of a personal data breach affecting your scraped content, with the information you need for GDPR Art. 33(3), and more as our investigation goes on.

source: DPA §8 personal data breaches

can I audit crawlbrulee?

yes. first you review our documents: the DPA, the subprocessor list, annex 2 and our written answers. if they don't show a duty the GDPR asks of a processor, you or an independent auditor can run a proportionate audit, at most once every 12 months on 30 days' notice. §10 sets out the rest, including how costs are handled.

source: DPA §10 audits

does crawlbrulee hold a security certification such as ISO 27001 or SOC 2?

we do not hold one today, though we are building our systems to meet both standards, so we can get certified later.

references

every answer above rests on our legal documents. the full list, with the latest version of each, is at crawlbrulee.com/legal.

other references:

• GDPR: Regulation (EU) 2016/679, Art. 12, 28 and 33
• standard contractual clauses for transfers: Commission Implementing Decision (EU) 2021/914
• Romania's data protection authority: ANSPDCP

contact

questions about anything on this page reach the people who run the service.

• privacy, legal, removal requests and a countersigned DPA: contact@crawlbrulee.com
• website operators reporting abuse: abuse-reports@crawlbrulee.com
• plans and enterprise: sales@crawlbrulee.com

this page is not legal advice. for a decision on a real project, talk to a lawyer or your DPO.